Privacy Policy

Last updated: 27 September 2026

CHASP Advisory is an African-led consulting, research and advisory firm based in Nairobi, Kenya. This policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it.

1. Introduction

CHASP Advisory ("CHASP", "we", "us" or "our") provides advisory, research, evaluation and technical assistance services across the development and humanitarian sectors.

We are committed to protecting the privacy of everyone whose personal data we hold: visitors to this website, our clients and partners, consultants who apply to our expert roster, and the individuals and communities who take part in the research and evaluations we carry out.

This policy is written to meet our obligations under the Kenya Data Protection Act, 2019 and, where our processing falls within its scope, the EU General Data Protection Regulation (GDPR).

2. Who is responsible for your data

CHASP Advisory is the data controller for the personal data described in this policy.

For any data protection enquiry, contact us at advisory@chasp.co.ke.

3. Personal data we collect

3.1 Information you provide to us

• Contact form. Your name, email address and the content of your message.
• Newsletters and mailing lists. Your name and email address.
• Consultant and talent roster applications. The information in your CV and cover note — typically your name, contact details, country of residence, employment history, qualifications, technical areas of expertise, language proficiency and professional references.
• Correspondence. Records of your emails, calls and meetings with us.
• Events and trainings. Registration details when you sign up for an event or training we host.

3.2 Information collected automatically

When you visit this website we automatically collect limited technical information through cookies and similar technologies, including your IP address, browser and device type, the pages you view, how you arrived at the site, and the dates and times of your visit. Section 4 sets this out in detail.

3.3 Research and evaluation data

In the course of our assignments we may collect personal data from research participants, including survey and interview responses, household and beneficiary details, geographic location, photographs, and in some cases sensitive personal data such as information about health, disability, income, gender or displacement status.

This data is collected under contract with the commissioning client, on the basis of informed consent obtained from participants at the point of collection, and in line with the ethical approvals governing the study. Participants are told at that point what the study is for, who will receive the data and how long it will be kept. We do not use research data for our own marketing or commercial purposes.

4. Cookies and analytics

Cookies are small text files placed on your device when you visit a website. This site currently uses:

• Google Analytics (cookies named _ga and _ga_<ID>), deployed through Google Tag Manager, to understand how many people visit the site and which content is most useful. This data is processed by Google LLC.
• Referral tracking (cookies beginning sbjs_), which record how you arrived at the site, such as via a search engine or a link from another website.
• Session and preference cookies (such as PHPSESSID), necessary for the website to function. Additional wp-settings cookies are set only for logged-in site administrators.

You can control or delete cookies through your browser settings, and you can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on. Blocking cookies may affect how parts of this website work.

5. Why we use your data, and our lawful basis

Purpose	Lawful basis
Responding to enquiries you send us	Legitimate interests; steps towards entering a contract
Delivering advisory, research and evaluation services	Performance of a contract
Assessing applications to our consultant roster	Consent; steps towards entering a contract
Sending newsletters and updates	Consent, which you may withdraw at any time
Understanding and improving how this website is used	Legitimate interests
Research and evaluation involving participants	Consent, and where applicable the public interest or the vital interests of the data subject in humanitarian contexts
Meeting legal, tax, audit and donor reporting obligations	Compliance with a legal obligation

6. Sharing your data

We do not sell your personal data, and we do not share it for advertising purposes. We may share it with:

• Service providers supporting our operations — website hosting, email delivery and analytics — acting under contract and only on our instructions.
• Clients and donors, in the context of assignments we carry out for them. Research findings are normally reported in anonymised or aggregated form unless participants have specifically consented otherwise.
• Professional advisers, such as auditors and legal counsel, where necessary.
• Regulators, courts or law enforcement, where we are required to do so by law.

7. International transfers

We operate across multiple African countries and work with international clients and donors, so your data may be transferred outside Kenya — for example to service providers hosting data in the European Union or the United States.

Where we transfer personal data out of Kenya we do so in accordance with sections 48 and 49 of the Data Protection Act, 2019, on the basis of appropriate safeguards, your consent, or the necessity of the transfer for the performance of a contract. Where the GDPR applies, transfers outside the European Economic Area are made under an adequacy decision or standard contractual clauses.

8. How long we keep your data

• Website enquiries: up to 24 months after our last contact with you.
• Consultant roster applications: up to 3 years, after which we delete your details or ask whether you wish to remain on the roster.
• Newsletter subscriptions: until you unsubscribe.
• Research and evaluation data: for the period specified in the contract with the commissioning client, after which it is returned to them or securely destroyed.
• Financial and contractual records: for the period required by Kenyan tax and company law.

9. How we protect your data

We apply technical and organisational measures appropriate to the sensitivity of the data we hold. These include encrypted connections to this website, access controls limiting staff access to what their role requires, confidentiality obligations in our staff and consultant contracts, secure handling protocols for field data collection, and contractual data protection terms with our clients and suppliers.

No system can be guaranteed completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and affected individuals as required by law.

10. Your rights

Under the Data Protection Act, 2019 and, where applicable, the GDPR, you have the right to:

• be informed of how your personal data is being used;
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• request deletion of your data where there is no continuing lawful reason for us to hold it;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• request that we restrict processing in certain circumstances;
• receive your data in a portable format, where the GDPR applies; and
• withdraw consent at any time, where consent is the basis for our processing.

To exercise any of these rights, email advisory@chasp.co.ke. We may need to verify your identity before responding. We will reply within the timeframes set by law, and in any event without undue delay.

11. Children

This website is not directed at children, and we do not knowingly collect personal data from children through it.

Some of our research and evaluation work does involve children, for example in child protection, education and nutrition programmes. Where it does, we process their data only with the consent of a parent or guardian, in line with section 33 of the Data Protection Act, 2019, the ethical approvals governing the study, and the child safeguarding policies of the commissioning client.

12. Complaints

If you are concerned about how we have handled your personal data, please contact us first at advisory@chasp.co.ke so we can try to resolve it.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (Kenya) at www.odpc.go.ke. If you are in the European Economic Area or the United Kingdom, you may complain to your national supervisory authority.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. The date at the top of this page shows when it was last revised. Where changes are significant, we will bring them to your attention.

14. Contact us