PRIVACY POLICY
Effective Date: 5 September 2026
1. Introduction
ASTRA SOURCESS LTD. (“ASTRA SOURCESS”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.
This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our website, contact us, request information, enquire about our services or otherwise interact with ASTRA SOURCESS.
This Policy is intended to provide transparency regarding our personal data practices and is designed with reference to the Kenya Data Protection Act, 2019 and applicable data protection regulations.
2. Who We Are
ASTRA SOURCESS LTD. is a business advisory and execution support company based in Nairobi, Kenya.
For purposes of applicable data protection legislation, ASTRA SOURCESS may act as a Data Controller where we determine the purposes and means of processing personal data.
Where we process personal data on behalf of a client or another organisation, we may act as a Data Processor, subject to the applicable contractual arrangements and instructions.
3. Personal Information We May Collect
Depending on how you interact with us, we may collect the following categories of personal information:
Contact Information
Name
Email address
Telephone number
Company name
Job title or position
Business address
Enquiry and Communication Information
Information contained in enquiries, correspondence, forms, emails, telephone communications or other communications submitted to us.
Business and Engagement Information
Where you engage ASTRA SOURCESS, we may collect information necessary to understand and provide the requested services, including relevant business, project, commercial and operational information.
Website and Technical Information
When you use our website, certain technical information may be collected automatically, including:
IP address;
Browser type;
Device type;
Operating system;
Pages visited;
Approximate usage information; and
Other technical information generated through website interaction.
The specific information collected may depend on the technologies and services used on our website.
4. How We Collect Personal Information
We may collect personal information:
Directly from you;
When you submit an enquiry through our website;
When you communicate with us by email, telephone or other communication channels;
When you request or engage our services;
During the course of a business relationship;
From publicly available sources where appropriate; and
From third-party service providers or professional advisers where legally permitted.
We seek to collect personal information through lawful and transparent means and only where it is relevant to the purpose for which it is required. This reflects the principles established under Kenya's Data Protection Act.
5. How We Use Personal Information
We may use personal information for purposes including:
Responding to enquiries;
Communicating with prospective and existing clients;
Preparing proposals, quotations and engagement documentation;
Providing advisory and business support services;
Managing client relationships;
Coordinating projects and business activities;
Communicating with suppliers, consultants and professional advisers where necessary;
Managing our business operations;
Maintaining business and financial records;
Meeting legal and regulatory obligations;
Protecting our systems, website and business interests;
Improving our services and website; and
Sending business-related communications where permitted by law.
We will not use personal information for purposes that are incompatible with the purpose for which it was collected unless permitted by applicable law or otherwise appropriately authorised.
6. Lawful Basis for Processing
Where applicable, ASTRA SOURCESS may process personal information on one or more of the following lawful bases:
Consent
Where you have voluntarily provided consent for a specific processing activity.
Performance of a Contract
Where processing is necessary to establish, perform or manage a contractual relationship with you.
Legal or Regulatory Obligation
Where processing is necessary to comply with an applicable legal or regulatory requirement.
Legitimate Interests
Where processing is necessary for legitimate business interests, provided that such interests do not override the applicable rights and freedoms of the data subject.
Kenya's data protection framework recognises, among other bases, consent, contractual necessity, legal obligation and legitimate interests as grounds for lawful processing.
7. Data Minimisation
We seek to collect and process only personal information that is adequate, relevant and reasonably necessary for the applicable purpose.
We do not seek to collect personal information merely because it is available.
Our approach is consistent with the Data Protection Act's requirements concerning purpose limitation and data minimisation.
8. Sharing Personal Information
We may disclose personal information where reasonably necessary to:
Employees and authorised representatives of ASTRA SOURCESS;
Professional advisers;
Lawyers, accountants, auditors and other professional service providers;
Technology and IT service providers;
Website, hosting, cloud and communication service providers;
Banks and financial institutions where necessary for a transaction;
Contractors, consultants or other service providers involved in an engagement;
Government authorities and regulatory bodies where required or permitted by law; or
Other parties where you have provided appropriate consent or where disclosure is otherwise lawful.
We do not sell personal information to third parties.
Where third parties process personal information on our behalf, we seek to ensure that appropriate contractual, organisational and technical safeguards are in place.
9. International Transfers
ASTRA SOURCESS may use technology, cloud services, professional advisers or other service providers that operate outside Kenya.
Where personal information is transferred outside Kenya, we will take appropriate steps to ensure that such transfers comply with applicable Kenyan data protection requirements, including applicable safeguards or consent where required.
The Kenya Data Protection Act places specific requirements on transfers of personal data outside Kenya.
