Who we are
This website, ony-group.com, is operated by Ony Group Limited [To confirm: registration number and registered address], based in Nairobi, Kenya (“Ony Group”, “we”, “us”).
For the personal data described in this notice, Ony Group Limited is the data controller under the Data Protection Act, 2019 (the “Act”). [To confirm: Ony Group’s registration status with the Office of the Data Protection Commissioner (ODPC) and registration number]
What this notice covers
This notice explains how we handle personal data when you visit ony-group.com, contact us by email, or submit an enquiry through the Work With Us form. It does not cover services we provide under a separate engagement, which are governed by the terms of that engagement.
Information we collect
When you submit the Work With Us form, we collect the information you choose to provide:
- About you — your name, work email address, phone number and role or title.
- About your organisation — organisation name, industry, and a description of what the organisation does or sells.
- About your enquiry — the type of support you are looking for, what you are trying to achieve and what is getting in the way, your current stage and when you would like to start.
- Company profile — any document you choose to upload. Please only upload documents you are authorised to share, and avoid including personal data about other people unless it is necessary.
- Your confirmations — a record that you accepted this Privacy Notice and our Terms of Use, with the version and time of acceptance.
- Submission details — a submission reference, the date and time of submission, the page or link from which you made the enquiry, and campaign information contained in the link (for example, where you arrived from a shared link).
When you visit the website, our hosting provider processes technical information such as your IP address, browser type and the pages requested, for the purposes of delivering the website and protecting it against abuse. We may also record the approximate country from which an enquiry was submitted.
We do not ask for, and you should not submit through the form, sensitive personal data (such as health information or national identification numbers), passwords, or payment card details.
How we use it
- To review and assess your enquiry and decide whether there is a fit with the work we do.
- To contact you about your enquiry and any potential engagement.
- To keep an internal record of the enquiry and the resulting opportunity in our client relationship management (CRM) system.
- To operate, secure and improve this website, including preventing spam and misuse of the form.
- To comply with our legal obligations and to establish, exercise or defend legal claims.
We do not sell your personal data, and we do not use the information submitted through the form for automated decision-making that produces legal or similarly significant effects on you. We will not send you marketing communications unless you separately agree to receive them.
Our lawful basis
Under the Act, we process your personal data on the following bases:
- Consent — you consent to us processing the information you submit when you send an enquiry. You may withdraw consent at any time (see Your rights); this does not affect processing already carried out.
- Steps before a contract — processing needed to take steps at your request before potentially entering into an engagement with you or your organisation.
- Legitimate interests — operating and securing our website and keeping appropriate business records, where those interests are not overridden by your rights.
- Legal obligation — where we must retain or disclose information to comply with the law.
[To confirm with counsel: final position on lawful bases under section 30 of the Act]
Transfers outside Kenya
Some of our service providers store or process data outside Kenya. Where personal data is transferred outside Kenya, we do so in accordance with the Act and its regulations — for example, where appropriate safeguards are in place for the protection of the data, or where you have consented to the transfer. [To confirm: data locations of each provider and the transfer mechanism relied upon]
How long we keep it
We keep enquiry information only as long as it is needed for the purposes described in this notice. If your enquiry does not lead to an engagement, we will delete or anonymise it within [To confirm: e.g. 24 months] of our last contact with you, unless we need to keep it longer to comply with the law or resolve a dispute. If it leads to an engagement, it will be retained in line with the records requirements for that engagement.
Technical logs held by our hosting provider are retained for limited periods in line with that provider’s standard practices.
Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), restricted access to enquiry records and uploaded documents, and server-side handling of form submissions. No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the Data Protection Commissioner and, where required, you, in accordance with the Act.
Your rights
Subject to the Act, you have the right to:
- be informed of the use to which your personal data is put;
- access your personal data in our custody;
- object to the processing of all or part of your personal data;
- request correction of false or misleading data;
- request deletion of false or misleading data, or of data we are no longer authorised to retain;
- withdraw your consent at any time; and
- where applicable, receive your personal data in a structured, commonly used and machine-readable format (data portability).
To exercise any of these rights, email our Data Protection Officer at dpo@ony-group.com. We may need to verify your identity before acting on a request, and we will respond within the time required by law.
Children
This website and the Work With Us form are intended for businesses and professionals. They are not directed at children, and we do not knowingly collect personal data from anyone under 18.
Changes to this notice
We may update this notice from time to time. The version and date at the top of this page show when it was last revised. Material changes will be highlighted on this page.
Contact and complaints
Ony Group has designated a Data Protection Officer. For privacy questions or requests, contact dpo@ony-group.com. For general enquiries, contact hello@ony-group.com.
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner, Kenya (odpc.go.ke).