1. Who We Are
SCIAT AFRICA ("SCIAT AFRICA", "we", "us") is a cybersecurity and digital forensics firm headquartered at 2nd Avenue, Parklands, Nairobi, Kenya, with regional offices in Kampala, Dar es Salaam and Cape Town.
For personal data collected through this website and in the course of our own business, SCIAT AFRICA is the data controller. Where we process personal data on behalf of a client during an engagement, we act as a data processor under that client’s instructions and the terms of our agreement with them.
2. Personal Data We Collect
- Enquiry details you choose to send us — name, organisation, email address, telephone number and the content of your message.
- Business contact and contract information for clients, partners and suppliers, including billing details.
- Technical information recorded by our hosting provider when you visit the site, such as IP address, browser type and the time of the request, kept in server logs for security purposes.
- Cookie and preference choices, as described in our Cookie Policy.
- Information processed during client engagements, such as system logs, user accounts and digital evidence, handled strictly under contract and in confidence.
Conversations with Lisa, our website assistant, are processed entirely within your browser. They are not stored by us or sent to our servers. Please do not share passwords, personal identification numbers or other sensitive information with Lisa.
3. How We Use Personal Data and Our Lawful Basis
| Purpose | Lawful basis (Kenya Data Protection Act, s.30) |
|---|---|
| Responding to enquiries and preparing proposals | Steps taken at your request prior to entering a contract; legitimate interests |
| Delivering services and products, and managing client relationships | Performance of a contract |
| Incident response, forensic investigation and evidence handling | Performance of a contract; compliance with legal obligations; establishment or defence of legal claims |
| Securing our website, systems and premises | Legitimate interests |
| Accounting, tax and regulatory record-keeping | Compliance with legal obligations |
| Website translation through functional cookies | Consent, which you may withdraw at any time |
| Sending security advisories or event invitations | Consent, or legitimate interests for existing clients, with an opt-out in every message |
5. Cross-Border Transfers
Where personal data is transferred outside Kenya, including between our offices in Kenya, Uganda, Tanzania and South Africa, we do so only in accordance with sections 48 to 50 of the Kenya Data Protection Act, 2019 and the corresponding requirements of local law, relying on appropriate safeguards such as contractual protections and confirmation of adequate protection in the receiving country.
Client data subject to residency requirements is processed and stored within the agreed jurisdiction.
6. Retention
We keep personal data only for as long as necessary for the purpose for which it was collected. Enquiries that do not lead to an engagement are deleted within 24 months. Contract and financial records are retained for the periods required by Kenyan tax and company law. Engagement evidence is retained and destroyed in accordance with the client agreement and any applicable legal hold.
7. How We Protect Personal Data
As a security firm, we apply to our own operations the controls we recommend to clients: encryption in transit and at rest, role-based access on a least-privilege basis, multi-factor authentication, logging and monitoring, documented chain-of-custody procedures for evidence, staff confidentiality undertakings and regular security training. Suspected personal data breaches are assessed promptly and notified to the Data Commissioner and affected individuals where the Act requires.
8. Your Rights
Under the Kenya Data Protection Act, 2019 you have the right to:
- Be informed of the use to which your personal data is put.
- Access personal data held about you.
- Object to the processing of all or part of your personal data.
- Have false or misleading data corrected.
- Have false or misleading data deleted.
- Receive your data in a portable format where the Act provides.
- Withdraw consent at any time, without affecting processing carried out before withdrawal.
- Not be subject to a decision based solely on automated processing that significantly affects you.
9. Exercising Your Rights and Contacting Us
To exercise any of these rights, or for any question about this policy, contact our Data Protection Officer at info@sciatafrica.com with the subject line "Data Protection Request", or call +254 794 946633. We may need to verify your identity before acting on a request, and we will respond within the timelines set by the Act and its regulations.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke, or with the data protection authority in your own country.
10. Regional Laws
Where we process personal data in our regional offices, we also comply with the Data Protection and Privacy Act, 2019 (Uganda), the Personal Data Protection Act, 2022 (Tanzania) and the Protection of Personal Information Act, 2013 (South Africa), as applicable.
11. Children
Our website and services are intended for organisations and are not directed at children. We do not knowingly collect personal data from children.
12. Changes to This Policy
We may update this policy from time to time. The date at the top of this page shows when it was last revised. Material changes will be highlighted on this website.