Home / Privacy Notice
Privacy Notice
Last updated: 30 October 2026. Version privacy-2026-10-30.
1. Who we are
Databexx Limited (“Databexx”, “we”, “us”) is the controller of the personal data described in this notice. We are a digital consulting, technology and training partner, and this notice explains how we collect, use, share and protect personal data when you visit www.databexx.com, contact us, or use our services.
This notice is written to meet the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, which apply to us as a company established in Kenya, and the transparency requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), including Articles 13 and 14.
| Item | Details |
|---|---|
| Controller | Databexx Limited |
| Privacy contact | info@databexx.com |
| Website | www.databexx.com |
This notice covers visitors to our website, people who contact us, prospective and existing clients, training participants, and subscribers to our communications. It does not cover personal data we process on behalf of clients under a separate data processing agreement.
2. Personal data we collect
We collect personal data you give us directly, data generated when you use our website, and limited data from service providers who support our business.
- Identity and contact. Your name, email address, phone number, company, job title and country, which you give us through website forms, email, WhatsApp or events.
- Enquiry details. The service you are interested in, your message and your preferred contact method, which you give us through website forms and WhatsApp Business.
- AI self-assessment and AI Readiness Audit. Your answers about your organisation’s data, systems and AI use, and the resulting score or report, collected through online assessment forms and audit sessions.
- Training records. Course registration, attendance, progress, assessment results and certificates issued, provided by you and generated through our training delivery.
- Billing and payment. Billing name and address, invoice details, amount paid and payment reference, provided by you and our payment provider. We do not receive or store full card details.
- Communication preferences. Your newsletter subscription, marketing consents and opt-outs, which you give us directly.
- Communications. Emails, WhatsApp messages and call notes exchanged between you and us.
- Technical and usage. Your IP address, device and browser type, pages viewed, referring site, approximate location and cookie identifiers, collected from your device through cookies and similar technologies, with your consent where required.
- Advertising interactions. Whether you reached our website from one of our advertisements and the actions you took afterwards, received from advertising platforms with your consent.
We do not intentionally collect special categories of personal data (such as health, religious or biometric data). Please do not include such data in forms or messages.
3. How we use personal data and our lawful bases
We use personal data only for specified purposes, each supported by a lawful basis under Article 6(1) GDPR.
- Enquiries and proposals. We use your contact details, enquiry details and communications to respond to enquiries, arrange consultations and prepare proposals. We do this to take steps at your request before entering a contract (Art. 6(1)(b)), or, for enquiries made on behalf of an organisation, in our legitimate interest in responding to business enquiries (Art. 6(1)(f)).
- AI self-assessment and AI Readiness Audit. We use your contact details and assessment responses to provide your results and deliver the audit, as steps taken at your request before a contract or to perform a contract (Art. 6(1)(b)).
- Consulting and managed services. We use your contact details, communications and billing information to deliver consulting, managed services and platform implementations, to perform our contract with you (Art. 6(1)(b)).
- Training. We use your contact details and training records to register participants, deliver training and issue certificates, to perform our contract with you (Art. 6(1)(b)).
- Billing and payments. We use your contact and billing information to invoice, collect payments and keep financial records, to perform our contract (Art. 6(1)(b)) and to meet our legal obligations (Art. 6(1)(c)).
- Newsletters and insights. We use your contact details and communication preferences to send newsletters, insights and event invitations with your consent (Art. 6(1)(a)). For existing clients, we may share updates on similar services in our legitimate interest, with an opt-out in every message (Art. 6(1)(f)).
- Website analytics. We use technical and usage data to measure website use and improve the site, with your consent (Art. 6(1)(a)).
- Advertising measurement. We use technical data and advertising interactions to measure and improve our advertising, with your consent (Art. 6(1)(a)).
- Client relationships and service improvement. We use contact details, enquiry details and communications to manage client relationships and improve our services, in our legitimate interest in running and developing our business (Art. 6(1)(f)).
- Security. We use technical and usage data to secure our website and systems and prevent misuse, in our legitimate interest in protecting our services (Art. 6(1)(f)).
- Legal claims and compliance. We use relevant data to establish, exercise or defend legal claims and respond to regulators, to meet our legal obligations (Art. 6(1)(c)) and in our legitimate interest (Art. 6(1)(f)).
Where we rely on legitimate interests, we have balanced those interests against your rights. You may object at any time (see section 8).
Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.
If you do not provide data needed to enter or perform a contract, we may be unable to provide the requested service.
4. Cookies and tracking technologies
We use strictly necessary cookies to run the website and, only with your consent, analytics and advertising cookies. Non-essential cookies are not set until you accept them in our cookie banner.
| Type | Purpose | Provider | Consent needed |
|---|---|---|---|
| Strictly necessary | Site operation, security, form submission, remembering your cookie choices | Databexx and our hosting provider | No |
| Analytics | Understanding how visitors use the site, using aggregated statistics | Google Analytics (Google) | Yes |
| Advertising | Measuring the effectiveness of our advertisements and reaching relevant audiences | Meta Pixel (Meta Platforms) | Yes |
You can accept, reject or change your choices at any time through the cookie settings link in the website footer, or by adjusting your browser settings. Rejecting non-essential cookies does not affect your ability to use the site.
