Tathmini Researchtathminiresearch.com/privacy
EFFECTIVE 2 NOVEMBER 2026

Privacy Policy

This policy explains what personal data Tathmini Research collects through tathminiresearch.com and the Tathmini app waitlist, why, who we share it with, and the rights you have under Kenya's Data Protection Act, 2019. The short version: we collect your email address and, only if you choose to give them, the NSE stocks you hold and what you would pay for the Tathmini app. We never sell it.

1. Who we are

Tathmini Research ("we", "us") publishes independent research on companies listed on the Nairobi Securities Exchange and is developing the Tathmini app. We are the data controller for the personal data described here.

2. What we collect

You give us:

  • Email address, when you join the Tathmini app waitlist.
  • Optional survey answers: which NSE stocks you hold and which price band you would pay for the Tathmini app. You can skip these; joining works the same either way.
  • Messages you send us by email.

Collected automatically:

  • Signup records: which page you joined from, when, whether you have unsubscribed, and a random anonymous ID created by our database provider.
  • Technical data: your IP address, browser and device type, logged by our hosting and security providers to serve pages and block abuse.
  • Usage data, unless you turn analytics off: pages viewed, time on page, the site that referred you, approximate location (city or country), and device and browser type, collected by Google Analytics.

We do not collect your name, phone number, ID number, KRA PIN, CDS account number, broker details, the size of your holdings, or payment details. Please don't send them to us.

Which stocks you hold is optional. We treat it with the care we give sensitive data: it is used only in aggregate, to decide which companies to cover.

3. How we use it, and why

Section 30 of the Act requires a lawful basis for each use. Ours:

PURPOSE
LAWFUL BASIS
Telling you about early access and the launch of the Tathmini app
Your consent, given when you join the waitlist
Sending a welcome email with highlights of our research
Your consent, given when you join the waitlist
Using your optional survey answers, in aggregate, to decide what to build and how to price it
Your consent, given by answering
Measuring traffic to see which reports are read and where readers come from
Our legitimate interest in understanding which research is read; you can opt out at any time
Keeping the site secure and blocking automated signups
Our legitimate interest in a working, abuse-free service
Answering your messages and requests
Legitimate interest; legal obligation for rights requests
Complying with the law and defending legal claims
Legal obligation; legitimate interest

We may publish aggregated, anonymised findings, for example "40% of waitlist members hold Safaricom". No individual can be identified from them, and we will not try to re-identify anyone. We do not use your data for advertising or for automated decisions that affect you, and we do not sell or rent it.

4. Who we share it with

Only with service providers that process data on our behalf and under contract. Each may use it only to provide its service to us:

  • Google (Firebase): anonymous sessions, the subscriber database, and reCAPTCHA bot protection.
  • Google (Analytics): traffic measurement, unless you turn analytics off. We do not link Analytics data to your email address.
  • Resend: sending our emails.
  • GitHub (GitHub Pages): hosting the website.

We may also disclose data to professional advisers bound by confidentiality, to authorities where Kenyan law requires it, or to a successor if Tathmini Research is merged or sold. In a sale, this policy continues to apply and you will be told.

5. Email

Every email we send has an unsubscribe link, and you can also reply asking to be removed. We record delivery status (sent, bounced, complained) to keep the list healthy. We do not track whether you open our emails or which links you click.

6. Transfers outside Kenya

Our providers store and process data outside Kenya, in the European Union and the United States. Under sections 48 to 50 of the Act, we transfer data only where the provider gives appropriate safeguards: contractual data protection terms, encryption in transit and at rest, and access controls. We choose EU regions where a provider offers them. By joining the waitlist you consent to these transfers. On request we will tell you more about the safeguards for a particular provider.

7. Cookies and storage on your device

Analytics cookies (optional). Google Analytics sets the cookies _ga and _ga_* when you visit, to tell visits apart. They last up to 2 years. You can turn them off at any time from the "Cookie settings" link in the footer, which also deletes them, or with Google's Analytics opt-out add-on. We have turned off Google signals and advertising features, so Analytics data is not used for ads.

We do not use advertising cookies. Essential storage. The site also keeps a few items in your browser's local storage, all needed to make it work:

  • your light or dark display preference;
  • an anonymous session ID kept by Firebase, so your survey answers attach to your signup.

Google's reCAPTCHA, which protects our forms from bots, may set its own cookies and collect device and interaction data under Google's Privacy Policy. Clearing your browser's site data removes everything we store.

8. How long we keep it

  • Waitlist members: while you are on the waitlist. When you unsubscribe we delete your waitlist record immediately; if you ask us to delete your data another way, we do so within 30 days. In both cases our email provider keeps only a suppression record of your email so we never email you again by mistake.
  • Survey answers: kept with your waitlist record; any analysis older than 24 months is fully anonymised.
  • Messages to us: up to 2 years after the matter is closed.
  • Technical logs: as set by our providers, usually 90 days or less.
  • Analytics data: 14 months in Google Analytics, then deleted automatically.

9. Your rights

Under the Data Protection Act, 2019, you have the right to:

  • be informed of how your data is used, which is what this policy is for;
  • access the personal data we hold about you;
  • correct data that is false or misleading;
  • delete your data;
  • object to processing, including analytics and all processing for marketing;
  • withdraw consent at any time, without affecting what was done before;
  • data portability: receive your data in a common, machine-readable format.

Email hello@tathminiresearch.com from the address you signed up with, so we can confirm the request is yours. Requests are free. We respond within the time limits of the Data Protection (General) Regulations, 2021, and if we cannot meet a request in full we will explain why.

10. Security and breaches

Data is encrypted in transit and at rest by our providers. Access to the subscriber database is restricted by security rules: visitors can only write their own record and can never read anyone else's. Only named Tathmini Research staff have administrative access. No system is perfectly secure. If a breach creates a real risk of harm, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as section 43 of the Act requires, and tell affected subscribers without undue delay.

11. Children

Our research is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has joined the waitlist, contact us and we will delete the record.

12. Changes

We will update the effective date above when this policy changes. For material changes we will email waitlist members before they take effect. If a change needs fresh consent, we will ask for it.

13. Contact and complaints

Questions or requests: hello@tathminiresearch.com, or write to Tathmini Research, Westlands, Nairobi, Kenya.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You may also complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.