Effective date: 3 August 2026
Ashworth Partners ("Ashworth Partners", "we", "us", or "our") provides PVoC and product registration advisory services to importers bringing chemical and industrial products into Kenya. This Privacy Policy explains what personal data we collect through our website and client portal, why we collect it, who we share it with, and the rights you have over it. It is written to comply with Kenya's Data Protection Act, 2019 (the "Act") and the regulations made under it.
This policy applies to visitors to our public website, prospective clients who submit a consultation inquiry, and clients and their staff who use our client portal. It does not cover the internal handling of our own employees' or advisors' data.
Ashworth Partners is the data controller for the personal data described in this policy. For any question about this policy or to exercise the rights described below, contact us at advisory@ashworth-partners.com.
Registered address: [to be added]. Data Protection Officer / contact person: [to be added]. See also our Terms of Service.
If you submit a "Book a Consultation" request on our website, we collect your full name, email address, and any company name, phone number, or message you choose to include. You do not need an account to submit this form.
When we set up your client portal access, we hold your company name, KRA PIN, company registration number, postal and physical addresses, company telephone and email, and the name, email, and telephone number of your designated contact person(s). Portal sign-in itself is handled by our authentication provider and uses your email address and a password you choose.
To assess and process a registration or import application we collect information about the specific product involved: its HS code, product name and category, country of supply, shipment frequency, estimated shipment value, and whether your company is the brand owner or manufacturer.
Depending on the route and product, you may upload supporting documents through the portal, which can include your Business Registration Certificate, KRA PIN Certificate, laboratory test reports, QMS or product certification, labelling photographs, product samples documentation, Safety Data Sheets (MSDS), declarations of conformity, product recall procedures, and proof of fee payment. These documents often contain business and, occasionally, personal data about your staff or suppliers (for example, a signatory's name on a certificate) — please only upload what a document naturally contains, and let us know if a document includes personal data belonging to someone other than you so we can handle it appropriately.
When you pay a fee through the portal, you can pay by card or M-Pesa. We do not collect or store your card number — card payments are processed directly by Stripe, our payment processor, and we only receive a payment reference and status back from them. M-Pesa payments are processed through Safaricom's Daraja platform; we receive the phone number you pay from, a transaction/checkout reference, and (on success) the M-Pesa receipt number. We keep a record of the fee, its status, and these references for your account and our own accounting.
Signing in to the portal sets a session cookie so you stay logged in; this cookie is strictly necessary for the service to function and is not used for tracking or advertising. Your light/dark display preference is saved in your browser's local storage, not as a cookie, and is never sent to us. We do not currently use analytics, advertising, or third-party tracking scripts on our website or portal.
Under the Act, we rely on the following grounds depending on the data and purpose: performance of a contract (carrying out the advisory services you've engaged), your consent (for example, submitting a consultation inquiry), compliance with a legal obligation (for example, tax and accounting records), and our legitimate interests in running and securing our business, where these do not override your own rights and interests.
KEBS and conformity assessment bodies. The core of our service is submitting your product and company information, and supporting documents, to the Kenya Bureau of Standards and the conformity assessment agents or bodies it appoints, in order to secure your PVoC certificate, registration, or license. This sharing is inherent to the service and necessary to complete your application.
Service providers. We use a small number of providers to run the portal and process payments, each acting on our instructions:
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
Legal disclosures. We may disclose information where required by Kenyan law, court order, or a lawful request from a competent authority, or to protect our rights, property, or safety, or that of our clients or the public.
Some of our service providers may process or store data outside Kenya. Where this happens, we rely on the providers' own security and contractual safeguards, and we only work with providers who maintain a standard of protection consistent with the Act.
We retain client account, application, document, and payment records for as long as your account is active and for a reasonable period afterward to meet our legal, accounting, and regulatory recordkeeping obligations (including those tied to KEBS registration validity periods). Consultation inquiries that don't proceed to a client relationship are kept only as long as needed to follow up, then archived or deleted. You can ask us to delete your data at any time, subject to the retention obligations described above.
Access to client data in the portal is restricted by row-level security so that each client can only see their own records, and advisor access is limited to staff who need it to do their work. Uploaded documents are stored in a private location and are never publicly accessible — every view or download is served through a time-limited, individually generated link. All traffic to our website and portal is encrypted in transit (HTTPS). No method of transmission or storage is completely secure, but we work to protect your information using appropriate technical and organizational measures.
As a data subject, you have the right to:
To exercise any of these rights, contact us at advisory@ashworth-partners.com. We will respond within the timeframes required by the Act.
We use only one cookie, set when you sign in, to keep you authenticated in the portal. It is strictly necessary and cannot be disabled without disabling sign-in itself. We do not use cookies for analytics, advertising, or cross-site tracking.
Our services are intended for businesses and professionals and are not directed at children. We do not knowingly collect personal data from children.
We may update this policy from time to time to reflect changes in our practices or the law. We will update the effective date above when we do, and, for material changes, we will make reasonable efforts to notify active clients directly.
If you have a concern about how we handle your personal data, please contact us first at advisory@ashworth-partners.com so we can try to resolve it. You also have the right to lodge a complaint directly with the Office of the Data Protection Commissioner (ODPC), Kenya.