Privacy Notice

1. Who is responsible (data controller)

Sumatran Technologies is the data controller responsible for your personal data.

• Registered entity: Sumatran Technologies
• Privacy contact: the privacy request form at the end of this notice

If you have any questions about this notice or wish to exercise your data privacy rights, please use the privacy request form.

2. What information we collect

When you submit an executive conversation request through our website, we collect the following personal data:

• Full name
• Work email address
• Organisation name
• The specific decision, challenge, or operational context you describe
• Optional details, such as your professional role and the specific offer of interest

Note on confidentiality: Please send only a brief, non-confidential summary. Do not include sensitive personal data, financial account details, or confidential corporate documents in the form.

Spam protection: To protect our forms from automated spam, we use Cloudflare Turnstile, which checks that a request comes from a person. Cloudflare processes technical information about your browser and connection for this purpose only.

Cookies and analytics: The website uses standard technical logs necessary for site operation and security. With your consent, we also use Google Analytics 4 to understand how visitors use the site, such as which pages are read. Google Analytics sets cookies and processes information about your device and visit; Google may process this data outside Kenya. We do not use it for advertising or combine it with other data.

Your choice: Analytics runs only if you select “Accept analytics” in the cookie banner. You can change your choice at any time through “Cookie settings” at the bottom of every page. We remember your choice in a small cookie (sm_consent) for six months.

3. Purpose and legal basis for processing

We process your personal information based on the following legal grounds:

• Legitimate interests: To review whether one of our advisory or transformation offers fits your organisation’s needs and to respond appropriately to your enquiry.
• Consent: When you voluntarily submit your details through our contact mechanism, you consent to our processing of that data solely for the purpose of scheduling a follow-up conversation.

We do not sell your information, monetize your data, or add you to marketing mailing lists without your explicit, separate agreement.

4. Data storage, security, and retention

• Enquiry transmission: Your request is transmitted securely via email to our primary enquiries mailbox.
• Database backup: A private administrative copy is stored within the secure website database, accessible strictly by authorized system administrators, and is deleted automatically after 12 months.
• Form safety buffer: If a form submission fails, the information you typed is held temporarily on our website server for up to 15 minutes, so you do not have to retype your message. It is then deleted.

5. International data transfers

If you access this website from outside Kenya (such as within the European Union), your data may be processed on servers hosted securely via our managed hosting provider. We ensure appropriate technical and organizational safeguards are maintained to protect your data to standard GDPR equivalence.

6. Your data protection rights

Under the Kenya Data Protection Act, 2019 and the GDPR, you have the following rights regarding your personal data:

• Right of access: You can request copies of your personal data.
• Right to correction: You can ask us to rectify inaccurate or incomplete information.
• Right to deletion: You can request that we erase your personal data under certain conditions.
• Right to object or restrict: You can object to or limit our processing of your data.

To exercise any of these rights, please use the privacy request form below.

7. Privacy requests

We may ask you to confirm your identity before acting on a request.