01Who we are
SIGMA BROOKS ("we", "us") is a data, analytics and AI consultancy based in Nairobi, Kenya. We are the data controller for personal data collected through this website. You can reach us about anything in this policy at hello@sigmabrooks.com or by post at Westlands, Nairobi, Kenya.
02What we collect and why
We only collect what we need for the purpose you would expect.
| When | What we collect | Why | Lawful basis |
|---|
| You send the contact form | Name, work email, company, phone (optional), subject, message, IP address, date and time | To reply, follow up on your enquiry and keep a record of it | Your consent and steps you ask us to take before a contract |
| You subscribe to the newsletter | Email address, sign-up date, confirmation date, the page you signed up from | To send the newsletter you asked for | Your consent, confirmed by email |
| You ask for a free tool report | Name, email, company, phone (optional), your answers and result | To email the report and, if you agree, discuss the result with you | Your consent |
| You chat with the website assistant | Your messages, the replies from the assistant or our team, the page you started on, a scrambled (hashed) form of your IP address, when you were last active in the chat, and any feedback you give; your name, email, company and phone only if you confirm them in the chat | To answer your questions; to let a member of our team join the chat when you ask for a person; to learn from your feedback (thumbs up or down and an optional comment); and to improve our answers. Answers we reuse for other visitors are written by our team without any personal details | Our legitimate interest in answering visitors; your consent when you send your details to our team |
| You use the free tools without asking for a report | Answers stay in your browser for that visit | To calculate your result | Not sent to us |
| Anyone visits the site | Server logs (IP address, browser, pages, time) | To keep the site secure and working | Our legitimate interest in running a secure website |
We do not sell personal data, we do not use it for advertising, and we do not make automated decisions about you that have legal or similarly significant effects. The website assistant is an AI: it can make mistakes, so please check important details with our team, and do not share sensitive personal information in the chat.
03Who we share it with
Only the people at SIGMA BROOKS who need it to respond to you can see your data. We use a small number of service providers that process data on our behalf under contract:
- Website hosting, where the site and its database run.
- Email delivery, used to send replies, confirmations and reports.
- OpenAI, which generates the website assistant's replies from your messages. We send it the conversation, not your IP address, and we ask it not to store conversations (under its API terms, OpenAI keeps abuse-monitoring logs for up to 30 days and does not use API data to train its models).
- Font and icon delivery (Google Fonts, cdnjs by Cloudflare), which receive your IP address when your browser loads the site's fonts and icons.
- OpenStreetMap, which shows the map on our contact page.
If you contact us on WhatsApp or LinkedIn, those services handle your messages under their own privacy policies. We may disclose data where the law requires it.
04Transfers outside Kenya
Some of our providers store or process data outside Kenya. When that happens we rely on the safeguards in Part VI of the Data Protection Act, 2019, such as providers that offer appropriate protection and contractual commitments.
05How long we keep it
- Enquiries: up to 24 months after our last contact, or longer if you become a client and we need records for the engagement.
- Newsletter: until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days.
- Tool reports: up to 12 months.
- Assistant conversations: 90 days, then deleted automatically. If you sent your details to our team, the lead it created follows the enquiries period above.
- Server logs: kept for a short period for security, then deleted by our host.
06Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed about how we use your data;
- access the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete data we no longer need or that we process unlawfully;
- object to processing, including any direct marketing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting what we did before.
To use any of these rights, email hello@sigmabrooks.com. We will confirm who you are and respond within the timelines set by the Act and its regulations. Every newsletter email has a one-click unsubscribe link.
07How we protect it
Data is stored on an access-controlled system used only by our team. Access needs an individual account, sign-ins are rate-limited, every change is recorded in an audit log, and connections to the site are encrypted. No system is perfectly secure; if a breach affects your data we will notify the Office of the Data Protection Commissioner and, where required, you.
08Cookies
This website does not use advertising or analytics cookies. See our Cookie Policy for the details.
09Complaints
If you are unhappy with how we have handled your data, please tell us first at hello@sigmabrooks.com so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), Kenya: www.odpc.go.ke.
10Changes to this policy
We will update this page if how we use data changes, and change the date at the top. Significant changes will be highlighted on the site.
