Privacy Policy

1. Who we are

Vanguard Business Informatics Limited ("Vanguard BI", "we", "us") is a Google Cloud partner and Google Workspace reseller. We help organisations with Google Workspace, data and business intelligence, AI and automation, websites, cloud services and digital business cards. Our office is at Ongata Mall, Ongata Rongai, Nairobi, Kenya.

For the personal data described in this policy, Vanguard BI is the data controller under Kenya's Data Protection Act, 2019.

This policy covers our website (vanguard.bi), our enquiry and contact channels, our recruitment (including our careers pages and our job ads on Facebook and Instagram), and our dealings with clients and suppliers.

2. What we collect

When you contact us

Your name, work email, company and phone number from our contact form, plus anything you tell us in the message, on a call, by email or on WhatsApp. If you came to us from one of our ads and you have agreed to it, we also tell Meta that an enquiry came from that ad (see Cookies, analytics and ads).

When you apply for a job

Your name, phone number and email, your answers to the application questions (for example your experience, qualifications and availability), any written task you complete, and any CV or profile link you give us. See Job applicants.

When you are a client or supplier

The names, work contact details and roles of the people we work with, contract and billing details, and the records of our work together, such as support requests and meeting notes.

When you visit our website

Basic technical information such as your browser, device type, the pages you visit and an approximate location from your IP address. If you accept cookies on our banner, Meta also receives information about your visit (see Cookies, analytics and ads).

We do not ask for sensitive personal data, such as health, religion or ethnic origin. Please don't include it in an application or message.

3. How we use it, and why

The Data Protection Act requires a lawful basis for each use. These are ours:

Where we rely on consent, you can withdraw it at any time. That stops future use but does not undo anything done lawfully before.

We do not make decisions about you, including hiring decisions, by automated means alone. A person reviews every application.

4. Job applicants

We advertise some roles on Facebook and Instagram. Depending on the role, you can apply on our website, by email or WhatsApp, or through an application form hosted by Meta.

If you apply on our website, by email or on WhatsApp

Your answers, your written task and your CV come straight to our Google Workspace account. They are never shared with Meta.

If you agree, through our cookie banner or the optional box on the application form, we tell Meta that an application came from one of its ads. To do that we send your email, phone and name in coded (hashed) form, plus the reference of the ad you clicked, so Meta can match the application to the ad. Saying no has no effect on your application.

If you apply through a Meta form

Meta passes your answers and contact details to us. Meta's own handling of your data is covered by Meta's Privacy Policy.

However you apply

• We store your application in our Google Workspace account, where only the people hiring for that role can see it.
• We use it only to assess your application, to contact you about it by phone, WhatsApp or email, and to arrange interviews.
• To help us decide what to read first, our system sorts applications by how well the answers match the role. It never rejects anyone: a person reads every application.
• We check references only with your permission, at a later stage.
• If you are not shortlisted, we keep your application for 12 months in case a similar role opens, then delete it. You can ask us to delete it sooner.
• If you join us, your application becomes part of your employee record, which is covered by a separate staff privacy notice.

Applications are open to all qualified candidates. We do not ask for your age, gender, religion, ethnicity, marital status or health.

5. Data we handle for clients

When we build or run systems for a client, such as a CRM, booking tool or reporting dashboard, we may handle personal data about that client's own customers. In that work the client is the data controller and we are their data processor. We follow the client's written instructions and our agreement with them, and use that data for no other purpose. If your data is held in a system we run for one of our clients, please contact that organisation first. We will help them answer your request.

6. Who we share it with

We never sell or rent personal data. We share it only with:

• Service providers that host or process data for us under contract: Google (Workspace and Cloud), Meta (Facebook and Instagram ads and application forms), Cloudflare (website hosting, security and cookie-free analytics), and the payment and accounting tools we use.
• Professional advisers, such as our accountants, auditors and lawyers, where they need it to advise us.
• Authorities, when the law requires it, for example the Kenya Revenue Authority or a court order.
• A future owner of our business, if Vanguard BI is reorganised, merged or sold. Your data would remain protected by this policy.

7. Transfers outside Kenya

Some of our service providers, including Google, Meta and Cloudflare, store or process data on servers outside Kenya. We use providers that offer appropriate safeguards for personal data, such as contractual data protection terms, as the Data Protection Act requires. You can ask us for details of these safeguards.

8. How long we keep it

After that we delete the data or anonymise it so that it no longer identifies you.

9. How we protect it

We keep personal data in business accounts with two-step sign-in. Access is limited to the people who need it for their work, and we review that access regularly. Our staff are bound by confidentiality. If a breach puts your data at real risk, we will notify the Data Protection Commissioner and, where required, you, within the time the law sets.

10. Your rights

Under the Data Protection Act, 2019, you have the right to:

• be told how your personal data is used (this policy);
• see the personal data we hold about you;
• have inaccurate or misleading data corrected;
• have data deleted when we no longer have a lawful reason to keep it;
• object to our use of your data, including for direct marketing;
• receive your data in a portable format;
• withdraw consent at any time.

To use any of these rights, email hello@vanguard.bi with the subject line "Data request". We may ask you to confirm your identity first. We will reply within the time the Act and its regulations allow, and we do not charge for reasonable requests.

11. Cookies, analytics and ads

Our website works without optional cookies. We use:

• Cloudflare Web Analytics to count visits. It does not set cookies or track you across other sites.
• Meta analytics cookies to understand how our ads perform. These runonly if you choose Accept on our cookie banner. You can change your choice at any time through "Cookie preferences" at the foot of every page.
• Ad matching, only with your agreement. When you send an enquiry or a job application after accepting the banner (or ticking the optional box on an application), we tell Meta that it came from one of its ads. We send your email, phone and name in coded (hashed) form, never the content of your message, answers or CV.

12. Children

Our website, services and job ads are meant for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as our services or the law change. We will post the new version here with its date. If a change significantly affects how we use your data, we will tell you directly where we can.

14. Contact and complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Office of the Data Protection Commissioner at odpc.go.ke.