Privacy Notice

1. Who we are (data controller)

This site is operated by JK & Associates ("JK", "we", "us", "our"), an aviation management consultancy based in Nairobi, Kenya. For the purposes of the Data Protection Act, 2019 (the "Act"), JK is the data controller for the limited personal data described in this notice.

• Registered entity: JK & Associates — incorporation in progress; registration number to follow. Until incorporation completes, JK & Associates is the practice name under which this site is operated, and the obligations in this notice are accepted under that name. This entry will carry the registered name and company number once the certificate issues.
• Office address: 2nd Avenue, Cargo Terminal, JKIA, Nairobi, Kenya
• Email: info@aviationhubkenya.org
• Contact for data matters: info@aviationhubkenya.org. We have not appointed a Data Protection Officer; data-protection queries are handled by JK directly at that address. We keep the need for a designated officer under review as the practice grows.
• ODPC registration: JK is not currently registered as a data controller with the Office of the Data Protection Commissioner. This does not narrow your rights under the Act or our obligations under it, both of which apply regardless, and we keep our registration position under review.

2. How the tools handle your data

Every tool on this site is a client-side tool. They run as code in your browser. Any values you enter are processed on your device and, where you would otherwise lose them on refresh, are saved to your browser's local storage (see section 5). This applies without exception to all of them:

• Venture tools: Venture Control Room, KCAA Certification Navigator, Greenfield Venture Builder, Corporate Structure Designer, and Organogram & Postholder Planner.
• Operating-carrier tools: Airline Health Scorecard, CASK Benchmarking Calculator, Operating Model Canvas, Fuel Contract Optimizer Lite, Training Needs Analysis, MRO & Technical Readiness Diagnostic, and the 48-Hour Data Request.

This matters most for the tools where you type things about real people and real money — the names of proposed shareholders in the Corporate Structure Designer, the names of proposed postholders in the Organogram Planner, and your capital and funding assumptions in the Venture Builder. Those never leave your device.

• Running a tool transmits nothing. There is no account, no upload, and no background submission. You can complete every diagnostic on this site without sending us anything.
• We use no cookies, no analytics, no advertising or tracking technologies, and no social-media pixels.
• We cannot access, view, link or sell anything you have not sent us — and until you press one of the send buttons described immediately below, you have not sent us anything.

The exceptions, in full

Three optional forms on this site do send data to us, and it is only fair to be exact about them rather than leave the paragraph above sounding more absolute than it is. Each one requires you to fill it in and press a button; none fires on its own, and nothing is queued or sent later.

• “Email me this report” on the results page sends your name, email address, airline, fleet size, your health index, your three weakest domains with their scores, and a link to your report.
• “Request a debrief” on the results page sends your name, email address, airline, role, preferred week, and the same health index, weakest domains and report link.
• Tool enquiry forms elsewhere on the site send which tool you were using, plus whatever contact details that particular form asks for.

One point deserves emphasis, because it is easy to miss. The report link in the first two forms carries your scorecard answers encoded in the address itself. Sending it therefore sends us your answers, not merely your score. That is what makes a useful debrief possible — a consultant who can see which options you selected can prepare properly — but it is your decision, and you should make it knowing that is what the link contains. If you would rather we saw only the headline figure, email us instead and paste in what you choose.

These submissions are received through Netlify Forms and stored in our Netlify account (see section 6). They are not fed into any analytics, advertising or profiling system, and they are not shared with anyone outside JK.

3. Personal data we process

Given the design above, the only personal data involved is:

(a) Information you send us

If you use a "contact" or "talk to JK" link, your own email application opens a draft addressed to us. If you send that email, we receive your email address, your name (if you include it) and whatever you choose to write — which may include information about your airline. You decide what to share.

If instead you submit one of the three forms listed in section 2, we receive the fields named there — which, for the two results-page forms, include your health index, your weakest domains and a report link that carries your scorecard answers. Those forms are the only route by which anything you typed into a diagnostic can reach us, and each one requires an explicit submission.

(b) Technical data handled by our service providers

As with any website, when your browser loads our pages our hosting/content-delivery provider automatically processes limited technical data — such as your IP address, the page requested, browser type and timestamp — to deliver the page and keep it secure. We do not use this data to identify you and we do not build profiles from it. See sections 6 and 7.

Our typefaces are served from this same domain, so loading a page discloses your IP address only to our hosting provider and to no one else.

4. Purposes and lawful bases

Under section 30 of the Act we process personal data only where we have a lawful basis:

• Responding to your enquiry and taking steps toward a possible engagement — basis: your consent in choosing to contact us, and the necessity of taking steps at your request prior to entering a contract.
• Delivering and securing the website (technical data via providers) — basis: our legitimate interest in operating a safe, functioning website, balanced against your rights.

Where we rely on consent, you may withdraw it at any time by contacting us; this does not affect processing already carried out.

5. Local storage on your device

To make the tools usable, your browser stores your entries under keys beginning jk_ or dn_ — for example jk_airline_scorecard_v3, jk_structure_v3, jk_organogram_v3, jk_venture_file_v3 and dn_operating_model_canvas_v1. This is local storage, not a cookie: it stays in your browser, is not sent in network requests, and is not visible to us. You remain in control:

• Use the "Reset" / "Clear" buttons in the tools, or
• Clear your browser's site data for this domain, or
• Use a private/incognito window, which discards it when you close the window.

Exporting your workspace

The Venture Control Room can export everything the tools have saved — the whole workspace, including any names and financial assumptions you entered — into a single .json file that your browser downloads to your device. We do not receive that file and it is not uploaded anywhere. Two things follow, and you should weigh both:

• The file is a plain, readable copy of your inputs. Treat it with the same care as any other confidential document — it is only as protected as wherever you save it.
• Once you send it to someone — a colleague, a lender, an adviser — it is outside our design and outside our control. Nothing in this notice can protect data you have chosen to forward.

Importing a workspace file replaces what the tools currently hold on that device. The import runs entirely in your browser and reads only keys belonging to this site.

6. Who else is involved (processors & third parties)

We keep third parties to the minimum needed to serve a static website:

• Hosting / content delivery: Netlify hosts the static files and serves them over HTTPS.
• Form submissions: the three optional forms described in section 2 are received and stored by Netlify Forms, part of the same hosting provider. This is the only place data you send through this site is held. Nothing reaches it unless you press one of those send buttons.
• Web fonts: none. Our typefaces are self-hosted on this domain. Earlier versions of this site loaded them from Google Fonts, which disclosed your IP address to Google on every page view; that is no longer the case, and no third-party font, script, analytics or advertising service is loaded anywhere on this site.
• Email: if you email us, our email provider processes that message so we can read and reply.

These providers act as our processors or as independent controllers of the technical data described above. We do not sell or rent personal data, and we do not share your tool inputs with anyone because we never receive them.

7. International data transfers

Our hosting and content-delivery providers operate infrastructure outside Kenya, including in the United States and other countries. Consequently, loading the site, and any email you send us, may involve transferring the limited data described above outside Kenya. In line with sections 48 and 49 of the Act, such transfers are made in reliance on the providers' own data-protection commitments and appropriate safeguards. If you would like more detail on a specific provider's safeguards, contact us.

8. Retention

• Your tool inputs: retained only on your device, for as long as you keep them, unless you submitted one of the forms in section 2 — in which case the fields that form sends, including the report link carrying your answers, are held with the enquiry data below.
• Emails and enquiry data: kept only as long as necessary to handle your enquiry and any resulting engagement, and to meet legal or accounting obligations, after which they are deleted or anonymised.
• Provider technical logs: retained by those providers under their own retention schedules.

9. Your rights

Subject to the Act (in particular section 26), you have the right to:

• be informed of the use of your personal data;
• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion or erasure of your data;
• object to, or request restriction of, processing;
• data portability, where applicable; and
• not be subject to a decision based solely on automated processing. (Our tools score only the figures you enter, on your device, and produce indicative guidance — they make no decision about you.)

To exercise any right, email us at info@aviationhubkenya.org. We will respond within the timeframes set by the Act and may need to verify your identity first.

10. Complaints to the ODPC

If you believe we have not handled your personal data lawfully, please contact us first so we can put it right. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya: website www.odpc.go.ke, email info@odpc.go.ke.

11. Children

This site is a professional tool intended for airline executives and is not directed at children. We do not knowingly collect the personal data of anyone under 18.

12. Security

The site is served over HTTPS with security headers (including content-security-policy controls on embedding). Because your tool inputs never leave your device and we operate no central store of them, the most sensitive data simply never reaches us. Email you send us is protected by our provider's security measures.

13. Changes to this notice

We may update this notice from time to time. The "last updated" date at the top shows the current version; material changes will be reflected here.

14. How to contact us

For any privacy question or to exercise your rights, contact info@aviationhubkenya.org, or write to us at the office address in section 1. Both reach the same people; email is faster.

Read our Terms of Use →