PRIVACY
Privacy policy.
This policy covers the egrc.cloud website only. Personal data inside an eGRC deployment is governed by the data processing terms in your contract, where you are the controller and Sibasi Ltd is the processor.
Last updated 5 August 2026
Who is responsible.
Sibasi Ltd, a company registered in Kenya with offices in Nairobi, is the data controller for personal data collected through this website. You can reach us at [email protected] or +254-780-SIBASI.
We process personal data under the Data Protection Act 2019 (Kenya). Where the General Data Protection Regulation applies to you, we process it under that as well.
What we collect, and why.
- What you send us in the demo form
- Your name, work email, organisation, role, country, sector, approximate staff numbers and your message. We use it to respond to your enquiry and to prepare for a demo. The lawful basis is our legitimate interest in responding to a business enquiry you initiated.
- Analytics, only if you accept
- If you accept cookies we load Google Analytics 4 and Microsoft Clarity, which tell us which pages are read and where people leave. IP addresses are anonymised in GA4. If you decline, neither is loaded and no analytics identifier is set.
- Your cookie choice
- We store your accept-or-decline choice in your browser's local storage so we do not ask again on every page. This is stored on your device and is not sent to us.
How long we keep it.
Enquiries are kept for as long as the commercial conversation is live, and for up to 24 months afterwards so we can pick up a conversation you may return to. After that they are deleted.
Analytics data is retained according to the retention setting on the relevant analytics property, which is 14 months or less.
Your rights.
You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to our processing it. Write to [email protected] and we will respond within the statutory period.
If you are not satisfied with how we have handled a request, you can complain to the Office of the Data Protection Commissioner in Kenya, or to your own supervisory authority if the GDPR applies to you.
Changes to this policy.
If we change this policy we will change the date below. Material changes affecting people who have already contacted us will be notified directly.