01 Who We Are
This portfolio website is operated by Nazline Mwita , Co-Founder & Cybersecurity Assurance Lead at HarLyn Digital Partners, based in Nairobi, Kenya. The portfolio is hosted at nazlinemwita.co.ke.
You can contact Nazline directly via email at contact@nazlinemwita.co.ke or nazline@harlyndigitalpartners.com, via HarLyn at info@harlyndigitalpartners.co.ke, or by WhatsApp/phone at +254 792 185 625 (office WhatsApp 0184328180).
Under Kenya's Data Protection Act (KDPA) 2019, Nazline Mwita is the data controller for personal data collected through this personal portfolio. A data controller is the person or organisation that decides why and how personal data is collected and used.
02 What We Collect
We collect only the specific items verified in this site's codebase:
-
Consulting Intake Form (
#secure-uplink-form): When you request a security scoping call or assessment, the form asks for:- Your Name
- Your Company or Organisation
- Your Business Email
- Service Interest (e.g. Workflow Assessment, Web/API Security Review, Secure Automation)
- Project Context & Objectives (brief description of systems, bottlenecks, or timeline)
- Scope & Rules of Engagement consent acknowledgment
- AI Copilot (Chatbot): Queries and technical questions you type into the on-site AI Copilot during your active session.
- Direct Communications: Any messages or project briefs you choose to send via direct email, WhatsApp, or LinkedIn.
- Standard Web Server Requests: Basic HTTP request data (IP address, browser user-agent, requested page URL) handled automatically by our cloud edge provider (Vercel) to serve secure HTTPS pages.
03 Why We Collect It
We collect data strictly for transparent, operational purposes tied directly to each item:
- Intake Form Submissions: To review your security assessment requirements, verify testing authorization, and schedule a technical discovery call.
- AI Copilot Queries: To provide instant conversational answers regarding Nazline's cybersecurity methodology, certifications, and research notes.
- Direct Inquiries: To respond to your questions and scope technical consulting engagements.
- Edge Request Logs: To deliver website assets securely over HTTPS and protect our serverless functions against automated denial-of-service attempts.
04 What We Do NOT Do With Your Data
We make these explicit commitments:
- We do not sell personal data: We do not sell, rent, trade, or monetize your personal information to data brokers or advertising networks.
- No unsolicited marketing: We do not add your email to promotional newsletters or spam lists.
- Strictly verified subprocessors: We share your data only with the specific technical service providers verified in our code, strictly to operate this site:
- Web3Forms API: Processes and routes intake form submissions securely to Nazline's consulting inbox.
- Vercel Inc.: Cloud edge hosting and serverless compute infrastructure (
/api/chat.js). - NVIDIA NIM API: Real-time inference for the AI Copilot. Conversations are processed ephemerally and are not saved in a persistent database.
05 How We Protect It
As a cybersecurity assurance lead, defensive engineering and permission boundaries govern every process:
- Encrypted Connections: All web traffic, form submissions, and API dispatches enforce HTTPS with TLS 1.3 encryption.
- Permission Before Testing Mandate: No security assessment or penetration test is ever conducted without signed written authorization, clear scope, and agreed Rules of Engagement (RoE).
- Ephemeral Chat Memory: The AI Copilot operates in client memory and does not record conversation histories to browser storage or persistent databases.
- Credential Vaulting: API keys and access tokens are secured in server environment variables with least-privilege boundaries.
While we enforce strict defense-in-depth security measures aligned with industry standards, no internet-connected platform can guarantee 100% impenetrable immunity against all threats.
06 How Long We Keep It
We keep personal data only for as long as necessary:
- Consulting Intake Messages: Retained only while scoping discussions and follow-up communications are active, and deleted upon request. (Fixed retention period: founder to confirm).
- AI Copilot Interactions: Discarded immediately after inference completes; not stored in a persistent database.
07 Your Rights Under KDPA 2019
Under Part IV of Kenya's Data Protection Act (KDPA 2019), you are a data subject with specific enforceable rights:
- Right to access: Ask what personal data we hold about you and receive a copy.
- Right to correction: Request correction of inaccurate, outdated, or incomplete personal data.
- Right to erasure: Request deletion of your personal information where no lawful basis exists to retain it.
- Right to object: Object to the processing of your personal data.
- Right to complain: Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Nairobi, Kenya (odpc.go.ke).
To exercise any of your statutory rights, email contact@nazlinemwita.co.ke or info@harlyndigitalpartners.co.ke with the subject “Data Subject Rights Request”.
08 Cookies & Tracking
This website uses zero advertising cookies, zero marketing trackers, zero Meta Pixel, and zero behavioral analytics scripts.
Only strictly necessary edge HTTP headers and session routing provided by our hosting platform (Vercel) to deliver web pages securely are utilized.
09 Client Project Data is Separate
This website policy applies specifically to this public portfolio.
When a client commissions an authorized vulnerability assessment, penetration test, DPIA compliance review, or 48-Hour Assessment Sprint through HarLyn Digital Partners, all technical findings, system architecture diagrams, vulnerability proof-of-concepts, and client proprietary data are governed by that engagement's formal Non-Disclosure Agreement (NDA), Master Services Agreement (MSA), and Rules of Engagement (RoE), not just by this public website policy.
10 Children
This portfolio and our cybersecurity services are designed for enterprise IT teams, engineering leaders, and adult professionals. We do not knowingly collect personal data from anyone under 18.
11 Changes & Effective Date
We may update this policy periodically to reflect operational, legal, or technical changes. The current version will always be published directly on this page at https://www.nazlinemwita.co.ke/privacy-policy.
12 Link to Company Policy
For HarLyn Digital Partners' shared company services, 48-Hour Assessment Sprints, and joint infrastructure, see the company's Privacy Policy at: