Website Privacy Policy

Last updated: July 25, 2025

Introduction

At Optimum Partnerships Africa Limited ("we," "us," or "our"), we're committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website at www.optimumafrica.com and any other websites owned and operated by Optimum Partnerships Africa Limited (collectively, the "Website"), interact with us for marketing and communication purposes, or inquire about our security services. We process your personal data in accordance with applicable data protection laws, including the Kenyan Data Protection Act 2019, the UK and EU General Data Protection Regulations (GDPR) and the USA Data Protection Laws and Regulations. By using our website or providing us with your personal data, you agree to the terms of this Privacy Policy.

The personal data we collect

We may collect various types of personal data from you, depending on how you interact with us.

Information you provide directly

This is data you actively give us when you:

• Contact us: Your name, email address, phone number, company name, and any details you include in your message when you fill out contact forms, enquiry forms, or communicate with us directly (e.g., via email or phone)
• Subscribe to communications: Your name and email address if you sign up for our newsletters, updates, or marketing communications
• Event registrations: Your name, contact details, and any dietary or accessibility requirements if you register for events, webinars, or workshops hosted by us
• Feedback/surveys: Your responses to surveys or feedback forms we may send

Information collected automatically (via cookies and tracking technologies):

When you visit our Website, certain information is collected automatically using cookies and similar technologies. This may include:

• Device information: Your IP address, browser type and version, operating system, and device type
• Usage data: Details about how you interact with our website, such as the pages you visit, the time spent on those pages, referring URLs, clickstream data, and dates/times of access
• Location data: General geographical location (e.g., country or city) derived from your IP address

For more detailed information on the specific cookies, we use and how to manage your preferences, please refer to our dedicated Cookie Policy.

How we collect your personal data

We collect your personal data through various methods:

• Direct interactions: You provide data directly when you fill in forms on our website, correspond with us by post, phone, email, or otherwise
• Automated technologies or interactions: As you interact with our website, we automatically collect technical data about your equipment, browse actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies
• Third parties or publicly available sources: We may receive personal data about you from various third parties, such as analytics providers (e.g., Google Analytics), social media platforms, or publicly available sources like company registers, to enhance our marketing efforts or verify information

How we use your personal data and our lawful bases

We use your personal data for specific purposes and only when we have a valid legal basis to do so under applicable data protection policies.

• To respond to your inquiries: necessary for our legitimate interests (to respond to website enquiries and provide information about our services)
• To provide our services: necessary for the performance of a contract with you or to take steps at your request before entering into a contract
• For marketing and communications: your consent (for direct marketing where required, e.g., email newsletters) or our legitimate interests (to inform you about relevant services or updates if you're an existing client or lead)
• To manage our website and IT systems: necessary for our legitimate interests (for the proper administration and security of our website and it infrastructure)
• To improve our website and user experience: necessary for our legitimate interests (to study how customers use our products/services, to develop them, and to grow our business)
• To comply with legal obligations: necessary for compliance with a legal obligation (e.g., tax, regulatory, or crime prevention)
• For business development and analysis: necessary for our legitimate interests (to understand our market, identify potential clients, and analyse business performance)

Disclosing your personal data

We may share your personal data with the following types of third parties for the purposes outlined in Section 4:

• Service providers: third-party companies that perform services on our behalf, such as website hosting, IT system administration, email marketing platforms, Customer Relationship Management (CRM) software providers, and analytics services (e.g., Google Analytics). These providers are contractually obligated to protect your data and only use it for the specific purposes we define
• Professional advisers: lawyers, bankers, auditors, and insurers who provide professional services to us
• Regulators and other authorities: if required by law or regulation, or if we believe it's necessary to protect our rights, property, or safety, or the rights, property, or safety of others
• Business transfers: in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company. In such cases, your data may be transferred to the new owners
• With your consent: we may disclose your personal data to any other third party with your explicit consent

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Data security

We're committed to protecting your personal data. We implement appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed. These measures include:

• Encryption: Using SSL/TLS encryption for data in transit on our website
• Access controls: Restricting access to personal data to only those employees, agents, contractors, and other third parties who have a legitimate business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality
• Network security: Implementing firewalls, intrusion detection systems, and regular security audits
• Data minimisation: Collecting only the data necessary for the stated purposes
• Regular training: Ensuring our staff are regularly trained on data protection and security best practices

Despite these measures, the transmission of information via the internet is not completely secure. While we do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website; any transmission is at your own risk.

Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider:

• The amount, nature, and sensitivity of the personal data
• The potential risk of harm from unauthorised use or disclosure of your personal data
• The purposes for which we process your personal data and whether we can achieve those purposes through other means
• Applicable legal requirements (e.g., tax, regulatory, or contractual obligations)

For example, we generally keep basic information about our customers (including contact, identity, financial, and transaction data) for six years after they cease being customers for tax and legal purposes. Marketing consent records are typically retained until you withdraw consent.

Your legal rights

Under data protection laws, you have several rights regarding your personal data. These include:

• The right to be informed: About how your personal data is being used
• The right of access: To your personal data (commonly known as a "data subject access request")
• The right to rectification: To have inaccurate personal data corrected
• The right to erasure ("the right to be forgotten"): To have your personal data deleted in certain circumstances
• The right to restrict processing: To ask us to suspend the processing of your personal data in certain scenarios
• The right to data portability: To request the transfer of your personal data to you or to a third party
• The right to object to processing: Where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes
• Rights in relation to automated decision-making and profiling: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you
• The right to withdraw consent: At any time where we are relying on consent to process your personal data. This won't affect the lawfulness of any processing carried out before you withdraw your consent

To exercise any of these rights, please contact us using the details in Section 13. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Cookies and tracking technologies

Our website uses cookies and similar tracking technologies to enhance your browse experience, analyse site traffic, and support our marketing and communication efforts. For comprehensive information about the types of cookies we use, their purpose, and how you can manage your cookie preferences, please refer to our dedicated Cookie Policy.

Third-party links

Our website may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Children's privacy

Our website is not intended for children under the age of 13, and we do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13 without verification of parental consent, we will take steps to remove that information from our servers.

Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will post any changes on this page and update the "Last Updated" date at the top of this Privacy Policy. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Contact us

If you have any questions or concerns about this Privacy or any material which appears on our website, please contact us:

Optimum Partnerships Africa Limited

• Address: I&M Bank House, 5th Floor, 2nd Ngong Avenue, Nairobi Kenya
• Email: info@optimumafrica.com
• Phone: +254 20 790 9011 / +254 20 268 6857