Privacy Policy

1. Introduction

Noventra Advisory Global Limited ("Noventra", "we", "us", "our") is committed to protecting your personal information in accordance with the Constitution of Kenya, the Data Protection Act, 2019, and this Privacy Policy. This Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at noventraadvisoryglobal.com ("Website"), use our client portal, or engage our professional services.

2. Data Controller

Noventra Advisory Global Limited is the data controller for your personal information. Our contact details:

Crescent Business Centre, Nairobi, Kenya
Email: admin@noventraadvisoryglobal.com
Data Protection Officer: dpo@noventraadvisoryglobal.com

3. Personal Information We Collect

Information you provide directly:

• Contact details: name, email, phone, company name, address
• Account credentials: username, password (hashed)
• Tax and financial data: KRA PIN, tax returns, financial statements, transaction records
• Correspondence: emails, messages, documents you share with us

Information collected automatically:

• Website usage data: IP address, browser type, pages visited, referral source
• Cookies and similar technologies (see Section 7)
• Client portal activity: login times, document access, feature usage

4. Lawful Basis for Processing (Data Protection Act, 2019)

We process your personal information on the following lawful bases:

• Contract performance: To deliver Services under our Engagement Agreement
• Legal obligation: To comply with tax laws, anti-money laundering regulations, professional conduct rules
• Legitimate interests: To improve our Website, portal, and services; for business development; for security
• Consent: For marketing communications (you can opt out anytime)

5. How We Use Your Information

We use your personal information to:

• Provide, manage, and improve our professional Services
• Communicate with you about your engagement, deadlines, and regulatory updates
• Operate and secure the client portal
• Comply with legal, regulatory, and professional obligations (including KRA filings)
• Prevent fraud and ensure security
• Send service updates and relevant insights (with your consent)

6. Disclosure of Your Information

We do not sell your personal information. We may disclose it only:

• To KRA and other tax authorities as required for filings, audits, or compliance
• To our professional service providers (cloud hosting, payment processors, IT support) under data processing agreements
• To professional advisers (lawyers, auditors) bound by confidentiality
• Where required by law, court order, or regulatory authority
• With your explicit consent

7. Cookies and Tracking Technologies

Our Website uses cookies for: (a) essential site functionality and security; (b) analytics (Google Analytics) to understand usage; (c) remembering your preferences. You can manage cookie preferences via your browser settings. Disabling essential cookies may impair site functionality.

8. International Transfers

Your information is primarily processed in Kenya. If we engage service providers outside Kenya (e.g., cloud platforms), we ensure adequate safeguards: standard contractual clauses, adequacy decisions, or your consent.

9. Data Retention

We retain personal information for as long as necessary to: (a) fulfil the purposes in this Policy; (b) comply with legal and professional obligations (typically 7+ years for tax and engagement records); (c) resolve disputes; (d) enforce our agreements. Anonymised data may be retained longer for analytics.

10. Your Rights (Data Protection Act, 2019)

You have the right to:

• Access your personal information and obtain a copy
• Rectify inaccurate or incomplete data
• Request erasure (subject to legal retention requirements)
• Restrict or object to processing
• Data portability (receive your data in a structured, commonly used format)
• Withdraw consent for marketing at any time
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

To exercise these rights, email dpo@noventraadvisoryglobal.com. We will respond within 30 days as required by law.

11. Security

We implement appropriate technical and organisational measures: encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, multi-factor authentication for the portal, regular security assessments, and staff training. However, no internet transmission is 100% secure.

12. Children's Privacy

Our Services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have, contact us to delete it.

13. Changes to This Policy

We may update this Policy to reflect legal, regulatory, or operational changes. The latest version will be posted here with an updated "Last Updated" date. Material changes will be communicated via email or portal notice.

14. Contact

For questions, concerns, or to exercise your rights:

Data Protection Officer
Noventra Advisory Global Limited
Crescent Business Centre, Nairobi, Kenya
Email: dpo@noventraadvisoryglobal.com