Legal
Data Protection
Draft for legal review. This document is an editable draft prepared as a starting point. It has not been reviewed by a lawyer and should be checked by a qualified legal professional familiar with Kenyan law and the laws of the markets you serve before being relied on.
This page explains how Bravura VA approaches data protection and confidentiality when supporting client businesses. It complements our Privacy Policy, which covers personal data collected through this website.
Our role
When we provide services, we usually act on our client's instructions in relation to the client's data (in many jurisdictions, as a "processor" or "service provider"). Our client remains responsible for deciding why and how their data is used. Specific responsibilities are set out in each client agreement, and we can enter into a data processing agreement where required.
Laws we consider
We are based in Kenya and take into account the Kenya Data Protection Act, 2019. Depending on our clients' locations and sectors, client data may also be subject to laws such as the UK GDPR and Data Protection Act 2018, the Australian Privacy Act 1988, and US federal and state laws. We discuss relevant requirements with each client before work begins.
We do not claim any certification (such as SOC 2, ISO 27001, HIPAA or "GDPR certification"). Where a client's sector has specialist obligations (for example, healthcare, legal or financial services) those obligations must be assessed and agreed before any work begins.
Our practices
- Confidentiality: confidentiality expectations agreed in writing; NDAs signed on request.
- Least-privilege access: assistants receive only the access needed for agreed tasks, ideally through individual user accounts.
- No shared passwords: we recommend password managers with shared vaults rather than sending credentials by email or chat.
- Work in your systems: client data stays in client systems wherever possible, and is not copied to personal devices or unapproved tools.
- Responsible AI use: confidential or personal data is not entered into AI tools unless the client has approved that use.
- Access removal: access is reviewed regularly and removed promptly when no longer required.
- Incident reporting: if we become aware of a security incident affecting client data, we will notify the client without undue delay and cooperate in the response.
[EDIT: add details of device security standards, staff confidentiality undertakings and training once finalized.]
Your questions
Clients and prospective clients can request more information about our data protection practices by emailing va@bravura.co.ke.