Privacy Notice

The data controller is X2A Cyber Solutions Ltd., a company registered in Kenya (registration number PVT-MKUL52V). Our registered office is in Nairobi, Kenya.

Data protection enquiries: dpo@x2-a.com.

We collect only what you send us. If you complete the enquiry form, we receive your name, organisation, role, email address and the content of your message. We do not ask for a phone number and we do not buy contact data.

Your browser preference for cookies is stored on your own device so that we do not ask you again. That preference is not transmitted to us as an identifier.

Enquiry details are used to respond to you and to conduct any resulting engagement discussion. The lawful basis is your consent when you submit the form, and our legitimate interest in responding to a business enquiry. Where a contract follows, processing is necessary for that contract.

We do not use enquiry data for automated decision-making or profiling.

This site does not run third-party advertising or analytics scripts, and it does not set advertising cookies. If we introduce measurement in future, this notice will be updated before that processing begins and your cookie preferences will govern it.

You can review or change your preference at any time through “Cookie preferences” in the footer.

Enquiry submissions are stored on infrastructure operated by our hosting and database providers acting as processors under contract, and are visible to X2A personnel who need them to respond. We do not sell personal data or disclose it for marketing purposes.

Where data is processed outside Kenya, we rely on the safeguards required by the Kenya Data Protection Act and, for transfers involving the European Economic Area, the transfer mechanisms permitted under the GDPR.

When you take the assessment we collect your name, work email, organisation, sector, your answers and the result worked out from them. We use them to produce your report and keep it in your account; that processing is necessary to provide the service you asked for. Your individual answers are seen only by you and X2A's assessment team.

If you tick the optional follow-up box, an X2A account manager may contact you about your result and our services. Only your contact details and result summary are held in our sales system for that purpose, never your individual answers. You can withdraw this agreement at any time without losing your report.

We may combine results across organisations to understand common gaps, after removing anything that identifies you or your organisation.

Enquiries are retained for up to 24 months from our last correspondence with you, unless an engagement follows, in which case records are retained for the period required by contract and applicable law. Records are deleted or anonymised at the end of that period.

Assessment answers and reports are deleted 12 months after completion. Follow-up records in our sales system are kept for 12 months from our last contact, and removed within 30 days if you withdraw your agreement. Inactive accounts are deleted after 24 months, with notice first.

You may request access to the personal data we hold about you, ask us to correct or delete it, object to or restrict our processing, withdraw consent, and request a copy in a portable form. Withdrawing consent does not affect the lawfulness of processing already carried out.

Write to dpo@x2-a.com. We respond within the statutory period. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner in Kenya or, where the GDPR applies, to your national supervisory authority.

We update this notice when our processing changes. Material changes are reflected here and, where required, notified to you directly.