Skip to content

Privacy Notice

Version 1.0 · Last updated 7 September 2026

This notice explains how the Integrated Performance Advisory and Transformation (IPAT) collects and processes personal data through this website, in a manner designed around the principles of the Kenya Data Protection Act, 2019 (KDPA): minimisation, purpose limitation, transparency, security, retention limits, and accountability.

Review notice. This document is a working draft prepared by IPAT for review by qualified Kenyan counsel. It does not constitute legal advice, and compliance with the Kenya Data Protection Act, 2019 and other applicable law must be confirmed by counsel before adoption. Technical security controls described here are implemented in the platform; policy commitments require organisational procedures and legal review.

1. Who we are

IPAT — the Integrated Performance Advisory and Transformation — is an executive education, advisory, and research institution with offices in Nairobi, Johannesburg, Lagos, and Kigali. For personal data processed through this website, IPAT is the data controller. You can reach us at info@ipatafrica.org or +254 181 445 591.

2. Data we collect

We collect only what a specific purpose requires (data minimisation):

  • Registration data — when you register for a programme: name, email, phone, country, city, organisation, job title, department, industry, selected course and preferred start date, delivery preference, optional learning objective, payment method, and your consent record (acknowledgement, marketing choice, timestamp, and policy version).
  • Enquiry data — when you contact us or request a corporate engagement: name, email, phone (optional), organisation, enquiry type, and message.
  • Payment data — card payments are processed by Stripe; IPAT does not store card numbers.
  • Analytics data — anonymous, aggregate usage events (pages viewed, searches, registration funnel steps). We do not record names, emails, or search terms with analytics events.

3. How and why we use your data

  • To administer your application and participation (contractual necessity) — reviewing your registration, confirming your seat, taking payment, and delivering your programme.
  • To respond to your enquiries (legitimate interest / necessity for the service you requested).
  • Marketing (consent) — occasional programme updates only if you tick the optional marketing box. Marketing consent is never pre-ticked and can be withdrawn at any time.
  • Legal and regulatory obligations — accounting, tax, and record-keeping requirements.

We do not use your data for automated decision-making or profiling, and we do not sell personal data.

4. Disclosure and transfers

We share personal data only with processors necessary to run the platform: our hosting and database provider, our payment processor (Stripe), and our email delivery provider. Where data is processed outside Kenya, we rely on appropriate safeguards with those providers. We do not disclose your data to any other third party except with your consent or where required by law.

5. Retention

Registration records are retained while your application is active and for the period required for programme administration, accounting, and audit. Enquiry records that do not become registrations are retained for a limited period and then deleted. Records subject to a legal retention duty are kept only as long as that duty requires. You may request earlier deletion as described below.

6. Security — technical and policy controls

Technical controls (implemented in this platform)

  • Role-based access control and least privilege for administrative functions
  • Row-level database permissions — administrative data is not publicly readable
  • Server-side validation and sanitisation of all submitted content
  • Protected administrator routes requiring secure sign-in
  • Credentials and payment secrets held server-side, never in frontend code
  • Transport encryption for all traffic

Legal and policy controls (procedural — for review by counsel)

  • Purpose limitation and data minimisation commitments in this notice
  • Retention schedules and secure deletion procedures
  • Data subject request (access, correction, objection, deletion) handling procedures
  • Marketing consent capture and withdrawal procedures
  • Staff confidentiality and access review procedures

7. Your rights

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, objection to processing, and deletion of your data where no overriding legal duty applies. To exercise any of these rights, submit a Data Subject Request:

We will verify your identity and respond within the statutory period. Our administrators can correct or delete records directly through the platform’s management tools.

8. Marketing consent

Marketing emails are sent only to those who opted in. We record your consent status, timestamp, and the version of this notice you accepted. To withdraw consent, reply to any email from us or write to info@ipatafrica.org — withdrawal takes effect promptly and does not affect your application.

9. Children

Our programs are designed for working professionals; this website is not directed at children under 18, and we do not knowingly collect their data.

10. Changes to this notice

We may update this notice to reflect changes in our practices or the law. Each version carries a version number and “last updated” date at the top of this page; material changes will be flagged on the website. Continued use after an update constitutes acceptance of the current version.

11. Contact

Questions about this notice or your data: info@ipatafrica.org · +254 181 445 591 · Nairobi, Kenya. See also our Terms of Use and Cookie & Analytics Notice.

base44
Edit with Base44