Last updated: 10 August 2026

Zircon Consultants ("we", "us" or "our") respects your privacy. This policy explains what personal data we collect through the Zircon Courses learning platform at courses.zirconconsultants.org (the "Platform"), why we collect it, who we share it with, and the rights you have over it.

We are a Kenyan company, so we process personal data in line with the Data Protection Act, Cap. 411C of the Laws of Kenya. Where learners reach us from the European Economic Area or the United Kingdom, we also apply the principles of the EU General Data Protection Regulation (GDPR).

This policy covers the Platform specifically. For our main website at zirconconsultants.org, see that site's own Privacy Policy.

Who We Are

For the purposes of the Data Protection Act and the GDPR, the data controller is:

• Zircon Consultants
• The Watermark Business Park, Spring Court, Ndege Road, Karen, Nairobi, Kenya
• Email: zircon@zirconconsultants.org

Information We Collect

Account information

To take a course, you need an account. When you register directly on the Platform, we collect your first name, last name, username, email address, and password (stored in encrypted form, never in plain text).

Signing in with Google

If you choose "Continue with Google" instead of registering directly, we receive your name, email address, and profile photo from your Google account to create or log you into your Zircon Courses account. We do not receive or store your Google password, and we do not post anything to your Google account on your behalf.

Course activity

Once you are enrolled, we record which courses you access, your lesson and quiz progress, quiz results, any certificates you earn, and any comments, reviews, or questions you post within a course.

Order information

All courses on the Platform are currently offered free of charge, so no payment details are collected at checkout. If we introduce paid courses, this policy will be updated before checkout goes live to describe what payment data we and our payment processor collect.

Other information you give us

If you contact us through a form on the Platform, we collect the details you provide, such as your name, email address, and message.

Information collected automatically

Our server automatically records standard technical information for every visit, such as your IP address, browser type, and the pages you request, which we use to operate and secure the Platform. See our Cookie Policy for the cookies involved. We do not currently run analytics or advertising trackers on the Platform.

How We Use Your Information

We use personal data to:

• create and manage your account, and let you sign in, including via Google;
• enrol you in courses, track your progress, and issue certificates;
• display your name and, where you provide one, your photo alongside comments, reviews, and questions you post in a course;
• send you course-related email, such as enrolment confirmations, progress updates, and password resets;
• operate, secure, and improve the Platform, including detecting and preventing abuse; and
• comply with legal obligations that apply to us.

We do not sell personal data, and we do not use it for automated decision-making that produces legal effects about you.

Lawful Bases for Processing

Section 30 of the Data Protection Act, and Article 6 of the GDPR where it applies, require a lawful basis for every use of personal data. Ours are:

• Performance of a contract: creating your account and providing the course you enrolled in is how we deliver the service you signed up for.
• Consent: for signing in via Google, and for any optional marketing email you subscribe to. You can withdraw consent at any time by unlinking your Google account in your dashboard or unsubscribing from email.
• Legitimate interests: keeping the Platform secure, preventing spam and abuse, and maintaining accurate learner records.
• Legal obligation: where we must keep records to comply with Kenyan law.

Who We Share Your Information With

We share personal data only with service providers who process it on our instructions, or with third parties you choose to interact with:

• Google: if you sign in with "Continue with Google," Google processes the authentication on our behalf via the Nextend Social Login service, in accordance with Google's own privacy policy.
• Brevo (Sendinblue GmbH, Germany): delivers transactional email from the Platform, such as registration confirmations and password resets.
• Our hosting provider: stores the Platform and processes server logs.

We may also disclose personal data where the law requires it, for example in response to a valid request from a court or public authority, or to protect our rights, our learners, or the public.

International Transfers

Some of our service providers process data outside Kenya, for example Google and Brevo. Section 48 of the Data Protection Act allows transfers outside Kenya where there are adequate data protection safeguards. Our providers are subject to the GDPR or to equivalent data protection commitments, which we consider an adequate safeguard for these transfers.

How Long We Keep Your Information

We keep personal data only as long as we need it for the purposes described above:

• Account and course activity data is kept for as long as your account is active, so you retain access to your course history and certificates.
• If you delete your account, we remove your personal data within a reasonable period, except where we must keep limited records, such as certificate issuance, to comply with the law or to verify a certificate's authenticity on request.
• Technical server logs are kept for a short period for security purposes.

Your Rights

Under Kenya's Data Protection Act

Section 26 of the Data Protection Act gives you the right to:

• be informed of the use to which your personal data is put;
• access your personal data in our custody;
• object to the processing of all or part of your personal data;
• correction of false or misleading data; and
• deletion of false or misleading data about you.

You can access and update most of your account information directly from your Platform dashboard at any time.

Under the GDPR

If you are in the European Economic Area or the United Kingdom, you additionally have the right to erasure, to restriction of processing, to data portability, and to lodge a complaint with your local supervisory authority.

Exercising your rights and complaints

To exercise any of these rights, email us at zircon@zirconconsultants.org. We will respond within a reasonable time and at no cost to you.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the authority established under the Data Protection Act to enforce data protection in Kenya.

How We Protect Your Information

We use appropriate technical and organizational measures to protect personal data, including encrypted (HTTPS) connections across the Platform, encrypted password storage, login-attempt limiting to deter brute-force attacks, and access to learner data restricted to the people who need it to run the Platform. No method of transmission or storage is completely secure, but we work to protect your data against loss, misuse, and unauthorized access.

Children's Privacy

The Platform is intended for users who are at least 13 years old. If you are a minor in the jurisdiction where you reside, you may only use the Platform with the consent of a parent or legal guardian, consistent with section 33 of the Data Protection Act. We do not knowingly collect personal data from a child without the required consent. If you believe a child has provided us with personal data without that consent, contact us and we will delete it.

Links to Other Websites

Course content may link to third-party sites and resources. We are not responsible for their content or privacy practices, and we encourage you to read the privacy policy of every site you visit.

Changes to This Policy

We may update this policy from time to time, for example when the law or our practices change. The current version is always published on this page, with the "Last updated" date at the top. Significant changes will be highlighted on the Platform.

Contact Us

Questions about this policy or about how we handle your personal data can be sent to zircon@zirconconsultants.org or posted to Zircon Consultants, The Watermark Business Park, Spring Court, Ndege Road, Karen, Nairobi, Kenya.