This policy explains what personal data MtaaLex Solutions collects when you use our website and services, why we collect it, who we share it with, how long we keep it and the rights you have. We handle personal data in line with Kenya’s Data Protection Act, 2019 and its regulations.
Who we are
MtaaLex Solutions (“MtaaLex”, “we”, “us”) is a legal-technology consultancy based in Nairobi, Kenya, Central Business District. We are the data controller for the personal data described in this policy.
When we handle personal data for a client as part of an engagement, for example during a compliance audit, we act as that client’s data processor, and our agreement with the client governs that data.
For any question about this policy or your data, email info@mtaalexsolutions.co.ke or call 0704 020 449.
What we collect and why
Your account
Your name, email address, phone number (optional) and password. We store the password only in a scrambled (hashed) form that nobody can read, and we record when you last signed in. We use this to run your account, client portal and AI tools.
Messages you send us
When you use the contact form: your name, email address, phone number (optional), subject, message and the network (IP) address it was sent from. We use it to reply and to deal with your request.
Live trainings
Your name, email address, phone number, organisation (optional), payment status and attendance check-ins. We use them to register you, send your ticket and joining link, confirm payment and keep attendance records.
Shop orders
Your name, email address, M-Pesa phone number, any notes you add and what you bought. We use them to process and deliver your order, send receipts and download links, and keep the accounting records the law requires.
M-Pesa payments
When you pay, Safaricom sends us the paying phone number (sometimes partly hidden), the name registered with M-Pesa, the M-Pesa receipt number, the amount and the time. We ask Safaricom to confirm every payment before we release an order or a seat. We never see your M-Pesa PIN, and we don’t take card payments.
AI chat assistant
The messages you type and the replies. They are linked to your account if you are signed in; otherwise only to a scrambled code for your visit. We use the conversations to answer you and to improve the assistant. Please don’t share confidential or sensitive information in the chat.
AI tools
What you enter into a tool and the result, saved to your account so you can see your history and so we can apply monthly usage limits. Contracts you upload to the Contract Analyzer are analysed and then discarded: we keep only the file name and type.
Newsletter
Your email address, when you subscribed and the network (IP) address you subscribed from, as a record of your consent. We use it only to send the newsletter. You can unsubscribe at any time by emailing info@mtaalexsolutions.co.ke.
Website use and security
The pages you visit and when, the page that sent you, your browser type and your network (IP) address. The code that identifies your visit is stored only in scrambled (hashed) form. We also log sign-ins, failed sign-in attempts and password changes, and briefly count requests from each network address to stop abuse. We use this to keep the site secure and to understand which pages are useful.
If you like or share an article, we record that against the same scrambled code, so that one person counts once and you can undo a like. It is not linked to your name, and you don't need an account.
Our lawful reasons
The Data Protection Act allows us to use personal data only when we have a lawful reason. We rely on:
- Contract: to provide the account, trainings, orders and tools you ask for.
- Legal obligation: to keep tax and accounting records and to respond to lawful requests from authorities.
- Legitimate interests: to reply to messages, keep the site secure, prevent fraud and improve our services, in ways you would reasonably expect.
- Consent: for the newsletter. You can withdraw consent at any time.
Cookies
We use essential cookies to keep you signed in, hold your cart and protect forms. Our Cookie Policy lists them.
Who we share it with
We don’t sell personal data or use it for advertising. We share it only when needed with:
- Safaricom, to process and confirm M-Pesa payments.
- Our hosting and email providers, who run the website and send our emails, such as receipts, tickets and password resets.
- Meeting platforms (Google Meet, Zoom or Microsoft Teams), when you join a live training.
- Google Fonts and Cloudflare (cdnjs), which deliver the site’s fonts and icons to your browser and so see your IP address.
- Our professional advisers, such as accountants and auditors, who must keep it confidential.
- Authorities, when the law requires it, or to protect the rights and safety of our clients, the public or us.
Transfers outside Kenya
Some of these providers process data outside Kenya, for example in the United States. When that happens we transfer only what is needed and rely on the safeguards the Data Protection Act requires, such as the provider’s contractual data protection commitments.
How long we keep it
- Your account: while it is open. If you ask us to close it, we delete or anonymise your data within 30 days, apart from records the law requires us to keep.
- Orders, payments and training registrations: as long as Kenyan tax law requires, currently five years.
- Messages you send us: 2 years.
- Chat conversations: 12 months. AI tool history: 12 months.
- Records of website visits: about 13 months. Security logs: 12 months.
- Newsletter: until you unsubscribe. We then keep only your email address on a do-not-contact list, so you aren’t added again by mistake.
Messages, chats, tool history, visit records and security logs are deleted automatically when their period ends.
How we protect it
The site uses encrypted connections (HTTPS). Passwords are stored only as secure hashes, access to personal data is limited to the people who need it, and changes made in our admin panel are logged. Payments are confirmed directly with Safaricom, so a fake payment message can’t unlock an order. If a data breach puts your rights at risk, we will tell you and the Data Protection Commissioner as the law requires.
Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your personal data is used, which is what this policy does;
- get a copy of the personal data we hold about you;
- have wrong or incomplete data corrected;
- have data deleted when we no longer need it or should not have it;
- object to our use of your data, including for direct marketing;
- withdraw your consent at any time, where we rely on consent;
- receive your data in a format you can take elsewhere; and
- not be subject to a decision made only by automated means that significantly affects you.
To use any of these rights, email info@mtaalexsolutions.co.ke. We may ask you to confirm your identity first. We aim to reply within seven days and will tell you if we need longer. We don’t charge for requests.
AI and automated decisions
Our AI tools and chat assistant give general information and suggestions for you to review. We don’t use them to make decisions about you that have legal or similarly significant effects.
Children
Our services are meant for adults and organisations. We don’t knowingly collect personal data from children under 18. If you think a child has given us personal data, contact us and we will delete it.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
Changes to this policy
We update this policy when our services or the law change. The date at the top shows the current version. If a change significantly affects how we use your data, we will email account holders before it takes effect.
Contact us
MtaaLex Solutions
Nairobi, Kenya, Central Business District
Email: info@mtaalexsolutions.co.ke
Phone: 0704 020 449