Privacy Policy & GDPR Compliance Statement

1 Data Controller & Overview

Circle Innovation Hub Ltd ("Circle Innovation", "we", "us", or "our") operates as a Nairobi-based climate innovation catalyst, building ecosystems, venture programmes, and research platforms across East Africa.

For the purposes of the General Data Protection Regulation (EU Regulation 2016/679 - "GDPR") and applicable regional data privacy frameworks (including Kenya's Data Protection Act 2019), Circle Innovation acts as the Data Controller responsible for determining the purposes and means of processing personal data collected through our website (circleinnovation.co), programme application portals, and ecosystem events.

2 Lawful Bases for Processing Data

Under Article 6 of the GDPR, we process personal data strictly when one or more of the following legal bases apply:

• Consent (Art. 6(1)(a)): You have given clear, specific consent for us to process your personal data for specific purposes (such as newsletter subscriptions, non-essential cookies, or event registrations).
• Contractual Performance (Art. 6(1)(b)): Processing is necessary for executing or entering into an agreement with you (e.g., participation in venture acceleration programmes, grant disbursements, or partnership agreements).
• Legitimate Interests (Art. 6(1)(f)): Processing is necessary for our legitimate interest in building climate tech innovation infrastructure, conducting ecosystem research, ensuring platform cybersecurity, and communicating with ecosystem stakeholders, provided these interests do not override your fundamental rights.
• Legal Obligation (Art. 6(1)(c)): Processing is necessary to comply with statutory accounting, anti-money laundering, or regulatory compliance requirements in Kenya and international operational jurisdictions.

3 Information We Collect

Depending on how you interact with Circle Innovation, we may collect and process the following categories of personal data:

A. Data Provided Directly by You

• Contact Information: Full name, professional email address, telephone number, job title, and organization name submitted via contact forms or newsletter signups.
• Programme Application Data: Founder background details, pitch deck submissions, funding history, team compositions, and sector focus submitted through our venture application forms.
• Inquiries & Correspondence: Text content and attached documentation provided when reaching out for partnership opportunities or research requests.

B. Data Collected Automatically

• Technical & Device Data: IP address, browser type and version, operating system, time zone setting, and device hardware identifiers.
• Usage & Telemetry Data: Pages visited, time spent on pages, click paths, referrer URLs, and interaction patterns across our research and case study publications.

4 How We Use Your Personal Data

We utilize personal data solely for defined organizational purposes:

• To deliver, maintain, and optimize our climate venture building programmes, incubators, and research publications.
• To assess and process founder applications for cohort onboarding and investor match-making.
• To distribute our newsletter, climate insights, and ecosystem reports (where explicit opt-in consent is provided).
• To analyze platform traffic and user engagement to continuously improve site navigation and accessibility.
• To enforce security controls and defend against fraudulent or unauthorized interactions.

5 Cookies & Tracking Technologies

Cookies are small text files placed on your device to store data readable by web servers. Circle Innovation uses cookies and similar technologies for session management, security, and performance analytics.

You can control your cookie preferences at any time using our on-site manager accessible via the Cookie Preferences link in the footer.

• Strictly Necessary Cookies: Essential for standard page navigation and form submissions. These cannot be disabled.
• Analytical / Performance Cookies: Collect anonymous data regarding page views and user paths to help us improve site utility. Enabled only upon opt-in consent.
• Functional Cookies: Store choices such as language or regional preferences across climate programmes. Enabled only upon opt-in consent.

6 Third-Party Data Sharing & Processors

We do not sell, rent, or trade your personal information to third parties. We share data only with trusted service providers bound by strict Data Processing Agreements (DPAs) under GDPR Article 28:

• Cloud Infrastructure & Hosting Providers: Secure hosting and data storage vendors operating encrypted facilities.
• Analytics & Communications Tools: Anonymized analytical processing and newsletter transmission platforms.
• Programme Partners & Co-sponsors: Shared application reviews conducted jointly with ecosystem partner institutions (with explicit applicant notice).
• Legal & Regulatory Authorities: Where compelled by law, court order, or enforceable governmental demand.

7 International Data Transfers

As an organization headquartered in Nairobi, Kenya, serving East Africa and collaborating with European and global partners, your data may be transferred to and processed in countries outside the European Economic Area (EEA).

Whenever international data transfers occur, we ensure robust safeguards are implemented in accordance with GDPR Chapter V, including:

• Executing EU Standard Contractual Clauses (SCCs) approved by the European Commission.
• Verifying third-party processor certifications and technical encryption standards (TLS 1.3 in transit, AES-256 at rest).
• Adhering to local statutory data protection requirements under the Kenyan Data Protection Act 2019.

8 Your Data Subject Rights Under GDPR

Under GDPR Chapter III, you possess comprehensive rights regarding your personal data:

To exercise any of these rights, please submit a written request to privacy@circleinnovation.co. We respond to all requests within 30 calendar days without fee.

9 Data Security & Retention Periods

We employ organizational, technical, and physical security measures designed to prevent unauthorized access, accidental loss, alteration, or disclosure of personal data.

• Technical Safeguards: Encrypted communications (HTTPS / TLS 1.3), hashed passwords, role-based access control (RBAC), and automated threat monitoring.
• Organizational Controls: Confidentiality agreements for team members, annual privacy training, and periodic vulnerability assessments.
• Retention Schedule: General inquiries are retained for up to 2 years following last contact. Programme application records are retained for 5 years for reporting and impact verification before secure anonymization or purge.

10 Contact & Supervisory Authority Complaints

If you have questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our Data Protection Lead:

You also have the right to lodge a complaint with an EU Supervisory Authority (in the EU Member State of your habitual residence) or Kenya's Office of the Data Protection Commissioner (ODPC) if you believe our processing infringes statutory data protection regulations.