Data Protection Policy

Black Knights (“we”, “our”, or “us”) is an AI-focused technology company headquartered in Gigiri, Nairobi, Kenya. We are committed to protecting the personal data of our clients, prospective clients, website visitors, employees, contractors, and any other individuals whose data we process.

This Data Protection Policy explains the standards we apply when handling personal data and the obligations that everyone acting on behalf of Black Knights must follow. It applies to:

• All personal data processed by Black Knights, in any format — digital or physical
• All staff, directors, contractors, and third parties who process personal data on our behalf
• All systems, services, and projects through which we collect, store, or use personal data

Where we act as a data processor on behalf of a client, this policy is applied alongside the relevant Data Processing Agreement (DPA), which takes precedence to the extent of any conflict.

We process personal data in accordance with the data protection laws applicable to us and to the individuals we serve, including:

• The Kenya Data Protection Act, 2019 and its accompanying regulations, overseen by the Office of the Data Protection Commissioner (ODPC)
• The EU General Data Protection Regulation (GDPR) and the UK GDPR, where we process the data of individuals in the EEA or the United Kingdom
• Any other applicable national data protection or privacy legislation relevant to a specific engagement

Where multiple frameworks apply, we adopt the highest applicable standard of protection.

Every processing activity we undertake is measured against the following principles, drawn from Section 25 of the Kenya Data Protection Act and Article 5 of the GDPR:

We only process personal data where we have a valid lawful basis. Depending on the context, this will be one of:

• Consent — the individual has given clear, specific, informed, and freely given consent
• Contract — processing is necessary to deliver a service or to take steps at the individual's request before entering a contract
• Legal obligation — processing is necessary to comply with the law
• Vital interests — processing is necessary to protect someone's life
• Legitimate interests — processing is necessary for our legitimate interests, balanced against the rights and freedoms of the individual

We record the lawful basis relied on for each processing activity. Where we rely on consent, individuals may withdraw it at any time without affecting the lawfulness of earlier processing.

Certain categories of data — such as health information, data revealing racial or ethnic origin, biometric data, or data concerning a person's vulnerability — carry a higher risk and require additional protection. We process such data only where:

• We have an additional condition for processing under the applicable law (for example, explicit consent)
• Access is tightly restricted to those with a genuine need
• Enhanced security and confidentiality controls are applied

Our handling of data relating to customers in vulnerable circumstances is governed by both this policy and our Vulnerable Customers Policy.

We respect and facilitate the rights individuals hold over their personal data, including the rights of access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decision-making with significant effects.

Requests can be made to hello@blackknights.co.ke. We respond within the statutory timeframe (generally 30 days) and may verify identity before acting. A full description of these rights and how to exercise them is set out in our Privacy Policy.

We apply appropriate technical and organisational measures (TOMs) to protect personal data against unauthorised access, loss, or alteration:

We keep personal data only for as long as necessary to fulfil the purpose for which it was collected or to meet legal and contractual obligations. When data is no longer required, it is securely deleted or irreversibly anonymised — digital records are permanently purged and physical records are shredded.

We maintain a retention schedule that defines retention periods by data category. Indicative periods are set out in our Privacy Policy.

We maintain a documented breach response procedure. In the event of a personal data breach we will:

• Contain and assess the breach, recording its nature, scope, and likely impact
• Notify the Office of the Data Protection Commissioner (and other relevant authorities) without undue delay — and, where the GDPR applies, within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals
• Inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
• Where we act as a processor, notify the affected client promptly and support their own notification obligations
• Conduct a post-incident review to prevent recurrence and update controls accordingly

We share personal data only where necessary and lawful. Any third party that processes personal data on our behalf is vetted, bound by a written Data Processing Agreement, and required to apply security standards equivalent to our own.

Where personal data is transferred outside its country of origin — including outside the EEA or Kenya — we put appropriate safeguards in place, such as Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements (IDTAs), or transfers to jurisdictions recognised as providing adequate protection.

We demonstrate accountability through documented governance:

• A Record of Processing Activities (ROPA) covering the personal data we process
• Ongoing data protection training and awareness for all staff
• Regular internal reviews and audits of our processing and security controls
• Clear procedures for handling data subject requests and regulatory enquiries

This policy is reviewed at least annually, and whenever there is a material change to our processing activities or the law. The current version is always published on this page.

For any question about this policy, our data protection practices, or to exercise your rights, please contact us: