Our approach. We collect and use personal information for legitimate business, advisory, security, compliance and relationship-management purposes. We do not sell personal information.
1. Scope
This Privacy Policy applies to the 0to1 Advisory public website, digital assessments, mandate forms, protected client and adviser workspaces, communications and other digital services that link to this Policy. It also applies to personal information we receive in connection with prospective mandates and business relationships unless a more specific privacy notice applies.
2. Who is responsible for your information
0to1 Advisory is registered in Delaware, United States and operates across multiple markets, with a focus on African transactions, enterprise development and institutional work. Depending on the service, 0to1 Advisory and an applicable affiliated or operating entity may act as controller, business, service provider or processor under the law that applies to the relevant processing.
Questions and privacy requests may be sent to ta@0to1advisory.com.
3. Categories of personal information we may collect
| Category | Examples |
|---|---|
| Identity and contact | Name, business email, telephone, address, country, professional title and organisation. |
| Business and professional | Employer, role, board or shareholder status, mandate responsibilities, professional biography and relationship information. |
| Mandate and transaction | Organisation name, city, role, telephone, email, selected advisory work, Discovery type, signed mandate, invoice reference and engagement records. |
| Electronic-signature and audit | Typed signature, drawn signature image, timestamp, email address, browser/device information, IP/network metadata, jurisdiction metadata and cryptographic record hash. |
| Financial and payment | Invoice details, Stripe Checkout or Buy Button references, payment status, amount, payment sequence and reconciliation records. Full payment-card or bank credentials are processed by Stripe rather than 0to1 Advisory. |
| Compliance | Identity verification, beneficial ownership, authority, conflicts, sanctions, anti-money-laundering, source-of-funds and other due-diligence information where relevant. |
| Saved client profile and security | Limited mandate details saved for returning clients, one-time verification-code records, account identifiers, access permissions, authentication events and security logs. |
| Communications | Emails, enquiries, meeting records, instructions, feedback and other communications with us. |
| Technical | IP address, browser, device, operating system, referring information, timestamps, error and security logs and similar operational information. |
4. How we collect information
We collect information directly from you, from authorised representatives of your organisation, through signed mandates and protected workspaces, from documents and communications you provide, from payment and technology providers, from professional advisers and counterparties, and from lawful public or professional sources where relevant to a legitimate mandate or compliance purpose.
5. Purposes for which we use personal information
- Respond to enquiries and assess potential mandates.
- Create, authenticate and administer Client Mandates and other agreements.
- Provide strategic, transaction, capital, enterprise and institutional advisory services.
- Create and manage client and adviser accounts, permissions and workspaces.
- Communicate instructions, deliverables, meeting arrangements and engagement updates.
- Process invoices, payment references and account reconciliation.
- Perform client verification, sanctions, conflicts and other compliance checks.
- Detect fraud, misuse, cyber threats and unauthorised access.
- Maintain records, audit trails, quality controls and business continuity.
- Improve the Site, digital tools and service delivery.
- Manage professional relationships and relevant business development communications.
- Establish, exercise or defend legal rights and comply with applicable law.
6. Legal bases
The legal basis depends on the jurisdiction and context. Where applicable, processing may be based on performance of or steps toward a contract, compliance with legal obligations, legitimate interests, consent, protection of legal rights, or another basis permitted by applicable law. Where consent is required, you may withdraw it prospectively, subject to lawful retention or processing that does not depend on consent.
7. Public diagnostics and assessments
Where a public diagnostic is designed to operate in your browser, responses are processed locally unless you separately submit information to us. A downloaded report may therefore remain on your device without being automatically transmitted to 0to1 Advisory.
8. Electronic mandate and saved-profile records
When you sign a mandate electronically, we create a record containing the agreement version, mandate type, organisation, city, role, contact details, selected advisory work, full legal name used for signature, drawn signature, execution timestamp, browser or device information and a cryptographic record hash. We also save a limited returning-client profile so the same contact details can be reused on a later mandate. Saved profile details are released only after a one-time code is sent to and verified through the email address previously used.
9. Discovery Grant applications
If you apply for the Discovery Grant, we process the organisation name, applicant contact details, approximate annual revenue, current team size, reason for support and the resulting grant reference and decision. Clear small-business cases may be decided automatically using the published website rules implemented on the server. Cases that meet only one size measure are sent for a partner review. Applicants may request a Grant Appeal by email.
10. Sharing and recipients
We may disclose personal information where reasonably necessary to 0to1 Advisory personnel and applicable affiliated entities, authorised members of the client team, professional advisers and transaction specialists supporting a mandate, technology and payment providers acting on our instructions, transaction participants where authorised and relevant, regulators or public authorities where lawfully required, and successors in a legitimate corporate transaction subject to appropriate safeguards.
We do not sell personal information for money. We do not use the public Site for 0to1 Advisory behavioural advertising at the effective date of this Policy.
11. International transfers
0to1 Advisory works across jurisdictions. Personal information may therefore be processed in the United States, Kenya or other countries where clients, counterparties, advisers or service providers are located. Where cross-border transfer restrictions apply, we use legally recognised safeguards appropriate to the jurisdiction, which may include contractual protections, transfer assessments, adequacy mechanisms, consent where valid, or other permitted transfer grounds.
12. Data security
We use administrative, technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, destruction or loss. Measures may include access controls, role-based permissions, audit logging, secure hosting, encryption where appropriate, vendor controls, backups and incident response. No online environment is completely risk-free, and users also remain responsible for protecting credentials and devices.
13. Retention
We retain personal information only for as long as reasonably required for the purpose for which it was collected and for applicable contractual, tax, accounting, audit, compliance, limitation, dispute and security periods. Mandate and transaction records may be retained for longer periods where reasonably required to document legal rights, professional work or transaction history. When information is no longer required, we take reasonable steps to delete, anonymise or securely restrict it.
14. Your choices and rights
Your rights depend on where you are located and the law that applies. Subject to applicable exceptions, rights may include being informed about how personal information is used, requesting access, correction or deletion, objecting to or restricting certain processing, withdrawing consent where consent is the legal basis, requesting portability where applicable, appealing or complaining to an appropriate privacy authority, and exercising rights concerning certain automated decisions where applicable.
Kenyan data subjects may have rights under the Data Protection Act, including rights to be informed, access, object, correct and request deletion of false or misleading data. US state residents may have additional rights if a state privacy law applies to the particular processing. UK, EEA and other jurisdictions may provide additional rights under their local laws.
15. California and other US state privacy laws
If a US state privacy law applies to 0to1 Advisory and to the relevant processing, residents of that state may have rights such as access, correction, deletion, portability, opt-out rights for certain sales, sharing, targeted advertising or profiling, and non-discrimination for exercising privacy rights. We do not currently sell personal information or use the public Site for 0to1 Advisory cross-context behavioural advertising. Applicability of a particular state law depends on its statutory thresholds and exemptions.
16. Children
The 0to1 Advisory public Site and professional services are not directed to children. We do not knowingly seek personal information from children through the public advisory Site. If a specific programme involves minors, separate programme-specific safeguards and notices will apply.
17. Cookies and similar technologies
Current browser and cookie practices are described in our Cookie Policy. The public Site does not currently use 0to1 Advisory advertising or behavioural tracking cookies. Essential security, hosting or authenticated workspace functions may use cookies or similar technologies where needed.
18. Third-party services
Payments are processed by Stripe. Stripe receives the information required to operate Checkout or its Buy Button, which may include the invoice reference, email, billing details and payment information. Stripe processes payment credentials under its own privacy terms. Other third-party platforms or websites linked from the Site also operate under their own terms and privacy practices.
19. Automated processing and AI
We may use software and AI-enabled tools to support document organisation, research, analysis, drafting, workflow management, quality control, security or other professional tasks. We remain responsible for applying appropriate human review to our work. We do not use solely automated processing to make a legally significant decision about an individual unless permitted by applicable law and subject to required safeguards.
20. Business communications
We may send communications relating to an enquiry, mandate, account, service or professional relationship. Where marketing consent or an opt-out is required, we will provide the appropriate mechanism. Service, security, legal and engagement communications are not marketing and may continue where necessary.
21. Changes to this Policy
We may update this Policy when our services, technology, legal obligations or business structure change. The current version will be published with its effective date. Material changes may also be communicated through an authenticated workspace or other appropriate channel.
22. Contact and complaints
Privacy requests should be sent to ta@0to1advisory.com. We may need to verify identity and authority before acting on a request.
0to1 Advisory
Registered in Delaware, United States
P.O. Box 77287-00611, Nairobi, Kenya
Email: ta@0to1advisory.com
If Kenyan data-protection law applies, you may also have the right to contact the Office of the Data Protection Commissioner. Other jurisdictions may provide a right to complain to the relevant privacy regulator.