This Privacy Policy is issued by Croyah Ltd ("Croyah Impact", "we", "us", "our"), a company registered in Kenya under registration number PVT-KW1998LP, KRA PIN P052531392E, with a registered postal address of P.O. Box 21871-00505, Nairobi, Kenya. Croyah Ltd is the data controller for personal data collected through croyah.com and in the course of our advisory, strategy, and events work.
This policy explains how we collect, use, share, and protect personal data when you visit our website, submit a contact enquiry, engage us for advisory or events work, attend a Curated Impact Event, or make a payment via our Payments page. It applies to visitors and clients worldwide, with specific sections addressing Kenyan, EU/UK, and US legal frameworks.
| Category | Examples | Source |
|---|---|---|
| Contact & enquiry data | Name, organisation, email, message content, enquiry type | Contact form |
| Payment & billing data | Payer/attendee name, organisation, email, phone, invoice number, amount, ticket selection | Payments page (processed by PesaPal — we do not store card or mobile-money details) |
| Newsletter data | Email address | Footer sign-up form |
| Technical data | IP address, browser type, device type, pages visited | Automatically, via cookies/analytics (only with consent for non-essential categories — see our Cookie Policy) |
| Event data | Attendance records, dietary/accessibility notes you provide | Event registration & ticketing |
Where applicable law requires a stated legal basis (including the Kenya Data Protection Act 2019 and, for EEA/UK visitors, the GDPR), we rely on:
We do not sell personal data. We share data only with:
Some of our service providers (for example, cloud hosting or email tools) may process data outside Kenya, including in the EU/UK or US. Where this happens, we take reasonable steps to ensure an adequate level of protection — such as relying on providers with recognised safeguards (e.g. Standard Contractual Clauses, or equivalent Kenya Data Protection Act cross-border transfer safeguards) — before data is transferred.
We keep personal data only as long as needed for the purpose it was collected: enquiry and engagement records for the duration of the relationship plus a reasonable period for legal and tax purposes (generally up to 7 years for financial records, in line with Kenyan tax law); newsletter data until you unsubscribe; event data for the duration of the event cycle and any follow-up reporting.
Our website uses cookies for essential functionality and, only with your consent, for analytics and marketing. Full detail, including how to change your preferences at any time, is in our Cookie Policy & Consent.
If you are in Kenya, the Data Protection Act, 2019 gives you the right to: be informed of the use of your data; access your data; object to processing; correct false or misleading data; and request deletion of your data. To exercise these rights, contact us at hello@croyah.com. If you're unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.
As a matter of best practice, we extend equivalent protections to visitors in the EEA and UK under the General Data Protection Regulation, including the right to access, rectify, erase, or port your data, restrict or object to processing, and withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.
As a matter of best practice, we extend equivalent protections to California residents under the CCPA/CPRA, including the right to know what personal data we hold, request deletion, correct inaccurate data, and opt out of the "sale" or "sharing" of personal data. We do not sell personal data. To exercise these rights, contact us at hello@croyah.com; we will not discriminate against you for exercising them.
Our services are directed at organisations and professional individuals. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
We use appropriate technical and organisational measures to protect personal data, including encrypted transmission (HTTPS) across the site and payment flows, and restricted access to systems holding personal data. No system is completely secure, and we encourage you to contact us promptly if you suspect any misuse of your data.
We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page.
Croyah Ltd
P.O. Box 21871-00505, Nairobi, Kenya
Email: hello@croyah.com