Privacy policy on how we handle your information.

1. Introduction

APSIS Business Consulting Ltd ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://www.apsis.co.ke or engage our professional services.

We are a registered accounting and tax consulting firm in Nairobi, Kenya, regulated by the Institute of Certified Public Accountants of Kenya (ICPAK). We comply with the Kenya Data Protection Act, 2019 and applicable international standards.

2. Information We Collect

2.1 Personal Information

We may collect the following categories of personal information:

• Contact Details: Name, email address, phone number, physical address
• Business Information: Company name, KRA PIN, business registration details, industry sector
• Financial Data: Tax records, financial statements, payroll data (only when engaged for professional services)
• Communication Records: Emails, messages, call logs, meeting notes

2.2 Automatically Collected Information

• IP address, browser type, operating system
• Pages visited, time spent on page, referral source
• Cookies and similar tracking technologies (see Section 7)

3. How We Use Your Information

We use your information for the following purposes:

• Providing tax, accounting, audit, and advisory services
• Communicating with you about your engagements, deadlines, and regulatory changes
• Complying with legal and regulatory obligations (KRA, ICPAK, Companies Act)
• Improving our website, services, and client experience
• Sending relevant updates, newsletters, and regulatory alerts (with your consent)
• Responding to enquiries and providing customer support

4. Information Sharing & Disclosure

We do not sell your personal information. We may share information only in these circumstances:

• With your consent: For specific third-party services you request
• Professional obligations: To KRA, ICPAK, or other regulators when legally required
• Service providers: Trusted vendors (cloud hosting, email, practice management) under strict data processing agreements
• Legal compliance: Court orders, legal proceedings, or statutory requirements
• Business transfers: In the event of a merger, acquisition, or sale of assets

5. Data Security

We implement appropriate technical and organisational measures to protect your information:

Encryption

In transit (TLS 1.2+) and at rest (AES-256)

Access controls

Role-based, least privilege, multi-factor authentication

Assessments and training

Regular security assessments and staff training on data protection

Secure disposal

Physical and electronic records disposed of securely per retention schedules

While we strive to protect your data, no transmission over the internet is 100% secure. We recommend that you also take precautions on your end.

6. Data Retention

We retain your information only as long as necessary for the purpose it was collected or as required by law:

Client records

7 years after engagement ends (ICPAK / KRA requirement)

Website analytics

26 months (Google Analytics GA4 default)

Marketing communications

Until unsubscribed or consent withdrawn

Enquiry forms

12 months unless a client relationship is established

7. Cookies & Tracking

Our website uses cookies for the following purposes:

• Essential: Site functionality, security, and session management — these cannot be disabled
• Analytics: Google Analytics (GA4) — aggregated, anonymised usage data to help us improve the site
• Preferences: Language, region, and display settings

You can manage cookie preferences via your browser settings. Disabling essential cookies may impair site functionality.

8. Your Rights

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:

• Access your data
• Rectify inaccuracies
• Request erasure
• Restrict processing
• Data portability
• Withdraw consent
• Lodge a complaint

To exercise any of these rights, contact us at info@apsis.co.ke or write to our office address. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

9. International Transfers

Your data is primarily processed in Kenya. If we use cloud services with servers outside Kenya (e.g., Google Cloud, Microsoft Azure), we ensure adequate safeguards are in place through standard contractual clauses, adequacy decisions, or equivalent mechanisms recognised under the Kenya Data Protection Act.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or service offerings. Updates will be posted on this page with a revised "Last updated" date.

Material changes will be communicated via email or a prominent notice on our website. We encourage you to review this page periodically.

11. Contact Us

For any questions, requests, or concerns about this Privacy Policy or how we handle your personal data, please reach out to us: