Privacy notice

Who we are

NuruTrace Labs Limited is a private company incorporated in the Republic of Kenya under the Companies Act, 2015, registration number PVT-DM1KBRLQ, with its registered office in Nairobi. For the purposes of the Data Protection Act, 2019, we are the data controller in respect of the personal data described in this notice.

Questions about this notice, or about how we handle personal data, can be sent to our data protection contact at the address in the Contact section of this site.

What we collect, and why

Enquiries made through this website. When you use a form on this site we collect your name, email address, the organisation you give, and the content of your message. We use it solely to respond to your enquiry and, where a matter proceeds, to establish an engagement. Our lawful basis is your consent, which you give by submitting the form, and thereafter the performance of a contract or steps taken at your request prior to a contract.

Engagement and client data. Where we are instructed, we collect the information necessary to carry out the work and to meet our own legal and regulatory obligations. This may include identity information for client verification, and the material you provide in connection with a matter. Our lawful basis is the performance of a contract and compliance with legal obligations.

Technical data. Our hosting and security infrastructure records IP addresses and request metadata for the purpose of protecting the site against abuse. Our lawful basis is our legitimate interest in the security and availability of our systems.

We do not use advertising cookies, we do not sell personal data, and we do not share it with third parties for their own marketing.

Information relating to investigations

In the course of our work we process information about individuals who are not our clients, including subjects of investigation. Where we do so on the instruction of a law enforcement agency, a regulated institution or a legal representative, that processing is carried out under the instructing party's authority and legal basis. We handle such material under strict access controls, retain it only as long as the matter and our professional obligations require, and do not use it for any purpose beyond the instruction.

We ask that you do not send case evidence, identity documents, wallet credentials or material relating to third parties through the forms on this website. Those forms are not a secure evidence channel. Where a matter proceeds, we will provide a secure route and a formal engagement before any sensitive material is exchanged.

How long we keep it

Enquiries that do not lead to an engagement are retained for up to twelve months and then deleted. Records relating to an engagement are retained for the period required by our professional, contractual and statutory obligations, and are then securely destroyed. Technical security logs are retained for a short period appropriate to their purpose.

Where it is held

Some of the service providers we use to host this website, deliver email and protect our infrastructure operate outside Kenya. Where personal data is transferred outside the country, we take steps to ensure it is subject to appropriate safeguards consistent with the requirements of the Act.

How we protect it

Access to personal data is restricted to those who require it for the work. Our systems use encryption in transit and at rest, multi-factor authentication, and logged access. Everyone working with us is bound by written confidentiality obligations, and those obligations survive the end of their engagement with us.

Your rights

Under the Data Protection Act, 2019 you have the right to be informed of the use of your personal data, to access it, to have inaccurate data corrected, to object to processing in certain circumstances, and to request deletion where the legal basis for holding it no longer applies. Where processing rests on your consent, you may withdraw that consent at any time, which does not affect processing already carried out.

To exercise any of these rights, contact us using the details on this site. We will respond within the period required by the Act. Some rights are qualified, and there are circumstances in which we may be unable to delete material, for example where it forms part of a record we are legally obliged to retain or which is subject to legal proceedings. Where that applies we will explain it to you.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner.

Changes

We will update this notice when our practices change. The date at the top records the current version.