KaribuKloud logo
    Privacy

    Privacy Policy

    Effective Date: 11 September 2026 | Last Updated: 11 September 2026

    Data Controller / Processor: KaribuKloud Limited
    Official Contact & DPO Email: [email protected]
    Website: https://karibukloud.com
    Physical Address: Nairobi, Kenya

    1. Introduction & Executive Statement

    KaribuKloud Limited (“KaribuKloud”, “we”, “us”, or “our”) is an elite Managed Security Service Provider (MSSP) and Cybersecurity Integrator operating across East Africa. We deliver sovereign, AI-driven threat detection, 24/7 Security Operations Center (SOC) monitoring, and continuous regulatory compliance solutions powered by Seceon’s Open Threat Management (OTM) platform.

    We are committed to safeguarding the privacy, confidentiality, and fundamental rights of all individuals whose personal data we collect or process. This Privacy Policy outlines how KaribuKloud collects, uses, stores, discloses, and protects personal data in compliance with:

    • The Constitution of Kenya (Article 31 - Right to Privacy)
    • The Data Protection Act, 2019 (Cap 411C of the Laws of Kenya)
    • The Data Protection (General) Regulations, 2021
    • The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021
    • The ODPC Guidance Notes on Privacy-Enhancing Technologies (PETs) and Artificial Intelligence (July 2026)
    • International Cybersecurity & Privacy Frameworks (ISO/IEC 27001, GDPR alignment)

    Whether you visit our website (https://karibukloud.com), interact with our statutory assessment tools (e.g., the DPA-K Compliance Estimator), or engage our enterprise Managed SOC and cybersecurity services, this policy explains your privacy rights and our legal duties.

    2. Our Statutory Role: Data Controller vs. Data Processor

    Under the Data Protection Act (DPA-K 2019), KaribuKloud operates in two distinct legal capacities depending on the context:

    2.1. KaribuKloud as a Data Controller

    We act as a Data Controller when we directly determine the purpose and means of processing personal data. This applies to:

    • Visitors accessing our public website (https://karibukloud.com), case studies portal (/cases), or estimator tool (/compliance).
    • Prospective and existing clients submitting contact requests, lead capture forms, or booking consultations.
    • Administrative users setting up client portal accounts, billing profiles, and reseller program registrations.

    2.2. KaribuKloud as a Data Processor

    We act as a Data Processor when we process network telemetry, system logs, administrative identity records, and security events on behalf of our enterprise clients (who act as the Data Controllers).

    When delivering our 24/7 Managed Fusion SOC, aiSIEM, aiXDR, and CMX360 services, KaribuKloud strictly processes telemetry according to our client’s documented Data Processing Agreement (DPA) and contractual instructions.

    3. Core Principles of Data Protection

    In accordance with Section 25 of the Data Protection Act, 2019, KaribuKloud ensures that all personal data is:

    • Processed Lawfully, Fairly, and Transparently: Handled with full disclosure and grounded in valid statutory processing grounds.
    • Purpose Limited: Collected for explicit, specified cybersecurity and service delivery purposes and not further processed in an incompatible manner.
    • Minimised: Adequate, relevant, and strictly limited to what is necessary for threat detection and service execution.
    • Accurate & Updated: Maintained accurately with prompt correction or erasure of inaccurate records.
    • Storage Limited: Retained in identifiable form only for as long as necessary to fulfill contractual or statutory archiving requirements.
    • Secured with Integrity & Confidentiality: Protected by robust technical and organizational measures (security by design and by default under Section 41).
    • Sovereign & Lawfully Transferred: Protected against unauthorized cross-border transfers outside Kenya without verified safeguards or explicit consent (Sections 48–50).

    4. Categories of Data We Collect

    4.1. Personal Data Collected Directly (As Data Controller)

    • Identity & Contact Data: Full name, job title, corporate email address (e.g., [email protected]), phone number, organization name, and industry sector.
    • Assessment & Diagnostic Data: Responses submitted via our DPA-K Compliance Estimator, calculated risk scores, and requested remediation reports.
    • Communications Data: Inquiries, feedback, and support tickets submitted to our technical pre-sales and SOC engineering teams.
    • Website Usage Data: IP address, browser type, device metadata, referrer URLs, and interaction timestamps collected via cookies and privacy-compliant analytics.

    4.2. Telemetry & Security Data Handled (As Data Processor)

    In delivering our AI-driven cybersecurity services, our platform ingests security telemetry from client environments:

    • Network & Flow Telemetry: NetFlow, sFlow, IPFIX, firewall logs, router/switch events, and DNS logs.
    • Identity & Access Telemetry: Active Directory logs, LDAP queries, login timestamps, user agent identifiers, and privilege escalation events.
    • Endpoint & Workload Telemetry: OS process logs, cloud workload events (Google Cloud, AWS, Azure), container events, and system performance indicators.

    Crucial Data Sovereignty Guarantee: KaribuKloud deploys an agentless Collection and Control Engine (CCE) within the client’s local network perimeter. The CCE inspects, parses, and correlates raw logs locally. Raw log files and sensitive citizen records (PII) remain 100% internal to your network. Only compressed, 256-bit SSH-encrypted behavioral metadata is streamed to our Analytics and Processing Engine (APE)—reducing WAN bandwidth by >90% and satisfying strict local data localization rules (DPA-K 2019 §50).

    5. Lawful Bases for Processing

    Under Section 30 of the Data Protection Act, 2019, KaribuKloud processes personal data under the following lawful grounds:

    • Consent (Section 30(1)(a)): Express, voluntary consent provided when submitting contact forms, requesting PoV trials, or accepting cookies. Consent may be withdrawn at any time.
    • Contractual Necessity (Section 30(1)(b)): Processing necessary to execute, deliver, or manage our Master Services Agreement (MSA) or SOC subscription with your organization.
    • Legal Obligation (Section 30(1)(c)): Compliance with statutory duties under Kenyan law, including mandatory audit logging, incident reporting to ODPC/KE-CIRT, and CMCA 2018 requirements.
    • Legitimate Interests (Section 30(1)(f)): Protecting institutional network perimeters against active cyber threats, detecting malware/ransomware, preventing fraud, and ensuring infrastructure resilience—provided these interests do not override individual rights.

    6. Privacy-Enhancing Technologies (PETs) & AI Governance

    To comply with the ODPC PETs Guidance Note (July 2026) and AI Guidance Note (July 2026), KaribuKloud implements advanced technical safeguards across our platform:

    • Pseudonymisation & Data Masking: Direct user identifiers are replaced with pseudonymous tokens or masked in non-production environments to prevent unauthorized re-identification.
    • 256-bit Cryptographic Controls: Encryption at rest (AES-256) and encryption in transit (TLS 1.3 / SSH 256-bit) are enforced across all telemetry pipelines.
    • Human-in-the-Loop Oversight (Section 35 ADM Rules): While Seceon OTM utilizes machine learning and automated SOAR playbooks for sub-1.5 second threat isolation, all critical security escalations, blocklists, and policy changes are subject to review by certified analysts at our 24/7 Nairobi Fusion SOC.
    • Zero Model Re-Training on Client Data: Client security telemetry and PII are strictly isolated and never utilized to train public AI models.

    7. Data Sharing, Disclosures & Sub-Processors

    KaribuKloud strictly prohibits selling, renting, or scraping personal data for third-party commercial marketing. We share data only under controlled circumstances:

    • Authorized Service Providers & Technology Partners: Technology vendors (such as Seceon Inc. for platform analytics, regional cloud infrastructure providers) operating under executed, legally binding Data Processing Agreements (DPAs) that mandate compliance with DPA-K 2019.
    • Statutory Regulators & Law Enforcement: When required by law, court order, or written directive from the Office of the Data Protection Commissioner (ODPC), KE-CIRT/CC, or law enforcement under the Computer Misuse and Cybercrimes Act (CMCA 2018).
    • Emergency Incident Response: Disclosures necessary to mitigate active, critical cyber threats posing imminent operational damage or data destruction to an enterprise network.

    8. Cross-Border Data Transfers & Sovereignty

    In accordance with Sections 48–50 of the Data Protection Act, 2019:

    • Local Data Localization (Section 50): Critical national infrastructure telemetry, biometric records, and sensitive health/financial data managed by our platform are processed and stored locally within Kenya, or backed up with an active serving copy inside Kenyan territorial servers.
    • Cross-Border Transfer Safeguards (Section 49): Where metadata or system diagnostic information must cross international borders, KaribuKloud ensures lawful transfer bases through Standard Contractual Clauses (SCCs) approved by the Data Commissioner, verified technical safeguards including end-to-end encryption and metadata-only transmission, or explicit, informed consent where applicable.

