Privacy Policy

Effective Date: 27 August 2026

AssuranceMax Consulting Ltd ("we", "us", or "our") is committed to protecting your privacy in accordance with the Constitution of Kenya (2010), the Data Protection Act, 2019 (Act No. 24 of 2019), the Computer Misuse and Cybercrimes Act, 2018, and other applicable Kenyan legislation. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or engage our professional services.

1. Your Right to Privacy

Article 31 of the Constitution of Kenya guarantees every person's right to privacy, including the right not to have information relating to their family or private affairs unnecessarily required or revealed, and the right not to have the privacy of their communications infringed. We respect and uphold this constitutional right in all our dealings with client data.

2. Information We Collect

We may collect the following categories of personal data:

• Identity Data: Full name, national identification number, KRA PIN, and other government-issued identifiers as required for regulatory compliance.
• Contact Data: Email address, telephone number, postal address, and physical location.
• Financial Data: Business financial records, accounting information, payroll data, tax records, and related documentation necessary for the provision of our professional services.
• Technical Data: IP address, browser type, operating system, device information, and usage data collected through cookies and similar technologies.
• Professional Data: Business registration details, company records, governance documents, and employee information as relevant to our engagements.

3. How We Use Your Information

We process personal data on the following lawful bases as provided under the Data Protection Act, 2019:

• Performance of a Contract: To deliver the professional consulting services you have engaged us to provide.
• Legal Obligation: To comply with tax laws, accounting regulations, reporting requirements, and other statutory obligations under the Income Tax Act, VAT Act, Public Finance Management Act, and Companies Act, 2015.
• Legitimate Interest: To improve our services, communicate with you, and ensure the security of our systems.
• Consent: Where you have given us explicit consent to process your data for a specific purpose.

4. Data Disclosure and Sharing

We may share your personal data with:

• Regulatory authorities including the Kenya Revenue Authority (KRA), the Companies Registry, and the National Treasury, where required by law.
• Professional bodies such as the Institute of Certified Public Accountants of Kenya (ICPAK) in connection with audit or compliance obligations.
• Service providers and data processors who assist in delivering our services, subject to strict confidentiality obligations.
• Law enforcement agencies where disclosure is required under the Proceeds of Crime and Anti-Money Laundering Act or other applicable legislation.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5. Data Security

In accordance with the Computer Misuse and Cybercrimes Act, 2018 and the Data Protection Act, 2019, we implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of sensitive data in transit and at rest.
• Access controls limiting data access to authorised personnel.
• Regular security assessments and vulnerability testing.
• Staff training on data protection and confidentiality obligations.
• Secure data storage with appropriate backup and disaster recovery procedures.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Accounting records and related financial data are retained in accordance with the Companies Act, 2015 and the Income Tax Act, which require retention of accounting records for a minimum period of seven (7) years. Upon expiry of the retention period, personal data is securely deleted or anonymised.

7. Your Rights Under the Data Protection Act, 2019

You have the following rights regarding your personal data:

• Right of Access: To request access to the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data where there is no compelling reason for continued processing.
• Right to Object: To object to the processing of your personal data for specific purposes.
• Right to Data Portability: To receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: To withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us using the details provided below.

8. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance your browsing experience and collect analytical data. You may control cookie preferences through your browser settings. Where non-essential cookies are used, we will obtain your consent in accordance with applicable data protection requirements.

9. International Data Transfers

Where we transfer personal data outside of Kenya, we ensure that appropriate safeguards are in place as required under the Data Protection Act, 2019, including standard contractual clauses or adequacy determinations as applicable.

10. Children's Privacy

Our services are directed to businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated policy will be posted on this page with a revised effective date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or wish to file a complaint, please contact our Data Protection Officer:

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner established under the Data Protection Act, 2019.