01 Who we are

Kiruh (“we”, “us”, “our”) is a cybersecurity consultancy based in Nairobi, Kenya, serving organisations across East Africa. For the purposes of the Kenya Data Protection Act, 2019, Kiruh acts as the data controller for personal data collected through this website (kiruh.co.ke) and in the course of providing our services.

02 Information we collect

We collect only what we need to respond to you and deliver our services:

• Contact details you provide — name, organisation, email address, phone number, and the message you send us through our contact form.
• Engagement information — details you share with us when scoping or delivering a security engagement, handled under a separate confidentiality agreement.
• Technical data — limited, anonymised information your browser sends automatically, such as IP address, device and browser type, and pages visited, used to keep the site secure and understand how it is used.

We do not knowingly collect special-category or children’s data through this website.

03 How we use your information

• To respond to enquiries and provide the information or scoping call you request.
• To deliver, manage, and improve the services you engage us for.
• To maintain the security, integrity, and performance of our website.
• To meet our legal, regulatory, and contractual obligations.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

04 Legal basis for processing

Under the Kenya Data Protection Act, 2019, we process your personal data on the basis of your consent (which you give when you contact us), the performance of a contract with you or your organisation, our legitimate interests in operating and securing our business, and where necessary to comply with a legal obligation.

05 Cookies & analytics

This site uses a small number of essential cookies required for it to function and stay secure. If we use analytics to understand aggregate, anonymised usage, it is limited to improving the site — never to track you across other websites. You can control or block cookies through your browser settings at any time.

06 How we share your data

We share personal data only where necessary, and always under appropriate safeguards:

• Trusted service providers — such as our website host and email provider, who process data on our behalf under contract.
• Legal and regulatory bodies — where we are required to disclose data by law.

We never share your data with third parties for their own marketing.

07 How we protect your data

Security is what we do. We apply encryption in transit, strict access controls, the principle of least privilege, and regular review of our own systems to protect the personal data we hold against unauthorised access, loss, or misuse. Where a personal-data breach is likely to affect your rights, we will notify the Office of the Data Protection Commissioner and affected individuals as required by law.

08 How long we keep it

We keep personal data only for as long as needed for the purpose it was collected, to maintain our client relationship, and to meet legal and accounting obligations. Enquiry data that does not lead to an engagement is deleted once it is no longer needed. When data is no longer required, we securely dispose of it.

09 International transfers

Some of our service providers may process data outside Kenya. Where personal data is transferred abroad, we ensure it is protected by appropriate safeguards and in line with the requirements of the Kenya Data Protection Act, 2019.

10 Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. Any changes will be posted on this page with an updated revision date above.