Privacy notice

Rosewood Technology Risk & Consulting Group, of Woodland Business Park, First Floor, Suite Three, Nairobi, Kenya, is the data controller for personal data collected through this website. You can reach us at taarifa@techrisk.co.ke or on +254 721 687846.

This notice is issued under the Data Protection Act, No. 24 of 2019 (Kenya). It covers this website only. Personal data we process while delivering a client engagement is governed by the engagement letter and any processor agreement signed with that client.

We collect only what the enquiry form asks for. There is no analytics tracker, no advertising pixel, and no third-party script on this site.

• Full name and work email address — required, so that we can identify you and reply.
• Phone number and organisation — optional, so that we can reach you by the channel you prefer and understand the context of the enquiry.
• Service of interest and how you found us — optional, so that we route the enquiry to the right people.
• Your message — required, because it is the enquiry itself.
• The time the form was opened — collected to reject automated submissions. It identifies nobody.

Our web host records standard server logs, including a truncated record of the request. To rate-limit the enquiry form we store a one-way hash of the requesting IP address; the address itself is never written to disk by us.

We rely on your consent, given by ticking the consent box on the enquiry form, to receive and respond to your enquiry. You may withdraw that consent at any time by emailing taarifa@techrisk.co.ke; withdrawal does not affect processing carried out before you withdrew.

Where an enquiry becomes an engagement, our lawful basis moves to the performance of a contract with you or your organisation, and the retention period below changes accordingly.

Enquiries are delivered to a mailbox controlled by Rosewood and read by the partners and consultants who respond to new business. We do not sell, rent or share enquiry data with third parties for their own purposes.

• Our hosting and email provider processes the message in transit and at rest as our processor.
• Professional advisers, where we are legally obliged to disclose.
• A regulator or court, where disclosure is required by law.

Where a processor operates outside Kenya, we rely on the transfer safeguards in Part VI of the Data Protection Act and require contractual protection equivalent to our own obligations.

• Enquiries that do not become engagements: 24 months from the last contact, then deleted.
• Enquiries that become engagements: retained for the life of the engagement and for seven years after it ends, to meet professional and statutory record-keeping obligations.
• Rate-limiting hashes: one hour.
• Server logs: as retained by our host under its own schedule, typically not more than 30 days.

Under the Data Protection Act you have the right to be informed of how your data is used, to access it, to correct it, to have it deleted, to object to its processing, and to receive it in a portable form. You may exercise any of these by writing to taarifa@techrisk.co.ke.

We will respond within the period the Act allows. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner, Kenya.

This site sets no cookies. Your choice of light, dark or system theme is stored in your browser’s local storage under the key rw-theme. It never leaves your device and is not readable by us.

This is version 1 of our privacy notice, published on 1 August 2026. When we revise it we will change the version number and the date at the top of this page. Consent recorded through the enquiry form is stamped with the version in force at the time.