1. Scope and site identity
This policy applies to nortixa.guru. No legal company name, registration number, tax identifier or verified street address has been provided for the site. The contact address for privacy enquiries is [email protected]. The site is associated with Nairobi, Kenya at city level.
2. Kenyan data-protection framework
The site is designed with the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 in mind. These rules establish principles and rights concerning personal data processing. Whether a specific statutory obligation applies in a particular situation depends on the role, scale and context of processing; this policy does not claim a legal status or registration that has not been confirmed.
3. Personal data we intentionally collect
The contact form asks for name, email address, subject and message. A consent checkbox records the user’s acknowledgement of this privacy notice at submission. Do not send medical records, identification numbers or other sensitive information through the general website contact form.
4. Health information and sensitive personal data
Kenyan privacy guidance treats health status and several other categories as sensitive personal data requiring additional protection. Nortixa is an educational site and does not ask users to create health profiles or submit symptom histories into a database. If a user voluntarily places health details inside a free-text contact message, that information may be sensitive. Users are encouraged to avoid doing so unless necessary for the website enquiry.
5. Technical data
Hosting and server infrastructure may generate standard logs such as IP address, date/time, requested URL, status code, browser/user-agent information and security events. Such logs may be used for security, reliability, troubleshooting and abuse prevention and may be subject to hosting-provider retention controls.
6. Cookies and local storage
The current site uses essential session functionality for contact-form CSRF protection. The cookie preference component uses localStorage under the key nortixa-consent to remember a choice on the device. See the Cookie Policy for details.
7. Analytics, GTM and advertising technologies
GA4 and Google Tag Manager IDs are currently not configured. The site therefore does not intentionally load those integrations in the present build. Cookiebot and reCAPTCHA are also not configured. If real IDs are supplied later, the privacy and cookie disclosures should be reviewed before activation.
8. Affiliate tracking
The declared business model is affiliate publishing, but no affiliate partner or CTA destination is configured in the current build. No active affiliate tracking links are therefore present. If monetised links are introduced, the categories of tracking data, recipients and retention should be documented before activation.
9. Why data is processed
Contact-form information is used to read and respond to enquiries, maintain correspondence, prevent abuse and manage legitimate website operations. Technical logs may be used to protect the site and diagnose faults. Where consent is the applicable basis for optional technologies, users should be able to decline or withdraw it.
10. Recipients and service providers
Data may be handled by infrastructure providers required to host, secure or deliver the site and its email. No specific provider is named here because none was supplied. Nortixa does not claim that data is sold to advertisers.
11. International transfers
Hosting or email infrastructure can potentially involve systems outside Kenya depending on the provider chosen for deployment. Because no hosting provider has been specified, this policy does not invent a transfer mechanism. The site operator should review the chosen provider and update this section before deployment where required.
12. Retention
Contact messages should be retained only as long as reasonably necessary to handle the enquiry, maintain appropriate business records, resolve disputes, prevent abuse or meet applicable legal obligations. Server-log retention depends on hosting configuration and should be documented by the deployer.
13. Security
The build uses CSRF protection and a honeypot on the contact form, server-side input validation, output escaping and HTTPS-ready canonical URLs. No website can guarantee absolute security. Deployment security, patching, server configuration, backups and mail settings remain operational responsibilities.
14. Your rights
Depending on applicable Kenyan law and the circumstances, individuals may have rights to be informed about processing, access personal data, object to processing, seek correction of inaccurate information, request deletion where appropriate, and withdraw consent where processing is based on consent. Requests can be sent to [email protected].
15. Complaints
Individuals may have the right to raise privacy concerns with Kenya’s Office of the Data Protection Commissioner (ODPC). This site does not embed an external complaint link; users can locate the ODPC through official Kenyan government channels.
16. Children
Nortixa is written for adults. The site does not intentionally solicit personal data from children.
17. Third-party links
The current build contains no commercial outbound affiliate links. If third-party links are added later, their own privacy practices will apply after users leave Nortixa.
18. Changes
This policy should be updated when data flows, integrations, affiliate relationships, hosting arrangements or operator details change.
19. Contact
Privacy enquiries: [email protected].