Privacy Policy

1. Who we are

Ona Insights LTD ("Ona Insights", "we", "us") is a data and AI consultancy registered in Kenya and based in Nairobi. We help organisations turn complex, fragmented data into systems they can rely on.

This Privacy Policy explains how we collect and use personal data when you visit our website at onainsights.io ("the Site"). It applies to website visitors and to individuals who contact us through the Site.

This policy covers our website only. If you are a client receiving Canopy data hosting services, the handling of your organisation's data is governed by the Canopy Service Terms, not this policy.

2. Data controller

Ona Insights Limited is the data controller for personal data collected through this Site, as defined under Kenya's Data Protection Act, 2019.

For any questions about this policy or your personal data, contact us at:

Email: privacy@onainsights.io

Postal address: Ona Insights LTD, PO BOX 254793691157, 00606, Nairobi, Kenya

3. What personal data we collect and why

3.1 Website analytics (Google Analytics and Wix)

Our Site uses Google Analytics and Wix's built-in analytics to help us understand how visitors interact with the Site. These tools collect:

• Pages visited and time spent on each page
• Referring website or search engine
• Browser type and device type
• General geographic location (country or city level, derived from IP address)

This data is anonymised and aggregated. We do not use it to build profiles of individual visitors, track you across other websites, or target you with advertising.

Legal basis: Legitimate interests — understanding how the Site is used so we can improve it.

3.2 Contact form submissions

When you use the contact form on the Site, we collect the information you provide, which typically includes your name, email address, organisation, and the content of your message.

We use this data solely to respond to your enquiry. We do not add contact form submissions to any marketing list or share them with third parties.

Legal basis: Taking steps at your request prior to entering a contract, or our legitimate interest in responding to genuine business enquiries.

3.3 Email correspondence

If you contact us directly by email, we retain that correspondence for as long as it is relevant to the business relationship or enquiry. We do not use email correspondence for any purpose beyond the exchange itself.

4. What we do not do

To be clear about our practices:

• We do not sell, rent, or share your personal data with third parties for commercial purposes.
• We do not run retargeting campaigns or ad tracking on this Site.
• We do not build individual profiles of website visitors.
• We do not use your data to send unsolicited marketing communications.

5. Third-party tools and sub-processors

We use the following third-party services in operating this Site. Each operates under its own privacy policy.

Google Analytics

Google Analytics is a web analytics service provided by Google LLC. It collects anonymised usage data to help us understand Site traffic. Google may transfer data to servers outside Kenya.

Google's Privacy Policy · Google Analytics opt-out

Wix

This Site is hosted and built on Wix. Wix collects certain technical and analytics data as part of operating the platform. Wix is certified under applicable data protection standards.

Wix's Privacy Policy

6. Cookies

Our Site uses cookies — small text files placed on your device — primarily for analytics. The cookies set by Google Analytics and Wix help us measure page views and visitor behaviour in aggregate.

You can control or disable cookies through your browser settings at any time. You can also opt out of Google Analytics measurement specifically using the link in Section 5.

Disabling cookies will not prevent you from using the Site, but some features may work differently.

7. Data retention

We retain personal data only for as long as necessary for the purpose it was collected:

• Analytics data: retained for 26 months, then automatically deleted by Google Analytics.
• Contact form data: retained for up to 3 years from last contact, or longer where a business relationship continues.
• Email correspondence: retained for as long as relevant to the relationship or any resulting agreement.

When data is no longer needed, we delete or anonymise it.

8. Your rights

Under Kenya's Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data, subject to any legal retention obligations
• Object to processing based on legitimate interests
• Withdraw consent where processing is based on consent

To exercise any of these rights, email us at privacy@onainsights.io. We will respond within 30 days.

If you are based in the EU or UK, you may also have rights under the GDPR or UK GDPR, respectively, and the right to lodge a complaint with your local data protection authority.

9. Data security

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss, or disclosure. These include access controls, encrypted communications (HTTPS), and working only with reputable third-party platforms.

However, no method of transmission over the internet is completely secure. If you have concerns about a potential security incident, contact us immediately at privacy@onainsights.io.

10. International data transfers

Google Analytics and Wix may process data outside of Kenya, including in the United States and European Union. We rely on these providers' own compliance mechanisms (including EU Standard Contractual Clauses where applicable) to ensure appropriate safeguards are in place.

11. A note on hosting services clients

If your organisation subscribes to Ona Insights' data hosting services (Canopy), this Privacy Policy does not govern the processing of your organisation's data. That data is processed by Ona Insights solely to provide the Canopy services, under the terms of your Canopy Service Terms.

In that context, your organisation is the data controller and Ona Insights acts as a data processor. Please refer to your Canopy Service Terms (Section 12) and Canopy Service Description (Section 9) for full details of our data protection commitments.

12. Changes to this policy

We may update this policy from time to time. When we do, we will update the version number and effective date at the top of this page. For significant changes, we will make a reasonable effort to communicate the update through the Site.

We encourage you to review this policy periodically.

13. Contact us

For questions, requests, or concerns about this Privacy Policy or our data practices:

Email: privacy@onainsights.io

Ona Insights Limited, Nairobi, Kenya