Privacy Policy

Kasi Insight respects your privacy. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Kenya's Data Protection Act, 2019, and the laws of the other countries where we operate.

1. Who we are and what this policy covers

Kasi Insight is a pan-African market research and decision intelligence firm headquartered in Nairobi, Kenya. In this policy, "Kasi", "we" and "us" mean the Kasi Insight group entities below. Kasi Insight Inc. in Canada is the data controller: it decides how and why your personal data is used. Our Kenyan and Ugandan companies process personal data on its behalf and on its instructions, for example to run fieldwork, analyse data and serve clients.

Kasi Insights Limited is registered with Kenya's Office of the Data Protection Commissioner (ODPC) as a data processor (registration 318-7956-8E52, valid until 10 March 2028).

This policy applies when you:

• visit kasiinsight.com or any of our subdomains, including reports.kasiinsight.com;
• contact us, request a demo, or subscribe to our newsletter;
• use our client platforms and data products, or buy reports or platform access online;
• are a client, prospect, partner, supplier or event attendee, or work for one;
• apply for a job or internship with us.

This policy does not cover:

• Research participation. This policy summarises how we handle data from our monthly Consumer Confidence Index (CCI) survey and from our focus groups and in-depth interviews (sections 2 to 7). For full detail on these, and for all other research we run, our Respondent Privacy Notice explains how we handle your data.
• Data we process for clients. When we handle personal data on a client's instructions, we do so under our contract with that client, and the client's privacy notice applies.
• Kasi employees. Staff data is covered by our internal employee privacy notice.

2. Personal data we collect

We collect only what we need for the purposes in section 3. Most of it you give us directly; some is collected automatically when you use our website.

Sensitive personal data. Kenyan law treats some data as sensitive, including health, ethnic origin, beliefs, biometric data, sex, marital status and family details. Our surveys, focus groups and interviews may touch on some of these, such as gender or marital status. We ask only where the research needs it, with your explicit consent, and you can skip any question. Outside our surveys, we do not ask for sensitive personal data through our website, platforms or business dealings. Please do not send it to us. If we receive it in error, we will delete it.

Payment information. Card payments are processed by Stripe and mobile money payments by M-Pesa. We do not store full card numbers.

3. Why we use your data and our lawful bases

We use personal data only for the purposes below, each with a lawful basis under section 30 of Kenya's Data Protection Act. Where we rely on consent, you can withdraw it at any time without affecting processing that happened before.

What we do not do:

• We do not sell or rent your personal data.
• We do not use your personal data for decisions based solely on automated processing that have legal or similarly significant effects on you.
• We do not use personal data from this policy's scope to train AI models.

AI tools. Our staff use AI tools to help with drafting, analysis and coding, under our internal AI policy. We put personal data into an AI tool only where that policy allows it, for example to record and transcribe focus groups and interviews with your consent. We use only tools that are approved under the policy and do not use our data to train their models, and we delete recordings and transcripts from them when the project closes. Other AI-assisted work uses only anonymised or aggregated data. Kasi staff check every AI output, and we do not use AI to make decisions about individuals.

Aggregated data. We combine data and remove identifiers so it can no longer identify anyone. Survey results are only ever reported, published or shared with clients in this aggregated, anonymised form, for example as percentages or index scores. We never pass a survey participant's identity to clients for sales or marketing.

4. Cookies and similar technologies

We set only essential cookies by default. Analytics and marketing cookies run only if you accept them in our cookie banner, and you can change your choice at any time via Cookie settings in the website footer.

You can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the site, such as the client login, from working.

Our newsletter emails may contain small tracking pixels that tell us whether an email was opened. You can block these by turning off image loading in your email client.

5. Who we share your data with

We share personal data only with the parties below, and only what each needs. We never sell it.

• Kasi group entities in Kenya, Canada and Uganda, to serve clients and run the business across markets.
• Service providers acting on our behalf, under written contracts that require them to protect your data and use it only on our instructions. These include providers of:
  • email, productivity and video conferencing, including Microsoft 365 and Microsoft Teams, which we use to run and record online focus groups and interviews;
  • cloud hosting and storage: Amazon Web Services (AWS);
  • CRM and newsletter tools;
  • website analytics: Google Analytics;
  • survey and data-collection platforms, including Sogolytics, which hosts our monthly CCI survey;
  • payments: Stripe for card payments and M-Pesa for mobile money payments and paying incentives to focus group and interview participants (we share your phone number with Safaricom to send these payments);
  • transcription: AI transcription tools approved under our internal AI policy, used with participants' consent and with model training switched off;
  • recruitment of research participants and staff: LinkedIn, with screening calls held on Microsoft Teams;
  • accounting software.
• Professional advisers such as lawyers, auditors and insurers, under confidentiality duties.
• Authorities, when the law requires it, for example to comply with a court order or regulator's request, or to protect someone's safety.
• A buyer or investor, if Kasi is involved in a merger, acquisition or sale of assets. They may use your data only as this policy allows, and we will tell you if that changes.

