Privacy Policy

1Who We Are

TrainingComplex Institute ("TrainingComplex", "we", "us", "our") is a professional training and capacity-building organisation registered in Kenya, headquartered in Nairobi. We provide short courses, certificate programmes, and corporate training solutions across leadership, project management, finance, human resources, ICT, monitoring & evaluation, and other professional disciplines.

For the purposes of the Kenya Data Protection Act, 2019 (the "Act"), TrainingComplex is the Data Controller in respect of the personal data you provide to us. Our designated Data Protection Contact can be reached using the details in Section 13.

2Information We Collect

We collect personal data that you provide to us directly, data generated when you use our services, and in some cases data from third parties. The categories we collect include:

2.1 Information you provide directly

• Identity data: full name, date of birth, national ID or passport number (where required for certification).
• Contact data: email address, phone number (including WhatsApp), physical address.
• Professional data: employer / organisation name, job title, industry sector, years of experience.
• Enrolment data: selected course(s), preferred training format (in-person, online, hybrid), location preference.
• Payment data: M-Pesa transaction reference, bank transfer details, or payment card information (processed by our payment processor; we do not store raw card numbers).
• Communications: enquiry forms, emails, WhatsApp messages, or any other correspondence you send us.
• Account credentials: username and hashed password if you create a learner account.

2.2 Information collected automatically

• Usage data: pages visited, time on site, links clicked, course pages viewed, search queries on our site.
• Device & technical data: IP address, browser type and version, operating system, screen resolution, referring URL.
• Cookie data: session cookies, preference cookies, and analytics cookies (see Section 7).

2.3 Information from third parties

• Employer or sponsoring organisation details when a corporate client books training on your behalf.
• Information from referral partners or professional bodies when you are referred to our programmes.
• Public professional profile data (e.g., LinkedIn) only when you explicitly connect such a profile to your account.

3How We Use Your Data

We use the personal data we hold about you for the following purposes:

We will never use your personal data for automated decision-making that produces significant legal or similarly significant effects without your explicit consent.

4Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we must have a lawful basis for processing your personal data. The bases we rely on are:

• Contract performance: processing necessary to enrol you in a course, deliver training, issue your certificate, and process payment.
• Legitimate interests: improving our services, detecting fraud, ensuring website security, and communicating about closely related services — provided this does not override your rights.
• Legal obligation: processing required to comply with Kenyan tax law, professional accreditation requirements, or valid court orders.
• Consent: sending you marketing communications about new courses and promotions. You may withdraw consent at any time (see Section 9).

5Sharing Your Information

We do not sell your personal data. We share it only in the following limited circumstances:

• Facilitators and trainers: accredited trainers delivering your chosen course receive the participant list (name, organisation) to prepare relevant training materials.
• Payment processors: M-Pesa (Safaricom), bank payment gateways, or card processors receive only the data needed to complete your transaction.
• Certification and accreditation bodies: where a course leads to an externally accredited certificate, your name and course result may be shared with the relevant body.
• Corporate clients: if your employer has sponsored your training, we may share your attendance and completion status with the authorised contact at that organisation.
• IT and cloud service providers: hosting, email, and CRM providers who process data on our behalf under data-processing agreements that require equivalent protections.
• Legal and regulatory authorities: government agencies, courts, or law enforcement when required by law or to protect our legal rights.

6International Data Transfers

Our primary operations are based in Kenya. Where we use cloud-based tools or services operated by companies outside Kenya (for example, email platforms or cloud hosting), your data may be transferred to and processed in other countries.

When we transfer personal data outside Kenya, we ensure an adequate level of protection is in place by:

• Using service providers in countries recognised as providing adequate data protection;
• Implementing standard contractual clauses or equivalent safeguards; or
• Obtaining your explicit consent for the specific transfer.

You may request details of the safeguards in place for any international transfer by contacting us (Section 13).

7Cookies & Tracking

Our website uses cookies — small text files stored on your device — to make the site work, remember your preferences, and understand how visitors use it.

You can control or delete cookies through your browser settings at any time. Disabling strictly-necessary cookies may affect how the site functions. You can also contact us to withdraw consent for analytics or marketing cookies.

8Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Our standard retention periods are:

• Enrolment and payment records: 7 years (Kenya tax and financial regulations).
• Certificates and transcripts: indefinitely (to enable future verification requests).
• Learner account data: retained while your account is active, then deleted within 12 months of your confirmed account closure request.
• Marketing preferences: until you withdraw consent or opt out.
• General enquiries and correspondence: 3 years from last contact.
• Website analytics: 26 months in aggregated, anonymised form.

At the end of the applicable retention period, data is securely deleted or anonymised.

9Your Rights

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:

To exercise any of these rights, please submit a written request to us (see Section 13). We will respond within 30 days. We may need to verify your identity before processing the request.

10Security Measures

We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:

• HTTPS encryption for all data transmitted to and from our website.
• Secure, access-controlled storage for all digital records.
• Password hashing and multi-factor authentication for staff accounts with access to personal data.
• Regular security reviews of our systems and third-party service providers.
• Restricted access to personal data on a need-to-know basis within our organisation.
• Staff training on data protection obligations.

In the event of a personal data breach that is likely to affect your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner (ODPC) as required by law — within 72 hours of becoming aware.

11Children's Privacy

Our training programmes are designed for working professionals and adults aged 18 and over. We do not knowingly collect personal data from individuals under 18 without the explicit consent of a parent or legal guardian.

If you believe we have inadvertently collected data from a minor, please contact us immediately at the details in Section 13 and we will promptly delete such information.

12Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Display a prominent notice on our website for a reasonable period.
• Where required by law or where the change significantly affects you, notify you directly by email.

We encourage you to review this policy periodically. Continued use of our services after an update constitutes acceptance of the revised policy.

13Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your rights, or want to raise a data protection concern, please contact us: