Privacy Policy

1. Company Identity

This Privacy Policy applies to Deni Sawa Partners (“we”, “us”, or “our”), a strategic advisory and fractional business support firm based in Kenya.

2. Governing Law

This policy is primarily governed by the Kenya Data Protection Act, 2019 (DPA 2019) and the Kenya Data Protection (General) Regulations, 2021. For our international users, we apply the principles of the European Union’s General Data Protection Regulation (GDPR) as best practice.

Our Data Protection Officer can be reached at advisory@denisawa.co.ke.

3. Data We Collect

We collect only the information needed to operate this platform and deliver our services.

Health Check assessments

• Full name
• Business name (Business Health Check only)
• Email address
• WhatsApp number
• Assessment responses (paragraph answers, single and multi-select choices)
• IP address and user agent (for rate limiting and security)
• Time taken to complete the assessment
• Assessment start and completion timestamps

Report delivery

• Preferred delivery channel (email, WhatsApp, or both)
• Report access timestamp (when your report link is opened)
• Report type accessed (summary or detailed)

Communications

• Email correspondence via SMTP (domain mail — no third-party email provider)
• WhatsApp messages via the Meta Business Cloud API
• Contact form submissions

Website usage

• Google Analytics 4 (GA4) data: page views, session duration, events, device type
• Cookie consent preferences
• Referral source

Admin and team

• Admin user accounts: name, email, role, last active timestamp
• Session activity for security (inactivity timeout enforcement)

4. How We Use Data

We use your personal data for the following specific purposes:

• To deliver Health Check reports — your assessment responses are processed to generate a structured diagnostic report. Reports are delivered to the email address or WhatsApp number you provide.
• To provide fractional advisory and business support services — contact details and assessment data inform advisory engagements.
• To communicate with you — confirmation messages, report delivery and follow-up communications via email and WhatsApp.
• To improve our services — anonymised, aggregated assessment data may be used to improve diagnostic accuracy and service design. No individual is identifiable in this analysis.
• For security and fraud prevention — IP addresses and session data are used solely to enforce rate limits and prevent abuse of the assessment system.
• For analytics — website usage data via GA4 is used to understand how visitors use the site and improve the user experience.

5. How Your Assessment Data is Processed

When you complete a Health Check assessment, your responses are submitted to Anthropic’s Claude API — a third-party AI service operated by Anthropic, PBC (USA) — to generate your diagnostic report. Your responses are processed by this service for the sole purpose of generating your report. Anthropic’s data processing is governed by their privacy policy, available at anthropic.com/privacy. We do not use your assessment responses to train AI models. Your report is stored securely in our database and accessible only via your unique, private report link.

6. Data Retention

We retain personal data only for as long as it is needed for the purposes described in this policy.

After retention periods expire, data is permanently deleted from all systems — including backups — within 30 days of the retention date.

7. Data Sharing

We share data only with the following service providers, each under a confidentiality obligation:

• Anthropic, PBC — assessment responses sent to the Claude API for report generation only.
• Meta Platforms — WhatsApp number and message content sent via the Meta Business Cloud API for report delivery (only when WhatsApp delivery is selected).
• Supabase, Inc. — our database and authentication provider. Data is stored in Supabase-managed PostgreSQL infrastructure.
• Google LLC — anonymised analytics data via Google Analytics 4.
• Vercel, Inc. — our hosting provider. No user data is stored by Vercel beyond standard server logs.

We do not sell, rent, or share personal data with any third party for marketing purposes. Ever.

8. Your Rights Under Kenya DPA 2019

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data (right to erasure)
• Object to processing
• Data portability
• Withdraw consent at any time

To exercise any right, email advisory@denisawa.co.ke with the subject line “Data Rights Request — [your name]”. We will respond within 21 days as required by the Kenya DPA 2019.

9. Cookies

We use the following cookies:

You can withdraw cookie consent at any time via the Cookie Settings link in the footer of this website.

10. Health Check Report Links

Report links (/business-health-checks/report/[token]) are private and unique. The token is a 64-character cryptographic random string. Anyone with the link can access the report — users are advised not to share their report link with unintended recipients.

11. Changes to This Policy

We will notify users of material changes via email (if provided) and by posting the updated policy on this page with a revised effective date. Continued use of the platform after changes constitutes acceptance.

12. Contact & Data Protection Officer

For any privacy questions, data subject requests, or to reach our Data Protection Officer, contact us at advisory@denisawa.co.ke or by phone at +254 702 448 601.