    9. Retention & Security Controls

    9.1. Security Safeguards (Section 41)

    We employ defense-in-depth security measures to protect personal data against accidental loss, unauthorized access, alteration, or exfiltration:

    • Multi-factor authentication (MFA) and role-based access control (RBAC) across all administrative consoles.
    • Continuous vulnerability scanning, penetration testing, and immutable log auditing.
    • 24/7 SOC monitoring with real-time control-drift detection (<30 seconds).

    9.2. Data Retention Schedule

    • Marketing & Inquiries: Retained for up to 24 months from last contact, or until consent is withdrawn.
    • Security Logs & Audit Telemetry: Retained in Long-Term Storage (LTS) pools for up to 7 years to satisfy SASRA, CBK, and ODPC regulatory audit requirements, after which data is securely purged or irreversibly anonymized.
    • Client Telemetry upon Contract Termination: Raw metadata and tenant configurations are securely erased within 30 days of contract termination.

    10. Data Subject Rights (Sections 26–40)

    Under Part IV of the Data Protection Act, 2019, you hold fundamental rights regarding your personal data:

    Statutory RightDescriptionAction / Timeline
    Right to Be Informed (§29)Right to clear, transparent information about how your data is processed.Provided via Privacy Policy & notices.
    Right of Access (§26(a))Right to request confirmation and copies of personal data held about you.Responded to within 30 days.
    Right to Rectification (§40(1)(a))Right to request correction of inaccurate, incomplete, or misleading data.Rectified promptly upon verification.
    Right to Erasure / Deletion (§40(1)(b))Right to request erasure of personal data no longer necessary or unlawfully held.Processed without delay unless statutory retention applies.
    Right to Object (§36 & §37)Right to object to processing based on legitimate interests or direct marketing.Absolute for direct marketing—ceases immediately upon request.
    Right to Data Portability (§38)Right to receive your personal data in a structured, machine-readable format.Provided in standard CSV/JSON format.
    Right to Human Oversight (§35)Right not to be subject to solely automated decisions affecting you.Human reviewer assigned upon request.

    How to Exercise Your Rights:
    To exercise any of your data protection rights, submit a written request to our Data Protection Officer at:
    Email: [email protected]
    Subject Line: Data Subject Rights Request – [Your Name / Organization]

    11. Breach Notification Protocol (Section 43)

    In the event of a personal data breach affecting systems managed directly by KaribuKloud:

    • Notification to ODPC: We will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of a breach likely to result in risk to data subjects.
    • Notification to Data Controllers: When acting as a Data Processor, we will notify affected Data Controller clients within 48 hours of breach confirmation.
    • Notification to Affected Individuals: Where a breach poses a high risk to individual rights and freedoms, affected data subjects will be notified without undue delay with practical mitigation guidance.

    12. Updates to This Policy

    KaribuKloud reviews and updates this Privacy Policy periodically to reflect changes in regulatory guidance, emerging cyber threat vectors, or operational enhancements. All updates will be published on our website (https://karibukloud.com/privacy) with a revised "Last Updated" timestamp.

    13. Contact Us & Dispute Resolution

    If you have questions, concerns, or complaints regarding this Privacy Policy or our data handling practices, please contact us first:

    KaribuKloud Limited – Privacy & Compliance Office
    Email: [email protected]
    Website: https://karibukloud.com
    Cases & Regulatory Portal: https://karibukloud.com/cases
    Address: Nairobi, Kenya

    Filing a Complaint with the Regulator:
    If you are unsatisfied with our internal dispute resolution, you have the statutory right under Section 56 of the Data Protection Act to lodge a complaint with the Data Commissioner:

    Office of the Data Protection Commissioner (ODPC)
    Website: https://www.odpc.go.ke / https://cie.odpc.go.ke
    Email: [email protected]
    Physical Address: Britam Towers, 12th Floor, Upper Hill, Nairobi, Kenya

    See also our Terms of Service.