Privacy Policy & Data Protection

RewardTech Solutions, registered in Nairobi, Kenya, acts as the primary Data Controller for client information, survey participant records, and benchmarking analytics collected across its digital properties.

We adhere to the mandates of Kenya's Data Protection Act 2019 and international best practices under the General Data Protection Regulation (GDPR) for cross-border African and international engagements.

We process only explicit data necessary to discharge professional obligations:

• Conference & Summit Delegates: Name, professional title, corporate email, telephone, organisation, sector, package selection, and invoice settlement records.
• Awards Submissions: Organization metrics, employee headcount, total rewards policy summaries, and executive endorser coordinates.
• Guidebook & Research Downloads: Contact information, sector classification, and business interest opt-ins.
• Salary Benchmarking Inputs: Anonymized job grades, base pay figures, allowance structures, and incentive targets provided by authorized HR survey participants.

Under no circumstances is identifiable employee compensation data exposed to other survey participants or third parties. All salary figures are ingested into isolated processing vaults where:

• All natural identifiers (names, national IDs, employee payroll codes) are stripped prior to ingestion.
• A minimum threshold of five (5) distinct participating corporate employers is mandated before any statistical percentile (P10, P25, Median, P75, P90) is generated.
• No single enterprise may represent more than 25% of any job benchmark cohort.

Our production infrastructure utilizes enterprise-grade resilience safeguards:

• Storage & Encryption: Hosted on PostgreSQL 18 with encrypted NVMe storage at rest and TLS 1.3 encryption in transit.
• Access Controls: Role-based access control (RBAC) strictly limits database visibility to authorized consultants. Session tokens utilize cryptographically secure HTTP-only cookies.
• Audit Logging: Administrative queries and financial exports are recorded with immutable timestamps and operator identifiers.
• Bot Mitigation & Abuse Prevention: We use Cloudflare Turnstile to protect public intake forms from automated bot attacks and fraudulent submissions. Turnstile evaluates visitor interaction headers and browser telemetry without harvesting biometric identifiers or cross-site browsing history. As a condition of enabling invisible mode verification, processing is governed by the Cloudflare Turnstile Privacy Addendum (opens in a new tab).

We do not sell, rent, or monetize delegate or client data to data brokers or advertising networks. Disclosures occur solely under the following conditions:

• Banking & Settlement: CRDB Bank Plc processes corporate wire instructions and invoice settlements.
• Summit Venue Operations: Golden Tulip Hotel Airport Zanzibar receives delegate names solely for conference badge generation and security access protocols.
• Bot Protection & Security Services: Cloudflare, Inc. verifies form submissions and safeguards digital infrastructure under the Cloudflare Turnstile Privacy Addendum (opens in a new tab).
• Statutory Mandates: Where compelled by valid court subpoena or regulatory requirement from the Tanzania Revenue Authority or Ministry of Labour.

Under the Tanzania PDPA 2022, you possess clear rights regarding your information:

• Right of Access: Request confirmation and an export copy of records held concerning your profile.
• Right of Rectification: Update inaccurate professional titles, phone numbers, or organizational affiliations.
• Right of Erasure: Request deletion of contact records upon conclusion of contractual or conference requirements.
• Right to Restrict or Object: Unsubscribe instantly from advisory newsletters via the 1-click preference link in every dispatch.

For compliance inquiries, Subject Access Requests, or grievance escalation, please direct communications to our designated privacy authority: