PRIVACY POLICY

Website: judithonchaga.com

Effective Date: 13 July 2026

 

1. Introduction

Welcome to judithonchaga.com ("Website").

Judith Onchaga ("Judith", "we", "our", or "us") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, disclose, store, protect and process personal information obtained through our Website and during the provision of virtual assistant and business support services.

This Policy has been prepared in accordance with:

• The Kenya Data Protection Act, 2019
• The Data Protection (General) Regulations, 2021
• International privacy best practices
• Relevant principles of the European Union General Data Protection Regulation (GDPR) where applicable
• Other applicable privacy laws governing international clients.

Our objective is to ensure transparency regarding how your information is handled while providing secure and professional services.

 

2. Scope

This Privacy Policy applies to:

• visitors to judithonchaga.com;
• prospective clients;
• existing clients;
• suppliers;
• business partners;
• contractors;
• individuals contacting us through the Website;
• subscribers to newsletters;
• users downloading resources;
• participants in consultations;
• persons interacting with us through social media where applicable.

This Policy applies regardless of whether you access the Website using:

• desktop computers;
• laptops;
• tablets;
• mobile devices;
• other internet-enabled devices.

 

3. Acceptance of this Policy

By using this Website, requesting services, communicating with Judith Onchaga or providing your personal information, you acknowledge that:

• you have read this Privacy Policy;
• you understand how your personal information is processed;
• you consent to the collection and use of your information as described herein where consent is the applicable legal basis.

Where consent is required by law, you may withdraw that consent at any time, subject to legal or contractual limitations.

 

4. Information We Collect

Depending upon your interaction with us, we may collect the following categories of information.

Personal Identification Information

This may include:

• full name;
• company name;
• job title;
• postal address;
• billing address;
• country of residence;
• telephone number;
• email address.

 

Business Information

Where services are provided to organisations, we may collect:

• company registration details;
• VAT or tax information;
• business contact information;
• business websites;
• branding assets;
• operational information necessary to deliver services.

 

Account Information

Where client portals or collaboration tools are used, we may collect:

• usernames;
• account identifiers;
• profile information;
• project preferences.

Passwords remain encrypted or managed through the relevant third-party platform and are not intentionally stored in plain text.

 

Project Information

To perform our services, we may collect information such as:

• project briefs;
• business objectives;
• marketing materials;
• customer communication templates;
• travel information;
• schedules;
• documents;
• spreadsheets;
• presentations;
• databases;
• administrative records.

Only information necessary to provide the agreed services will be requested.

 

Financial Information

For payment processing purposes, we may collect:

• invoice details;
• transaction references;
• payment confirmations;
• billing records.

Sensitive financial information such as complete card details is generally processed directly by secure third-party payment providers and is not stored on our Website.

 

Technical Information

When you visit our Website, certain technical information may be collected automatically, including:

• IP address;
• browser type;
• operating system;
• device information;
• referring website;
• pages visited;
• date and time of access;
• session duration;
• clickstream data.

This information assists us in maintaining Website security and improving user experience.

 

Communications

We retain records of communications exchanged through:

• email;
• contact forms;
• consultation requests;
• support enquiries;
• messaging applications;
• online meetings.

These communications help us manage projects, improve service quality and maintain accurate business records.

 

5. Information We Do Not Intentionally Collect

We do not intentionally collect or request:

• unnecessary sensitive personal information;
• biometric information;
• genetic information;
• political opinions;
• religious beliefs;
• trade union membership;
• health information unrelated to service delivery;
• criminal records,

unless legally required or voluntarily provided where directly relevant to the requested service.

Where such information is inadvertently received, appropriate safeguards will be applied, and the information will only be retained where necessary and lawful.

 

6. How We Collect Information

Information may be collected directly from you when you:

• complete Website forms;
• send emails;
• request quotations;
• purchase services;
• schedule consultations;
• subscribe to newsletters;
• download resources;
• communicate through social media;
• participate in meetings;
• provide project documentation.

Information may also be collected automatically through cookies and analytics technologies as explained later in this Policy.

 

7. Legal Bases for Processing

Where required by applicable law, we process personal information based on one or more of the following lawful grounds:

• your consent;
• performance of a contract;
• compliance with legal obligations;
• protection of legitimate business interests;
• establishment, exercise or defence of legal claims.

Where consent is the basis for processing, you may withdraw that consent at any time without affecting the lawfulness of processing undertaken before withdrawal.

 

8. Why We Collect Your Information

We process personal information to:

• provide virtual assistant services;
• communicate with clients;
• manage projects;
• process payments;
• issue invoices;
• schedule meetings;
• improve our Website;
• respond to enquiries;
• comply with legal obligations;
• maintain business records;
• prevent fraud;
• ensure security;
• deliver requested resources;
• administer client accounts.

We only collect information that is reasonably necessary for these legitimate purposes.

 

9. Cookies and Similar Technologies

To improve user experience and enhance the functionality of judithonchaga.com, we may use cookies and similar technologies.

Cookies are small text files placed on your device when you visit a website. They help websites remember information about your visit and improve performance.

We may use the following categories of cookies:

Essential Cookies

These cookies are necessary for the operation of the Website and cannot normally be disabled. They enable core functions such as:

• page navigation;
• security;
• form submissions;
• session management;
• fraud prevention.

Without these cookies, certain Website functions may not operate correctly.

 

Analytics Cookies

Analytics cookies help us understand how visitors interact with our Website.

Information collected may include:

• pages visited;
• session duration;
• visitor location (general geographic region);
• browser type;
• device type;
• referral sources;
• navigation behaviour.

This information is aggregated and generally does not directly identify individual users.

 

Functional Cookies

These cookies remember preferences selected by users, including:

• language preferences;
• form information;
• user interface settings;
• accessibility preferences.

 

Marketing Cookies

Where applicable, marketing cookies may be used to measure the effectiveness of advertising campaigns and improve the relevance of content shown to visitors.

Judith Onchaga does not intentionally sell personal information to advertisers.

 

10. Analytics Services

We may use website analytics services such as:

• Google Analytics;
• Google Search Console;
• Microsoft Clarity;
• Meta Pixel;
• LinkedIn Insight Tag;
• other reputable analytics providers.

These tools help us understand:

• Website performance;
• visitor behaviour;
• traffic sources;
• content effectiveness;
• technical issues.

Information generated through analytics tools is generally processed in accordance with the privacy policies of the respective providers.

Where required by law, appropriate consent mechanisms will be used before enabling non-essential analytics technologies.

 

11. Third-Party Service Providers

To deliver our services efficiently, Judith Onchaga may engage trusted third-party providers to process information on our behalf.

These providers may include:

Communication Platforms

• Google Workspace
• Microsoft 365
• Gmail
• Outlook
• Zoom
• Google Meet
• Microsoft Teams
• Slack
• WhatsApp Business

 

Scheduling Platforms

• Calendly

 

Cloud Storage Providers

• Google Drive
• Dropbox
• Microsoft OneDrive

 

Payment Processors

• Stripe
• PayPal
• Wise
• Flutterwave
• Payoneer
• M-Pesa
• commercial banking institutions.

 

Productivity Platforms

• Trello
• Asana
• Notion
• ClickUp

 

Design Tools

• Canva

 

AI Productivity Tools

Where appropriate, AI-assisted technologies may be used to improve efficiency in delivering administrative, research, drafting, and workflow services.

Examples include:

• ChatGPT
• Microsoft Copilot
• Google Gemini
• Claude
• other reputable AI tools.

AI tools are used responsibly and are subject to human oversight. Sensitive client information is not intentionally shared with AI systems unless necessary for service delivery and permitted by the client or applicable law.

 

12. Sharing Personal Information

Judith Onchaga does not sell, rent or trade your personal information.

Information may only be shared:

• where necessary to perform contracted services;
• with authorised payment providers;
• with trusted technology providers;
• where required by law;
• where necessary to protect legal rights;
• with your express consent.

Where third parties process information on our behalf, reasonable efforts are made to ensure they maintain appropriate confidentiality and security standards.

 

13. International Data Transfers

Because some technology providers operate globally, your information may be processed or stored outside Kenya.

Where international transfers occur, reasonable measures will be implemented to ensure that personal information continues to receive an appropriate level of protection.

Such safeguards may include:

• contractual safeguards;
• recognised international privacy frameworks;
• security certifications;
• encrypted communications;
• secure cloud infrastructure.

Where required by applicable law, appropriate safeguards consistent with the Kenya Data Protection Act, 2019 and relevant GDPR principles will be implemented.

 

14. Data Retention

Personal information will only be retained for as long as reasonably necessary to:

• provide services;
• fulfil contractual obligations;
• comply with tax obligations;
• comply with legal requirements;
• resolve disputes;
• maintain business records;
• enforce legal rights.

Retention periods vary depending on the type of information collected.

When information is no longer required, it will be securely deleted, anonymised or destroyed in accordance with applicable legal and operational requirements.

 

15. Data Security

Protecting your information is extremely important.

Judith Onchaga implements reasonable technical and organisational safeguards, including:

• password protection;
• encrypted communications where available;
• secure cloud storage;
• multi-factor authentication where supported;
• limited access controls;
• secure backup procedures;
• device security measures;
• software updates;
• antivirus protection.

While reasonable efforts are taken to safeguard personal information, no method of electronic transmission or internet storage can be guaranteed to be completely secure.

Accordingly, absolute security cannot be guaranteed.

 

16. Children's Privacy

The Website and services are intended for individuals who are at least eighteen (18) years of age or who otherwise have legal capacity to enter into binding agreements.

We do not knowingly collect personal information from children.

If we become aware that personal information has been collected from a child without appropriate legal authority, reasonable steps will be taken to delete such information promptly.

 

17. Marketing Communications

Where you voluntarily subscribe to newsletters or marketing communications, we may send information relating to:

• business updates;
• articles;
• service announcements;
• promotions;
• educational resources.

You may unsubscribe from marketing communications at any time by:

• clicking the unsubscribe link included in emails; or
• contacting us directly.

Transactional communications relating to active projects or legal obligations may continue where necessary.

 

18. Your Privacy Rights

Subject to applicable law, you may have the right to:

• request access to your personal information;
• request correction of inaccurate information;
• request deletion of personal information;
• object to certain processing activities;
• request restriction of processing;
• request data portability;
• withdraw consent where consent is relied upon;
• lodge a complaint with the relevant supervisory authority.

Requests will be considered in accordance with the Kenya Data Protection Act, 2019 and other applicable legal requirements.

 

19. Exercising Your Privacy Rights

If you wish to exercise any of your privacy rights, you may submit a written request to Judith Onchaga using the contact details provided at the end of this Privacy Policy.

To help us process your request efficiently, please include:

• your full name;
• your preferred contact details;
• sufficient information to identify the records you are requesting;
• the specific right you wish to exercise;
• any supporting documentation required to verify your identity.

Where permitted by law, we may request reasonable proof of identity before disclosing, correcting or deleting personal information.

We aim to respond to legitimate requests within the timeframes prescribed under applicable law. Where additional time is reasonably required due to the complexity or volume of the request, we will notify you accordingly.

 

20. Data Breach Management

Judith Onchaga takes information security seriously and maintains procedures designed to detect, investigate and respond to suspected personal data breaches.

If a breach involving personal information is identified, we will:

• investigate the nature and scope of the incident;
• take reasonable steps to contain and mitigate any harm;
• restore the integrity and security of affected systems where practicable;
• notify affected individuals where required by applicable law;
• notify the Office of the Data Protection Commissioner (ODPC) in Kenya where legally required;
• cooperate with relevant authorities during any investigation.

While no online system can guarantee absolute security, reasonable administrative, technical and organisational safeguards are maintained to reduce the likelihood and impact of security incidents.

 

21. Third-Party Websites

Our Website may contain links to third-party websites, applications or online resources for your convenience.

Examples may include:

• payment providers;
• scheduling platforms;
• social media platforms;
• government websites;
• business resources;
• partner websites.

Once you leave judithonchaga.com, this Privacy Policy no longer applies.

Judith Onchaga is not responsible for the privacy practices, content or security of third-party websites. We encourage users to review the privacy policies of every external website they visit before providing personal information.

 

22. California Privacy Rights (CCPA/CPRA)

Where applicable, residents of California may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

Subject to applicable legal requirements, eligible individuals may have the right to:

• know what categories of personal information are collected;
• request access to personal information;
• request correction of inaccurate personal information;
• request deletion of personal information;
• limit the use of certain sensitive personal information where applicable;
• opt out of the sale or sharing of personal information.

Judith Onchaga does not sell personal information or knowingly share personal information for cross-context behavioural advertising.

Any requests submitted under applicable California privacy laws will be handled in accordance with those laws.

 

23. GDPR Information for International Clients

Where the General Data Protection Regulation (GDPR) applies, individuals located within the European Economic Area (EEA), the United Kingdom or other jurisdictions with similar privacy legislation may have additional rights.

These rights may include:

• the right of access;
• the right to rectification;
• the right to erasure ("right to be forgotten");
• the right to restrict processing;
• the right to object to processing;
• the right to data portability;
• the right not to be subject solely to automated decision-making where applicable;
• the right to lodge a complaint with the relevant supervisory authority.

Where GDPR applies, personal information will only be processed on a lawful basis, including:

• consent;
• contractual necessity;
• compliance with legal obligations;
• legitimate interests;
• protection of vital interests where applicable.

Judith Onchaga will implement reasonable safeguards for international data transfers where required by law.

 

24. Record Keeping

To ensure accountability and compliance, we may retain records relating to:

• client agreements;
• quotations;
• invoices;
• payment confirmations;
• correspondence;
• project documentation;
• service delivery records;
• legal compliance obligations;
• dispute resolution.

Such records are maintained only for as long as reasonably necessary to fulfil contractual, operational, legal or regulatory requirements.

 

25. Changes to this Privacy Policy

Judith Onchaga may update this Privacy Policy from time to time to reflect:

• changes in applicable laws;
• improvements to our services;
• technological developments;
• changes to our business operations;
• updated security practices.

The latest version will always be published on judithonchaga.com together with the revised effective date.

Where required by law, material changes may be communicated using appropriate methods before they take effect.

Continued use of the Website following publication of an updated Privacy Policy constitutes acceptance of those changes to the extent permitted by law.

 

26. Contact Information

If you have any questions regarding this Privacy Policy, the processing of your personal information, or wish to exercise any of your privacy rights, please contact:

Judith Onchaga
Virtual Assistant & Business Support Professional

Website: https://judithonchaga.com

Email: hello@judithonchaga.com

Location: Kenya

Where required by law, you may also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya if you believe your personal information has been processed unlawfully.

 

27. Entire Privacy Policy

This Privacy Policy should be read together with the following documents published on judithonchaga.com:

• Terms & Conditions
• Refund & Cancellation Policy
• Any applicable Service Agreement, Proposal, Quotation or Statement of Work

In the event of any inconsistency between this Privacy Policy and a separately executed written agreement, the written agreement shall prevail to the extent of the inconsistency.

 

Final Statement

Judith Onchaga is committed to maintaining the privacy, confidentiality and security of the personal information entrusted to us. We believe that responsible data handling is an essential part of delivering professional virtual assistant and business support services.

By combining compliance with the Kenya Data Protection Act, 2019, internationally recognised privacy principles and industry best practices, we aim to provide clients with confidence that their information is managed lawfully, transparently and securely.