Privacy Policy

1. Introduction

Priority Activator Consulting ("PAC", "we", "us" or "our") respects your privacy. This Privacy Policy explains how we collect, use, share and protect personal information when you visit our website or interact with us through it.

We operate from Nairobi, Kenya, and we handle personal information in line with the Data Protection Act, 2019 of Kenya and other laws that apply to us. Where we work with clients or participants in other countries, local data protection laws may also apply.

This policy covers our website only. When we deliver consulting services to a client, the handling of personal information within that engagement is governed by the agreement we sign with that client.

2. Who we are

For the purposes of this policy, Priority Activator Consulting is the data controller responsible for personal information collected through this website. This means we decide why and how that information is used.

Our office is at Jasmine Centre, Westlands Business District, Nairobi, Kenya. You can reach us about any privacy matter at info@pac.africa.

3. Information we collect

We only ask for information we need for the purpose of each form. Fields marked as optional can be left blank.

3.1 Information you give us

• Contact enquiries. When you use our contact form, we ask for your full name, email address, phone number, organisation, the service you are interested in and your message.
• Newsletter subscriptions. When you subscribe to our Insights updates, we collect your email address.
• Talent network. When you join our talent network on the Careers page, we collect your full name, email address and area of interest.
• Research participation. When you apply to take part in our research, we collect your full name, work email, company name, job title, LinkedIn profile (optional), industry, company size and country or region.
• Event and training registration. When you book or enquire about an event or training, we collect your first and last name, work email, organisation, job title and whether you would like event reminders.
• Event tickets. When you book a paid ticket, we collect the name, email address, phone number and organisation of the person booking, and the name, email address and organisation of each attendee in a group booking. We also record the ticket type, quantity and booking reference. After payment, each attendee is given a ticket with a QR code that is unique to them.
• Event attendance. When a ticket's QR code is scanned at the door, we record that the attendee checked in and at what time.
• Photo and video choice. When you book, you can choose whether we may use photographs and video of you from the event. We record each attendee's choice, the date and the wording they saw. See section 3.4.
• Job applications. Our Careers page links to a separate career platform. Information you submit there will be handled as described at the point of collection on that platform.
• Emails and other correspondence. If you write to us directly, we keep your message and contact details so we can respond.

If you give us information about another person, for example when booking tickets for colleagues, please make sure they are aware of this policy and are happy for you to share their details.

Please do not include sensitive personal information, such as health information, in free-text fields unless it is necessary for your enquiry.

3.2 Payment information

Payments for paid events are handled by third-party payment providers: PayPal and, once it is available, M-Pesa (operated by Safaricom). You are taken to the provider's own page to pay. Card details, PayPal logins and M-Pesa PINs are entered with that provider and are not stored by Priority Activator Consulting. We receive confirmation of the payment, the amount (including VAT at the prevailing Kenyan rate) and a transaction reference.

3.3 Information collected automatically

Like most websites, our hosting provider automatically records basic technical information when your browser requests a page. This can include your IP address, browser type, device type, the page requested, the referring page and the date and time of the request. This information is used to deliver the website, keep it secure and diagnose technical problems.

When your browser loads our pages, it also requests website fonts and social media icons from third-party content delivery services. Those services receive your IP address and basic browser information as part of the request. See section 11 for details.

3.4 Photography and video at events

We may take photographs and video at our events. When you book, you can choose, for yourself, whether we may use images of you for marketing and to showcase our work, including on our website, social media, newsletters and presentations. This choice is optional. If you do not agree, we note it and tell our photographer to avoid photographing you, using a list of attendees who did not consent (shared with our staff and photographer) and a warning when your ticket is scanned. We will make reasonable efforts, but in a shared room we cannot promise you will never appear in the background of a group photograph. You can change your mind or ask us to remove a particular image at any time by emailing info@pac.africa. We cannot recall material that has already been printed or shared by others. See our Photography & Video Policy.

4. How we use your information

We use personal information for the following purposes:

• to respond to enquiries and requests for consultations;
• to register you for events and trainings, issue tickets and send confirmations, practical information and, if you asked for them, reminders;
• to send newsletters and updates you have subscribed to;
• to tell talent network members about roles, programmes and application windows;
• to contact research participants about relevant research opportunities;
• to process payments and keep financial records;
• to check attendees in at the door using their ticket QR code;
• to record whether each attendee agreed to be photographed or filmed, and to tell our photographer who to avoid;
• to operate, secure and improve our website; and
• to comply with our legal, tax and regulatory obligations and to establish or defend legal claims.

We process personal information only where we have a lawful basis to do so. Depending on the purpose, this will be:

• your consent, for example when you subscribe to a newsletter, join our research or talent networks, or agree to be photographed or filmed at an event;
• performance of a contract or steps you have asked us to take before entering into one, for example when you book an event ticket or ask us about our services;
• our legitimate interests in running and protecting our business and website, where those interests are not overridden by your rights; or
• compliance with a legal obligation.

We do not use personal information from this website to make decisions about you based solely on automated processing.

5. Website analytics

This website does not currently use analytics or performance-tracking tools. We do not track how individual visitors move around the site, and we do not build visitor profiles.

If we introduce analytics in the future, we will update this policy first, and we will ask for your consent where it is required. See our Cookie Policy for more detail on the technologies this website uses.

6. Cookies and similar technologies

This website does not use cookies or browser storage for analytics, advertising or personalisation. The only cookie we set is a sign-in cookie for PAC staff on the admin pages, and the bot check on our forms (Cloudflare Turnstile) may use its own technical storage. See our Cookie Policy for full details.

7. Our data protection principles

In handling personal information, we aim to follow the data protection principles set out in Kenyan law. In practice, this means we:

• process information lawfully, fairly and transparently, and respect your right to privacy;
• collect information only for clear, specified and legitimate purposes, and do not use it in ways that are incompatible with those purposes;
• limit what we collect to what is adequate, relevant and necessary;
• take reasonable steps to keep information accurate and up to date;
• keep information only for as long as we need it;
• protect information with appropriate security measures; and
• transfer information outside Kenya only where appropriate safeguards are in place or where the law otherwise permits it.

8. How we store and protect information

We use reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure and alteration. These include encrypted (HTTPS) connections to our website, restricting access to people who need it for their work, and choosing service providers that apply appropriate security standards.

No method of transmitting or storing information is completely secure. If we become aware of a data breach that is likely to affect your rights, we will take the steps required by law, which may include notifying the Office of the Data Protection Commissioner and the people affected.

9. Data retention

We keep personal information only for as long as we need it for the purpose it was collected, and then securely delete or anonymise it. How long that is depends on the type of information:

• Enquiries are kept for as long as needed to respond and follow up, and longer if the enquiry leads to a client relationship.
• Newsletter, talent network and research network details are kept until you unsubscribe or ask to be removed.
• Event registration and ticketing records are kept for as long as needed to run the event and meet our accounting and tax obligations.
• Photo and video choices and check-in records are kept with the event record. Photographs and video we are allowed to use are kept for as long as they remain useful to us, unless you ask us to remove them.
• Technical logs kept by our hosting provider are retained for limited periods in line with that provider's practices.

We may keep information for longer where the law requires it or where it is needed to establish or defend a legal claim. Exact retention periods, and how to ask us to see, correct or delete your information, are in our Data Retention & Data Subject Requests page. Payment details are covered in our Payments & Pricing Policy.

10. When we share information with third parties

We do not sell or rent personal information. We share it only in the following circumstances:

• with service providers who help us run our website and business, as described in section 11;
• with event partners, venues or co-hosts where this is needed to deliver an event you have registered for, and where we have told you about it at registration;
• with professional advisers such as lawyers, auditors and accountants, under a duty of confidentiality;
• with regulators, courts, law enforcement or other authorities where we are required to by law, or to protect our rights, our clients or others; and
• with a buyer or successor if our business, or part of it, is reorganised, merged or sold, subject to equivalent privacy protections.

