Last updated: Jan 2026

At The BoldBoss Consultancy (“Company”, “we”, “us”, “our”), we are committed to protecting the privacy, confidentiality, and data integrity of our executive clients, enterprise partners, and website visitors. This Privacy Policy outlines our standards and protocols regarding the collection, processing, storage, and protection of personal and corporate data in full compliance with the Kenya Data Protection Act, 2019 (DPA) and guidelines set forth by the Office of the Data Protection Commissioner (ODPC).

By accessing our website (https://www.theboldbossco.com/) or engaging our advisory services, you consent to the data practices described in this policy.

1. Data Controller & Processor Capacity

Depending on the nature of the engagement:

• Data Controller: We act as a Data Controller when determining the purpose and means of processing personal data collected through our website, intake forms, and direct business communications.

• Data Processor: For enterprise agreements involving Strategic Marketing Training or Brand Management, where corporate clients provide internal employee or executive data, we act as a Data Processor executing services under the Client’s instruction.

2. Information We Collect

We collect data strictly necessary for high-ticket B2B advisory, executive positioning, and corporate training execution:

1. Executive & Identity Data: Full name, executive title, business organization, professional credentials, board appointments, and bio details.
2. Contact Information: Corporate email address, direct phone number, official business location, and communication preferences.
3. Strategic & Brand Assets: Documents, corporate communications, interview transcripts, ghostwriting inputs, brand guidelines, and market data provided during strategy sprints.
4. Corporate Training Data: Names, job titles, and professional email addresses of corporate team members participating in our training programs.
5. Commercial & Transaction Data: Billing details, tax compliance information, and invoice history (processed via encrypted, ODPC-compliant payment gateways and banking channels).
6. Technical & Browsing Data: IP addresses, browser types, device identifiers, and analytics collected via cookies when navigating our website.

3. How We Collect Data

We collect information through the following touchpoints:

• Direct Submissions: When you complete our intake application form, request an advisory proposal, or schedule a strategic consultation.

• Advisory & Ghostwriting Sessions: Information shared during strategy calls, brand interviews, executive positioning audits, or board alignment workshops.

• Corporate Onboarding: Data provided under formal Statements of Work (SOW) or Master Services Agreements (MSA).

• Automated Technologies: Website analytics and cookies used to optimize website functionality.

4. Purpose and Legal Basis for Processing

In accordance with Section 30 of the Kenya Data Protection Act, 2019, we process personal and corporate data under the following lawful bases:

5. Executive Ghostwriting & Corporate Confidentiality

For Brand Management engagements:

• All draft content, executive interviews, and strategic insights gathered for ghostwriting or public positioning are treated with strict executive confidentiality.

• No personal or proprietary executive narrative assets will be published, distributed, or released to media channels or digital platforms without explicit written sign-off from the Client or their authorized representative.

6. Data Sharing & Third-Party Processors

We do not sell, rent, or trade personal or corporate data to third parties. We may disclose data strictly to trusted third-party service providers bound by equal or higher statutory confidentiality standard obligations:

1. Infrastructure & Operations: Secure enterprise cloud storage, encrypted file-sharing systems, and scheduling platforms.
2. Financial Operations: Licensed Kenyan financial institutions and secure payment processing platforms.
3. Legal & Regulatory Authorities: Statutory bodies or courts in the Republic of Kenya when mandated by enforceable legal orders or ODPC directives.

7. Cross-Border Data Transfers

Where strategic tools, cloud storage, or media distribution networks require transferring data outside the Republic of Kenya, we ensure compliance with Section 48 of the Data Protection Act, 2019. Transfers only occur to jurisdictions providing adequate data protection safeguards or where appropriate contractual clauses (SCCs) are established.

8. Data Security & Governance

We employ technical, administrative, and physical security measures to safeguard data against unauthorized access, loss, alteration, or disclosure, including:

• End-to-end encryption for data in transit and at rest across digital platforms.

• Role-based access controls limiting strategic client files to principal advisors.

• Non-Disclosure Agreements (NDAs) enforced across all internal personnel and subcontractors.

9. Retention of Personal & Corporate Data

We retain client data only for as long as necessary to fulfill the operational, advisory, and contractual purposes outlined in our agreement, or to comply with statutory accounting and legal retention periods under Kenyan law (typically 7 years for financial and contractual records). Upon expiration of the retention period, data is securely deleted or permanently anonymized.

10. Your Statutory Rights Under Kenyan Law

Under Sections 26 to 34 of the Kenya Data Protection Act, 2019, you hold the following statutory rights regarding your data:

• Right to be Informed: To know how your data is collected and processed.

• Right of Access: To request copies of personal data held by the Company.

• Right to Rectification: To request correction of inaccurate, incomplete, or misleading data.

• Right to Erasure (“Right to be Forgotten”): To request deletion of data where processing is no longer lawful or necessary (subject to legal retention requirements).

• Right to Object / Withdraw Consent: To object to processing based on legitimate interests or direct communications at any time.

To exercise any of these statutory rights, please submit a written request to our Data Protection Desk at contact@theboldbossco.com.

11. Website Analytics & Cookie Policy

Our website uses essential and operational cookies to improve site navigation and analyze traffic patterns. Visitors can adjust cookie preferences through their browser settings. Deactivating essential cookies may impact web functionality.

12. Updates to This Privacy Policy

We reserve the right to modify this Privacy Policy to reflect evolving legal, technological, or regulatory requirements. Material revisions will be posted on our website with an updated “Last Updated” date. Continued use of our website or services constitutes acceptance of the revised policy.

13. Contact Information & Data Protection Enquiries

For inquiries, data access requests, or regulatory questions regarding our privacy practices, please contact:

• Entity Name: The BoldBoss Consultancy

• Data Protection Desk: contact@theboldbossco.com

• Website: https://www.theboldbossco.com/

• Physical Location: Kiambu, Kenya