New: How Kenyans use AI. Our 2026 survey of 1,161 AI users in 18 counties
How we created the Sale of the Year and got people shopping.
View case studyFrom Consumer Tweets to Strategic Briefs: How Nendo uses data to advise one of the most powerful corporations.
View case studyLast updated: 30 October 2026
Effective date: 30 October 2026
This policy explains how Nendo Limited ("Nendo", "we", "us") collects and uses personal data when you visit nendo.co.ke, fill in a form on it, chat with us on it, or subscribe to our newsletter. It is written to meet the Data Protection Act, 2019 of Kenya and the regulations made under it.
Nendo Limited is the data controller for the personal data described in this policy.
For any privacy question or request, write to our data protection contact at hello@nendo.co.ke with "Privacy" in the subject line.
This policy covers our website, the forms and chat on it, and our newsletter. It does not cover our research surveys. If you take part in a Nendo survey or study, you will get a separate notice when we collect your answers, explaining what we collect, why, how long we keep it and your rights.
We only collect what we need for each purpose below, and we do not use it for unrelated purposes.
| Where | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
| Research sign-up form on /ai | First name and email (required); organisation and "Which best describes you?" (optional); whether you ticked the updates box | To send you the report you asked for, understand who reads our research, and, only if you ticked the box, send research and training updates | Your request (taking steps you asked for) for the report; your consent for updates; legitimate interests for understanding our readership |
| Contact and enquiry forms | Name, email, organisation and your message | To reply to you and, where relevant, prepare a proposal or contract | Taking steps at your request before a contract; legitimate interests in answering enquiries |
| Website chat (Collect.chat) | Whatever you type, which may include your name, email and phone number | To answer your question and follow up if you ask us to | Legitimate interests in answering enquiries; your consent where you choose to share contact details |
| Newsletter (Substack) | Email address and, if you give it, your name; whether emails are opened or links clicked | To send the newsletter you signed up for | Your consent |
| Analytics (Google Analytics 4) | Pages visited, approximate location, device and browser type, how you arrived; collected through cookies and similar technology | To see which pages are useful and improve the site | Legitimate interests in running and improving our website, with an easy way to opt out (see section 5) |
| Hosting (Webflow) | Technical data such as IP address and browser details in server logs; form submissions stored on our behalf | To deliver the website securely and store form entries | Legitimate interests in operating a secure website |
Giving us your details is voluntary. If you do not give a required field on a form, we will not be able to send what you asked for. You can read and download our public research without subscribing.
We do not ask for sensitive personal data (such as health, ethnic origin or biometric data) on this website. Please do not send it to us through the forms or chat.
We do not sell your personal data. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
We only send research and training updates if you ticked the updates box or subscribed to our newsletter. The box is never ticked for you.
Every email includes an unsubscribe link. You can also unsubscribe at any time by emailing hello@nendo.co.ke. Unsubscribing is free and we will stop sending marketing emails once it takes effect. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
We use Google Analytics 4 to measure how the site is used. It sets cookies in your browser. Our chat widget and hosting provider may also set cookies needed for them to work.
You can opt out of analytics at any time by:
Blocking analytics cookies will not stop the site from working.
We share personal data only with service providers that process it for us under contract, and only as needed for the purposes in section 3:
| Provider | What they do for us | Where data may be processed |
|---|---|---|
| Webflow, Inc. | Website hosting and form storage | United States |
| Google LLC (Google Analytics, Google Workspace) | Website analytics, email and document storage | United States and other countries where Google operates |
| Substack, Inc. | Newsletter delivery and subscriber list | United States |
| Collectchat Inc. (Collect.chat) | Website chat widget | United States and Europe |
We may also disclose personal data where the law requires it, for example to a court or a regulator, or to protect our legal rights. If Nendo is reorganised or sold, data may pass to the new owner, who must respect this policy.
The providers in section 6 store and process data outside Kenya. We only transfer personal data out of Kenya where the Data Protection Act and the Data Protection (General) Regulations, 2021 allow it. We rely on appropriate safeguards: each provider is bound by data processing terms that require it to protect personal data to a standard comparable to Kenyan law, to process it only on our instructions and to keep it secure. Where those safeguards do not apply, we will ask for your consent first. You can ask us for more information about these safeguards.
We keep personal data only for as long as we need it for the purpose we collected it, or as the law requires. Our defaults are:
When the period ends, we delete or anonymise the data.
Under the Data Protection Act, 2019 you have the right to:
Email hello@nendo.co.ke with "Privacy request" in the subject line, saying what you would like us to do. You can also use the forms in the First Schedule to the Data Protection (General) Regulations, 2021, but you do not have to. We may ask you to confirm your identity before acting. Someone else, such as a parent or guardian or a person you have authorised in writing, can make a request on your behalf.
We will respond within the time limits in the Regulations:
These requests are free. The law allows a reasonable fee for portability, capped at our actual cost; we will tell you before charging anything. If we cannot meet a request, we will tell you why in writing and remind you of your right to complain to the Data Commissioner.
We use technical and organisational measures suited to the data we hold. These include encrypted connections (HTTPS) on the whole site, restricting access to the people who need it, and using reputable providers bound by contract to keep data secure.
If a personal data breach creates a real risk of harm to you, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell you in writing within a reasonable time, explaining what happened and what you can do to protect yourself.
Our website and newsletter are for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
If you are unhappy with how we have handled your data, please contact us first at hello@nendo.co.ke so we can try to put it right.
You also have the right to complain to the Office of the Data Protection Commissioner (ODPC):
We will update this policy when our practices or the law change. The date at the top shows when it was last updated. If we make a significant change, we will tell subscribers by email before it takes effect.
Discover what we do, who we've worked with, the work we've done, the insights you need, and questions we answer. Or simply say hello.
