Privacy Policy

1. Introduction and data controller

This Privacy Policy explains how Norvelis ("we", "us") collects, uses and protects personal data belonging to visitors of norvelis.world and people who contact us about our sessions. Norvelis is the data controller for the purposes of the Kenya Data Protection Act, 2019. You can reach us at Moi Avenue 63, Nyahururu 20300, or by email at [email protected].

2. What data we collect

We collect personal data in two ways: information you submit through our contact form (name, email, phone number, and your message), and information collected automatically through cookies once you have given consent, as described in our Cookie Policy.

Data Category	Purpose	Legal Basis
Name, email, phone	Responding to your enquiry	Consent / contract steps
Message content	Understanding and answering your request	Consent
Cookie identifiers	Site functionality, analytics if permitted	Consent (except essential)

3. Data sharing and third parties

We do not sell personal data. We do not share your data with third parties except where required to fulfil the purpose you provided it for, or where required by Kenyan law. No data leaves our own records for marketing purposes without your specific consent.

4. Retention

We keep enquiry data for as long as needed to respond to you and maintain a reasonable record of correspondence, typically no longer than 24 months, after which it is deleted unless a longer period is required by law.

5. Security

We take reasonable technical and organisational measures to protect personal data against loss, misuse, or unauthorised access, consistent with the standards expected under the Data Protection Act.

6. International transfers

We do not routinely transfer personal data outside Kenya. If this were ever to change, we would only do so in compliance with the cross-border transfer requirements of the Data Protection Act.

7. Your rights

Under the Data Protection Act, 2019, and subject to oversight by the Office of the Data Protection Commissioner (ODPC), you have the right to access, correct, or delete your personal data, to object to certain processing, and to lodge a complaint with the ODPC. To exercise any of these rights, contact us via the Contact page.

8. Opt-out and data deletion

Providing your data through our contact form is entirely optional; without it, we simply cannot respond to your enquiry. You can disable non-essential cookies at any time through the Cookie Settings link in our footer. To request deletion of any data we hold about you, please get in touch via the Contact page.