10. Data Security
We take reasonable technical and organisational measures designed to protect personal information against:
Unauthorised access;
Unauthorised disclosure;
Accidental loss;
Destruction;
Alteration;
Misuse; and
Other unlawful processing.
Access to personal information is limited to individuals and service providers who reasonably require it for legitimate business purposes.
However, no electronic transmission, storage system or internet-based service can be guaranteed to be completely secure.
11. Data Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including where necessary to:
Provide services;
Maintain business records;
Comply with contractual obligations;
Meet legal, accounting or regulatory requirements;
Resolve disputes; or
Establish, exercise or defend legal claims.
When personal information is no longer required, we will take reasonable steps to securely delete, anonymise or otherwise dispose of it, subject to applicable legal and regulatory requirements.
This approach reflects the Data Protection Act's requirement that personal data should not be retained in identifiable form for longer than necessary.
12. Cookies and Website Technologies
Our website may use cookies and similar technologies to improve functionality, understand website usage, maintain security and enhance user experience.
Cookies may collect information such as browser type, device information, pages visited and general usage patterns.
Where required, we will seek appropriate consent before placing non-essential cookies or similar technologies on your device.
You may also be able to control or disable cookies through your browser settings. Disabling certain cookies may affect some website functionality.
13. Your Rights as a Data Subject
Subject to applicable legal requirements and limitations, you may have the right to:
Be informed about the use of your personal information;
Request access to personal information held about you;
Request correction of inaccurate or misleading personal information;
Object to certain processing of your personal information;
Request deletion or erasure of personal information in appropriate circumstances;
Request restriction of processing in applicable circumstances;
Request portability of certain personal information; and
Exercise rights relating to certain automated decision-making and profiling.
These rights are recognised within Kenya's data protection framework.
14. Withdrawal of Consent
Where we rely on your consent to process personal information, you may withdraw that consent at any time, subject to applicable legal requirements.
Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
In certain circumstances, we may continue to process information where another lawful basis permits us to do so.
15. How to Exercise Your Rights
To exercise your data protection rights or ask questions regarding the processing of your personal information, please contact us using the details provided below.
We may request reasonable information necessary to verify your identity before responding to a request.
We will handle requests in accordance with applicable legal requirements and within the applicable statutory timeframe.
16. Direct Marketing
Where permitted by applicable law, ASTRA SOURCESS may send business-related communications concerning our services, business developments, events or other relevant information.
Where consent is required, we will obtain appropriate consent.
You may request that we stop sending direct marketing communications at any time by contacting us or using an available unsubscribe mechanism.
17. Children's Privacy
Our website and services are primarily intended for businesses, investors, professionals and other adults.
We do not knowingly seek to collect personal information from children except where legally permitted and appropriately authorised.
If you believe that a child has provided personal information to us without appropriate consent, please contact us so that we can review and take appropriate action.
18. Third-Party Websites
Our website may contain links to third-party websites or services.
This Privacy Policy does not apply to the privacy practices of independent third parties.
We encourage users to review the privacy policies of third-party websites before providing personal information to them.
ASTRA SOURCESS is not responsible for the privacy practices, security or content of third-party websites.
19. Confidential Business Information
Personal data protection and business confidentiality are related but distinct matters.
Information provided to ASTRA SOURCESS in connection with a prospective or existing business engagement may also be protected under our Confidentiality Policy, contractual confidentiality obligations or a separate Non-Disclosure Agreement where applicable.
Our Confidentiality Policy governs the handling of confidential commercial, technical, financial and business information separately from this Privacy Policy.
20. Personal Data Breaches
If we become aware of a personal data breach affecting information under our control, we will assess the incident and take appropriate measures in accordance with applicable law, including any required notification to the relevant authorities and affected individuals.
The Office of the Data Protection Commissioner (ODPC) is the regulatory authority responsible for oversight and enforcement of Kenya's data protection framework.
21. Complaints
If you have concerns regarding the way ASTRA SOURCESS handles your personal information, we encourage you to contact us first so that we can investigate and address the matter.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) where permitted under applicable law. The ODPC provides a formal mechanism for data subjects to lodge complaints concerning the processing of their personal data.
22. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business, website, technology, legal requirements or data protection practices.
The updated version will be published on this website with the revised effective date.
We encourage users to review this Privacy Policy periodically.
23. Contact Us
If you have questions about this Privacy Policy, wish to exercise your data protection rights or have concerns regarding the processing of your personal information, please contact:
ASTRA SOURCESS LTD.
Nairobi, Kenya
Email: info@astrasourcess.com
Phone: +254 722 819 552