Privacy Policy

1. Introduction

Stanalytics HR Solutions ("Stanalytics", "we", "us", or "our") respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains what information we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have over your information.

This policy applies to our website stanalyticshr.co.ke and to the enquiries and communications we handle through it. Where we process personal data on behalf of a client as part of a consulting engagement, we do so under the terms of the relevant services agreement and that client is the data controller.

For the purposes of applicable data protection law, including the Kenya Data Protection Act, 2019, the data controller is Stanalytics HR Solutions. Our contact details are in section 13 below.

2. Information we collect

We only collect the information we need to respond to you, deliver our services, and operate our website.

Information you give us

• Your name, email address, and telephone number
• Company name, job title, and industry
• The content of your message or enquiry, and any details you choose to share
• Your communication preferences and consent choices

Information collected automatically

• IP address and approximate location
• Browser type, device type, and operating system
• Pages viewed, links clicked, referring page, and time on site
• Cookie and consent preferences (see our Cookie Policy)

Information from other sources

We may occasionally receive your business contact details from a colleague, a referral, or a publicly available professional source. We do not purchase personal data from data brokers, and we do not knowingly collect special categories of personal data (such as health or biometric data) through this website.

3. How we use your information

We will not use your information for materially different purposes without first informing you and, where required, obtaining your consent. You can opt out of marketing communications at any time using the unsubscribe link in our emails or by contacting us.

4. Legal bases for processing

We process personal data only where we have a valid legal basis. Depending on the circumstances, this will be one or more of the following:

• Consent – for example, when you subscribe to our newsletter. You may withdraw consent at any time.
• Contract – where processing is necessary to enter into or perform an agreement with you.
• Legal obligation – where we must comply with a legal or regulatory requirement.
• Legitimate interests – where processing is necessary for our legitimate business interests, such as responding to enquiries, securing our website, and improving our services, and those interests are not overridden by your rights.
• Vital interests – in the rare case where processing is necessary to protect life or safety.

Where we rely on legitimate interests, we carry out a balancing assessment and you have the right to object (see section 10).

5. Cookies and similar technologies

We use a small number of cookies and similar technologies to keep the website secure, remember your cookie choice, and understand how the site is used. Essential cookies are needed for the website to function; analytics cookies help us improve the experience and are used only where permitted.

You can manage your preferences through our cookie banner and your browser settings. For full details, see our Cookie Policy.

6. Sharing and disclosure

We do not sell your personal data. We share it only where necessary, and with appropriate safeguards:

• Service providers that help us operate, such as hosting, email, analytics, and IT providers, bound by confidentiality and data protection obligations.
• Professional advisers such as lawyers and accountants, where required.
• Legal and regulatory authorities, where we are required to disclose information or to establish, exercise, or defend legal claims.
• Business transfers in connection with a merger, acquisition, or sale of assets, in which case we will take reasonable steps to ensure your data remains protected and you are informed.

In consulting engagements, we handle client and employee data strictly in accordance with the relevant agreement, our confidentiality obligations, and applicable data protection law.

7. International data transfers

Some of our service providers may store or process data in countries outside your own. Where we transfer personal data internationally, we take steps to ensure it receives an adequate level of protection, including relying on appropriate contractual safeguards and selecting providers that meet recognised data protection standards.

8. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, and to meet our legal, accounting, and reporting obligations. The appropriate period depends on the nature of the data and the context in which we collected it.

• Newsletter subscriptions are kept until you unsubscribe or ask us to remove them.
• Enquiries and prospect information are kept for as long as needed to respond and maintain the relationship, after which they are deleted or anonymised.
• Client engagement records are kept for the term of the engagement and for the period required by law or our professional obligations.

When data is no longer needed, we securely delete it or anonymise it so that it can no longer identify you.

9. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include access controls, encryption of data in transit, the principle of least privilege, secure service providers, and confidentiality obligations for our staff and contractors.

While we work hard to protect your information, no method of transmission over the internet or method of electronic storage is completely secure, so we cannot guarantee absolute security.

10. Your rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Access – request a copy of the personal data we hold about you.
• Rectification – ask us to correct inaccurate or incomplete data.
• Erasure – ask us to delete your personal data in certain circumstances.
• Restriction – ask us to limit how we use your data.
• Objection – object to processing based on our legitimate interests, or to direct marketing.
• Portability – receive certain data in a structured, commonly used, machine-readable format.
• Withdraw consent – where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Automated decisions – not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, or with the supervisory authority in your country of residence.

11. Children's privacy

Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children under the age of 18 through this website. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will revise the "Last updated" date at the top of this page. If we make a material change, we will take reasonable steps to bring it to your attention.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

You can also reach us through our contact page.