11. Service providers

We use trusted service providers who process personal information on our behalf and under our instructions. They are not allowed to use it for their own purposes. They include:

• Website hosting: Vercel Inc., which hosts and delivers our website and keeps server logs as described in section 3.3.
• Map: OpenStreetMap, which serves the map on our Contact page. It receives your IP address and basic browser information when the map loads, and sets no advertising cookies.
• Bot protection: Cloudflare (Turnstile), which checks that a form is being submitted by a person. It receives your IP address and basic browser information when a form is shown or submitted.
• Database: Neon, which stores bookings, enquiries and sign-ups on our behalf.
• Email delivery: Resend, which sends our booking confirmations, tickets and staff notifications.
• Icon delivery: the Simple Icons content delivery network, which serves the social media icons in our footer.
• Email and form handling: the services we use to receive and send email.
• Payments: PayPal, and M-Pesa (Safaricom) once available, which process payments for paid events.

12. International data transfers

Some of our service providers, including our website host, operate infrastructure outside Kenya. This means personal information may be processed in other countries whose data protection laws may differ from Kenya's.

Where we transfer personal information outside Kenya, we do so in accordance with applicable Kenyan law. We rely on providers who apply appropriate safeguards to protect personal information, such as contractual data protection commitments and recognised security standards.

13. Your rights

Under the Data Protection Act, 2019 of Kenya, you have rights over your personal information. Subject to the conditions and exceptions set out in the law, you have the right to:

• be informed about how your personal information is used;
• access the personal information we hold about you;
• object to the processing of all or part of your personal information;
• have inaccurate, false or misleading information corrected;
• have false, misleading or unlawfully processed information deleted;
• ask us to restrict the processing of your information in certain circumstances;
• receive your information in a structured, commonly used and machine-readable format, and ask us to transmit it to another organisation where technically possible;
• withdraw your consent at any time, where we rely on consent, without affecting processing that took place before you withdrew it; and
• not be subject to a decision based solely on automated processing that significantly affects you.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya. We would appreciate the chance to address your concern first, so please contact us before you do.

14. Making a data protection request

To exercise any of your rights, email info@pac.africa with the subject line "Data Protection Request". Please tell us which right you wish to exercise and give us enough detail to find your information.

We may need to confirm your identity before acting on your request, to protect your information from being disclosed to someone else. We will respond within the time required by applicable law. If we cannot meet your request in full, we will explain why.

We will not normally charge a fee for handling a request.

15. Marketing communications

We only send newsletters, updates and talent network communications to people who have signed up for them. Event reminders are sent only if you ask for them when registering.

You can unsubscribe at any time using the link in any marketing email or by emailing info@pac.africa. If you unsubscribe, we will still send you messages that relate directly to something you have requested, such as a ticket confirmation for an event you have booked.

16. Children's privacy

Our website and services are intended for professionals and organisations. They are not directed at children, and we do not knowingly collect personal information from anyone under 18 years of age.

If you believe a child has given us personal information, please contact us and we will delete it. Where personal information about a child is needed for a specific programme, we will obtain the consent of a parent or guardian as required by law.

17. Third-party websites and links

Our website contains links to external websites and services, including our social media pages (Facebook, Instagram and TikTok), and our career platform. These services are operated by other organisations with their own privacy policies.

We are not responsible for how those organisations handle personal information. We encourage you to read their privacy policies before sharing information with them.

18. Changes to this Privacy Policy

We may update this policy from time to time, for example when we add new features to our website or when the law changes. The "Last updated" date at the top of this page shows when it was last revised. Where changes are significant, we will take reasonable steps to let you know.

19. Contact us

If you have any questions about this Privacy Policy or how we handle your personal information, please get in touch.