Privacy Notice

Aptila Holding Limited (“Aptila Holding”, “we”, “us”) is the parent company of the Aptila Group. It is incorporated in Kenya and based in Nairobi. For the personal data described in this notice, Aptila Holding is the data controller under Kenya’s Data Protection Act, 2019 (“the Act”).

For anything about this notice or your data, email info@aptilagroup.com with “Data protection” in the subject line, or call +254 141 948 883.

This notice covers personal data we collect:

• through this website, www.aptilagroup.com;
• when you contact us by email or phone; and
• when you apply for a role through the Aptila platform, app.aptilagroup.com.

Each Group company — Aptila Capital, Boocom Mining, Afristok, Aptila Logistics, Aptila Heritage — runs its own website, which has its own privacy notice.

When you use the contact form: your name, email address, the topic you choose and your message, together with a record of your consent — the wording you agreed to, its version and the time.

When you email or call us: your contact details and whatever you choose to tell us.

When you apply for a role: the details you use to create your account on the Aptila platform, your answers to the application questions, your CV and the supporting documents you upload, and our notes from reviewing your application and from any interview.

When you visit the website: our hosting provider records basic technical information — such as your IP address, browser type and the pages requested — to keep the site secure and running. This website does not use cookies for analytics or advertising.

We do not ask for sensitive personal data on this website. Please don’t include it in a message. If a role requires it, we will tell you why and ask separately.

• To reply to your enquiry — on the basis of your consent, given when you tick the box on the contact form.
• To consider your job application — because you have asked us to, as a step towards a possible contract of employment, and in our legitimate interest in recruiting the right people.
• To keep the website and platform secure — in our legitimate interest in protecting our systems and the people who use them.
• To meet our legal obligations — for example, where a law or a lawful request from an authority requires it.

We do not sell personal data. We do not use it for marketing without your separate consent, and we do not make decisions about you by automated means alone.

• Within the Group. If your enquiry or application concerns a particular Group company, we may share it with that company so it can respond or consider you.
• Service providers. Companies that provide services to us — website hosting, email, the infrastructure the Aptila platform runs on, and email delivery for the contact form (Resend, Inc.). They may use the data only on our instructions and only to provide those services.
• Authorities. Where the law requires us to, or to establish, exercise or defend legal claims.

Some of our service providers hold data outside Kenya — for example, Resend, which delivers contact-form messages to us, holds account data in the United States. We transfer personal data outside Kenya only as the Act permits, with appropriate safeguards in place, and you can ask us for details of those safeguards.

• Enquiries: up to two years after our last correspondence with you, then deleted.
• Job applications that don’t lead to a role: up to twelve months after the decision, so we can consider you for other roles — sooner if you ask us to delete them. If you join the Group, your application becomes part of your employment record.
• Technical logs: for the short period our hosting provider keeps them for security.

We keep data longer only where the law requires us to.

Access to personal data is limited to the people in the Group who need it for the purposes above, and we work only with service providers who apply security measures appropriate to the data they handle. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Commissioner as the Act requires.

Under the Act, you have the right to:

• be told how your personal data is used, as this notice does;
• access the personal data we hold about you;
• have inaccurate or misleading data corrected;
• have data deleted where we no longer have a lawful reason to keep it;
• object to, or ask us to restrict, how we use it;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting what we did before; and
• not be subject to a decision based solely on automated processing.

To exercise any of these, email info@aptilagroup.com with “Data protection request” in the subject line. We may need to confirm your identity first, and we will respond within the time the Act and its regulations require.

If you’re unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), www.odpc.go.ke (opens in a new tab).

[[CONFIRM: Aptila Holding Limited's registration with the ODPC as a data controller (and as a processor, if applicable), with its registration number.]]

We will update this notice when the way we handle personal data changes. The date at the top shows when it last changed; this is version 2026-10-02. If a change affects how we use data you have already given us, we will tell you.

See also our Terms of Use.