A full list of cookies, their lifespans and providers is set out in our Cookie Policy.
5. Who we share personal data with
We do not sell personal data. We share it only with service providers who help us operate, under contracts that require them to protect it and use it only on our instructions, or where the law requires.
| Recipient category | Role |
|---|---|
| Customer relationship management | Storing enquiries, client contacts and communication history |
| Email and productivity | Business email, documents and scheduling |
| Messaging | Enquiries and client communication through a business messaging platform |
| Accounting and invoicing | Issuing invoices and maintaining financial records |
| Payment processing | Processing card and mobile payments |
| Website hosting | Hosting and securing the website |
| Website analytics | Usage statistics, with your consent |
| Advertising | Advertising measurement, with your consent |
Our payment and advertising providers may also act as independent controllers for some processing under their own privacy notices. A list of our current service providers is available on request.
We may also disclose personal data:
- to professional advisers, such as lawyers, accountants and auditors, under confidentiality obligations
- to courts, regulators or law enforcement where required by law
- to a buyer or successor if Databexx is involved in a merger, acquisition or sale of assets, subject to equivalent protections
- to delivery partners or co-facilitators for a specific engagement or training programme, where you have been informed in advance
6. International transfers
Databexx operates outside the European Economic Area and works with service providers whose infrastructure may be located in other countries, including the United States, the European Economic Area and India. Personal data you share with us may therefore be processed outside your country of residence.
Under the Kenya Data Protection Act, 2019, we transfer personal data outside Kenya only where the conditions in sections 48 and 49 of the Act are met, for example where the recipient gives appropriate safeguards for the security and protection of the data through the data processing terms in our provider contracts.
Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on one of the following safeguards:
- an adequacy decision of the European Commission, where one applies
- the EU-U.S. Data Privacy Framework, where the recipient is certified
- Standard Contractual Clauses approved by the European Commission, with supplementary measures where needed
You may request a copy of the relevant safeguards by contacting info@databexx.com.
7. How long we keep personal data
We keep personal data only as long as needed for the purposes in section 3, then delete or anonymise it.
| Data | Retention period |
|---|---|
| Enquiries and leads that do not become clients | 24 months after our last contact |
| Client contact and engagement records | Duration of the engagement plus 6 years |
| Financial and billing records | As long as required by applicable tax and accounting law |
| Training records and certificates | 5 years after course completion, to verify certificates |
| AI self-assessment responses | 24 months after submission, unless you become a client |
| WhatsApp and email communications | 24 months after the last message, unless part of a client record |
| Marketing consents and opt-outs | Until you unsubscribe; opt-out details are kept to honour your choice |
| Analytics data | 14 months |
| Advertising data | As set by Meta Platforms under its data policy |
We may keep data longer where needed to establish, exercise or defend legal claims, or where the law requires.
8. Your rights
Under the Kenya Data Protection Act, 2019 and, where it applies, the GDPR, you have the following rights over your personal data, subject to certain legal conditions:
| Right | What it means |
|---|---|
| Access | Obtain confirmation that we process your data and a copy of it |
| Rectification | Have inaccurate or incomplete data corrected |
| Erasure | Have your data deleted where there is no reason for us to keep it |
| Restriction | Ask us to limit how we use your data in certain circumstances |
| Data portability | Receive data you gave us in a structured, machine-readable format, or have it sent to another organisation |
| Objection | Object to processing based on legitimate interests; you may object to direct marketing at any time |
| Withdraw consent | Withdraw consent at any time, including for marketing and non-essential cookies |
| Automated decisions | Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects |
How to exercise your rights. Email info@databexx.com with the subject line “Privacy request”. We may ask you to verify your identity. We respond within the time limits of the Kenya Data Protection (General) Regulations, 2021: 7 days for access requests, 14 days for correction, erasure, restriction or objection, and 30 days for data portability. These limits also meet the GDPR deadline of one month. Requests are free unless they are manifestly unfounded or excessive.
Unsubscribing. Every marketing email contains an unsubscribe link. For WhatsApp, reply “STOP” or tell us you no longer wish to receive messages.
Complaints. We encourage you to contact us first so we can resolve your concern. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner in Kenya (www.odpc.go.ke) or with another data protection supervisory authority, in particular in the EU or EEA country where you live, work or where the alleged infringement occurred.
9. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, role-based access controls, multi-factor authentication on business systems, and due diligence on service providers. No system is completely secure; if a personal data breach is likely to result in a high risk to you, we will notify you without undue delay.
10. Automated decision-making
Our AI self-assessment produces an indicative readiness score from your answers. The score informs our recommendations only and does not produce legal or similarly significant effects. We do not make decisions about individuals based solely on automated processing.
11. Children
Our website and services are intended for businesses and professionals. They are not directed at anyone under 18, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Links to other websites
Our website may link to third-party sites and platforms. We are not responsible for their privacy practices, and we encourage you to read their privacy notices.
13. Changes to this notice
We review this notice regularly and may update it to reflect changes in our services, providers or the law. The current version is always available on our website, with the date it was last updated. Where changes are material, we will notify you by email or through a notice on the website.
14. Contact us
For any question about this notice or how we handle personal data, contact:
Databexx Limited
Email: info@databexx.com
Website: www.databexx.com