Ephesus Investments and Assets Ltd – home
Contact

Privacy notice

Last updated October 2026. This notice explains how Ephesus Investments and Assets Ltd (“Ephesus”, “we”) collects and uses personal data through this website and in the course of its business, under the Kenya Data Protection Act 2019 and, where it applies to you, the EU and UK General Data Protection Regulation.

Who we are

Ephesus Investments and Assets Ltd, 49 Runda Ridge, Runda, Nairobi, Kenya, is the data controller. Contact: info@ephesusinvestments.biz. Compliance contact: compliance@ephesusinvestments.biz.

What we collect and why

  • Enquiry and project forms. Name, email, organisation, role and the content of your message. Lawful basis: steps at your request before a contract, and our legitimate interest in responding to enquiries. Retained for 24 months after our last contact, or for the life of an engagement plus seven years where an engagement follows.
  • Information-pack and newsletter requests. Name, institution and email, with your consent. You can withdraw consent at any time by emailing info@ephesusinvestments.biz or using the unsubscribe link.
  • Counterparty due diligence. Where we enter an engagement, identity, beneficial-ownership, PEP and sanctions-screening information under our AML, KYC and sanctions policy. Lawful basis: legal obligation and legitimate interest. Retained for seven years after the relationship ends.
  • Website analytics and cookies. This site is hosted on WordPress.com (Automattic Inc.), which sets cookies for site operation and collects aggregate statistics through Jetpack. See our cookie notice.

Sharing and international transfers

We share personal data only with service providers that process it on our behalf (website hosting by Automattic Inc. in the United States; email by Google Workspace), with professional advisers under confidentiality, and where the law requires. Transfers outside Kenya, the EU or the UK rely on the provider’s standard contractual clauses or equivalent safeguards. We do not sell personal data.

Your rights

You may ask to access, correct, delete or restrict the personal data we hold about you, object to processing based on legitimate interest, withdraw consent, and ask for a copy in a portable format. Write to info@ephesusinvestments.biz; we respond within 30 days. You may complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke) or, if you are in the EU or UK, to your supervisory authority.

Security and changes

Data is held on access-controlled systems with encryption in transit. We update this notice when our practices change and show the date at the top.

Kenyan counsel is confirming whether Ephesus must register with the ODPC as a data controller; this notice will be updated accordingly.