Privacy Policy

1. Who we are

Orvantis Security ("Orvantis", "we", "I") is a founder-led offensive-security practice operated by Martin Mwathi. For the purposes of the Data Protection Act, 2019, Orvantis is the data controller for personal data described in this policy.

• Contact: martin@orvantis.co.ke
• Location: Nairobi, Kenya · remote engagements worldwide
• ODPC registration number: [registration number, once registered with the Office of the Data Protection Commissioner]

2. The data we collect

Website & enquiries

• Details you submit through the contact form (name, email, organisation, message).
• Standard server/log data (IP address, browser, pages visited) collected by our hosting provider.
• [Analytics data, if you add an analytics tool — name it here.]

Engagement data

To deliver security services we may process technical information about your systems and, where in scope, personal data contained within them. This is handled under a separate engagement contract and the terms in Section 6.

3. How we use your data

• To respond to enquiries and scope potential engagements.
• To deliver, document and support contracted security services.
• To meet legal, accounting and regulatory obligations.
• To secure and maintain our own systems.

4. Legal basis

We rely on one or more of the lawful bases under the Data Protection Act, 2019: your consent, performance of a contract, compliance with a legal obligation, and our legitimate interests in operating and securing the practice. [Confirm bases with counsel.]

5. Website analytics & cookies

[State whether the site uses cookies/analytics. The current site uses Google Fonts and, on the contact page, a third-party form provider — disclose these. If you add analytics, describe it and provide an opt-out or consent banner as required.]

6. Data handled during security engagements

• Engagement data is treated as strictly confidential and used only to perform the agreed work.
• We apply data minimisation — we do not exfiltrate or retain live client data beyond what is required to evidence a finding.
• Findings and reports are delivered securely and are not published or shared without written client authorisation.
• Retention and secure destruction timelines are defined per engagement: [state default, e.g. reports and evidence securely destroyed within N days of engagement close unless otherwise agreed].

7. Sharing & third parties

We do not sell personal data. We share it only with service providers necessary to run the practice — for example:

• Hosting provider: [name]
• Contact-form processor: [e.g. Formspree]
• Email provider: [name]

Each is bound to protect the data and process it only on our instructions.

8. International transfers

Some providers may process data outside Kenya. Where they do, we take steps to ensure an adequate level of protection consistent with the Data Protection Act, 2019. [Confirm safeguards.]

9. How we protect data

• Encryption in transit and at rest for sensitive material.
• Access controls, multi-factor authentication and least-privilege on our systems.
• Secure handling and timely destruction of engagement evidence.

10. Retention

We keep personal data only as long as necessary for the purposes above or as required by law. [State default retention periods.]

11. Your rights

Under the Data Protection Act, 2019 you may request access to, correction or deletion of your personal data, object to or restrict processing, and lodge a complaint with the Office of the Data Protection Commissioner (ODPC). To exercise these rights, contact martin@orvantis.co.ke.

12. Changes to this policy

We may update this policy from time to time. The effective date above reflects the latest version.

13. Contact

Questions about this policy or your data: martin@orvantis.co.ke.