Clients who commission research. On client projects, the client may watch focus groups and interviews live, online through Teams or in person from an observation room. The client may also receive recordings, transcripts or anonymised quotes. We tell you this and ask your consent before the session starts. Observers know you by first name only, and we never give clients your contact details. Anything we share is covered by contracts that limit its use to that project.

We will share your data with anyone else only with your consent.

A current list of our main service providers is available on request from info@kasiinsight.com.

6. International transfers

All Kasi companies work in the same shared systems, so your data is not copied from one company to another. Those systems are hosted by our service providers, mostly in the United States, and our staff in Kenya, Canada and Uganda access them only as their work requires. Our website and client platforms are hosted on Amazon Web Services (AWS) in the United States (US East, Northern Virginia). Responses to our monthly CCI survey are stored by Sogolytics in data centres in the United States until the data is cleaned; the anonymised answers are then stored on AWS in the United States. Online focus groups and interviews run on Microsoft Teams, and their recordings are stored by Microsoft in Microsoft 365 data centres, which may be outside your country. AI transcription tools we use for these sessions may process recordings outside your country, including in the United States.

When we transfer personal data out of Kenya or another country we operate in, we do so only where that country's law allows it, and we put safeguards in place. These include:

• written data-transfer agreements, including standard contractual clauses, with group entities and service providers;
• choosing providers with recognised security certifications, such as ISO 27001 or SOC 2;
• encryption in transit and at rest.

We can provide details of the safeguards for a specific transfer on request. Laws in some destination countries may allow authorities to access data in circumstances different from those in your country.

7. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. Then we delete or anonymise it.

We may keep data longer if we need it for a legal claim or investigation, or if the law requires.

8. How we protect your data

We use technical and organisational measures suited to the risk, including:

• encryption of data in transit (HTTPS/TLS) and at rest;
• access limited to staff who need it, with multi-factor authentication on core systems;
• confidentiality agreements for staff and contractors who handle sensitive data, staff policies requiring everyone to protect client and company information, and data protection training for all staff;
• contracts requiring service providers to meet our security standards;
• regular backups, business continuity and IT disaster-recovery plans, and periodic review of access and security controls.

No system is completely secure, and we cannot guarantee the security of data sent to us over the internet or by email.

If a breach happens. If a breach of personal data creates a real risk of harm, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as Kenyan law requires, and other regulators as their laws require. We will also tell affected people without undue delay, explain what happened, and say what they can do to protect themselves.

9. Your rights

You have the following rights over your personal data. Exercising them is free.

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you and get a copy.
• Correct data that is inaccurate, out of date or incomplete.
• Delete data we no longer need or have no lawful basis to keep.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Restrict processing while a complaint or correction is being resolved.
• Data portability: receive data you gave us in a common machine-readable format, or have it sent to another organisation.
• Withdraw consent where we rely on it, such as for marketing emails or analytics cookies.
• Not be subject to solely automated decisions with legal or similarly significant effects.

How to use your rights. Email info@kasiinsight.com or write to our Data Protection Officer at the Nairobi address in section 11. We may ask you to confirm your identity first. We will respond within the time limits set by applicable law. For Kenyan requests, we answer access requests within 7 days of receiving them, as the Data Protection (General) Regulations, 2021 require. To stop marketing emails, use the unsubscribe link in any email.

Complaints. If you are unhappy with how we handled your data, please contact us first so we can try to fix it. You can also complain to the regulator where you live:

10. Children

Our website, platforms and services are for adults and are not directed at anyone under 18. We do not knowingly collect personal data from children through them. If you believe a child has given us personal data, contact info@kasiinsight.com and we will delete it.

Where our research involves people under 18, we collect data only with verifiable consent from a parent or guardian, as the Respondent Privacy Notice explains.

11. Links, changes and contact

Other websites. Our website links to sites we do not control. Their own privacy policies apply, and we are not responsible for how they handle your data.

Changes to this policy. We review this policy at least once a year. When we make material changes, we will update the effective date at the top, post a notice on our website, and email clients and subscribers where appropriate. Previous versions are available on request.

Contact us. Questions, requests or complaints about this policy:

• Data Protection Officer: Yannick Lefang, Managing Director & CEO
• Email: info@kasiinsight.com
• Kenya (head office): Kasi Insights Limited, Riara Corporate Suites, 3rd Floor, Riara Road, Kilimani, Nairobi; P.O. Box 31470, Nairobi; +254 786 511 161
• Canada: Kasi Insight Inc., 140 Yonge Street, Suite 200, Toronto, ON M5C 1X6, +1 647 293 6783
• Uganda: Kasi Insights Uganda Limited, Buganda Road, Nakasero II, Kampala Central Division, Kampala