Privacy Policy

1. Introduction

Noventra Advisory Global Limited ("Noventra", "we", "us", "our") is committed to protecting your personal information in accordance with the Constitution of Kenya, the Data Protection Act, 2019, and this Privacy Policy. This Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at noventraadvisoryglobal.com ("Website"), use our client portal, or engage our professional services.

2. Data Controller

Noventra Advisory Global Limited is the data controller for your personal information. Our contact details:

Crescent Business Centre, Nairobi, Kenya
Email: admin@noventraadvisoryglobal.com
Data Protection Officer: dpo@noventraadvisoryglobal.com

3. Personal Information We Collect

Information you provide directly:

• Contact details: name, email, phone, company name, address
• Account credentials: username, password (hashed)
• Tax and financial data: KRA PIN, tax returns, financial statements, transaction records
• Correspondence: emails, messages, documents you share with us

Information collected automatically:

• Website usage data: IP address, browser type, pages visited, referral source
• Cookies and similar technologies (see Section 7)
• Client portal activity: login times, document access, feature usage

3.1 Consent for Tax and Financial Document Processing

By uploading tax and financial documents (including your KRA PIN, P9 forms, bank statements, and financial statements) through our Website or client portal, you expressly consent to our processing and submission of this information to the Kenya Revenue Authority and other relevant authorities solely for the purpose of the filing or advisory service you have requested. This consent is separate from, and does not affect, your right to opt out of marketing communications.

3.2 Payment Information

Payments are processed directly by Pesapal, our licensed payment service provider. We do not collect, store, or have access to your full card number, M-Pesa PIN, or other payment credentials. We retain only transaction references and amounts necessary for your filing record and accounting.

4. Lawful Basis for Processing (Data Protection Act, 2019)

We process your personal information on the following lawful bases:

• Contract performance: To deliver Services under our Engagement Agreement
• Legal obligation: To comply with tax laws, anti-money laundering regulations, professional conduct rules
• Legitimate interests: To improve our Website, portal, and services; for business development; for security
• Consent: For marketing communications (you can opt out anytime)

4.1 Automated Processing

We may use automated tools to retrieve your eTIMS transaction history and pre-populate filing data. These tools support, but do not replace, review by a qualified advisor — no filing is submitted to KRA without human review. We do not use automated processing to make decisions that produce legal or similarly significant effects about you without human involvement.

5. How We Use Your Information

We use your personal information to:

• Provide, manage, and improve our professional Services
• Communicate with you about your engagement, deadlines, and regulatory updates
• Operate and secure the client portal
• Comply with legal, regulatory, and professional obligations (including KRA filings)
• Prevent fraud and ensure security
• Send service updates and relevant insights (with your consent)

6. Disclosure of Your Information

We do not sell your personal information. We may disclose it only:

• To KRA and other tax authorities as required for filings, audits, or compliance
• To our processors under data processing agreements, including: Pesapal (payment processing), our cloud hosting provider, and Google Analytics (website usage analytics)
• To professional advisers (lawyers, auditors) bound by confidentiality
• Where required by law, court order, or regulatory authority
• With your explicit consent

7. Cookies and Tracking Technologies

Our Website uses cookies for: (a) essential site functionality and security, which do not require consent; and (b) non-essential purposes such as analytics (Google Analytics) and remembering your preferences, which we only set after you accept via our cookie banner. You may withdraw consent at any time by clearing your cookies, adjusting your browser settings, or using the cookie preferences link in our footer. Disabling essential cookies may impair site functionality.

8. International Transfers

Your information is primarily processed in Kenya. If we engage service providers outside Kenya (e.g., cloud platforms), we ensure adequate safeguards: standard contractual clauses, adequacy decisions, or your consent.

9. Data Retention

We retain personal information for as long as necessary to: (a) fulfil the purposes in this Policy; (b) comply with legal and professional obligations (typically 7+ years for tax and engagement records); (c) resolve disputes; (d) enforce our agreements. Anonymised data may be retained longer for analytics.

10. Your Rights (Data Protection Act, 2019)

You have the right to:

• Access your personal information and obtain a copy
• Rectify inaccurate or incomplete data
• Request erasure (subject to legal retention requirements)
• Restrict or object to processing
• Data portability (receive your data in a structured, commonly used format)
• Withdraw consent for marketing at any time
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

To exercise these rights, email dpo@noventraadvisoryglobal.com. We will respond within 30 days as required by law.

11. Security

We implement appropriate technical and organisational measures: encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, multi-factor authentication for the portal, regular security assessments, and staff training. However, no internet transmission is 100% secure.

11.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach, where feasible. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay, describing the nature of the breach and the steps we are taking to address it.

12. Children's Privacy

Our Services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have, contact us to delete it.

13. Changes to This Policy

We may update this Policy to reflect legal, regulatory, or operational changes. The latest version will be posted here with an updated "Last Updated" date. Material changes will be communicated via email or portal notice.

14. Contact

For questions, concerns, or to exercise your rights:

Data Protection Officer
Noventra Advisory Global Limited
Crescent Business Centre, Nairobi, Kenya
Email: dpo@noventraadvisoryglobal.com