Privacy Notice

1. Who we are (data controller)

This site is operated by JK & Associates ("JK", "we", "us", "our"), an aviation management consultancy based in Nairobi, Kenya. For the purposes of the Data Protection Act, 2019 (the "Act"), JK is the data controller for the limited personal data described in this notice.

• Registered entity: [full registered legal name and company registration number]
• Registered / postal address: [registered office address, Nairobi, Kenya]
• Email:
• Contact for data matters: . We have not appointed a Data Protection Officer; data-protection queries are handled by JK directly at that address. We keep the need for a designated officer under review as the practice grows.
• ODPC registration: JK is not currently registered as a data controller with the Office of the Data Protection Commissioner. This does not narrow your rights under the Act or our obligations under it, both of which apply regardless, and we keep our registration position under review.

2. How the tools handle your data

Every tool on this site is a client-side tool. They run as code in your browser. Any values you enter are processed on your device and, where you would otherwise lose them on refresh, are saved to your browser's local storage (see section 5). This applies without exception to all of them:

• Venture tools: Venture Control Room, KCAA Certification Navigator, Greenfield Venture Builder, Corporate Structure Designer, and Organogram & Postholder Planner.
• Operating-carrier tools: Airline Health Scorecard, CASK Benchmarking Calculator, Operating Model Canvas, Fuel Contract Optimizer Lite, Training Needs Analysis, MRO & Technical Readiness Diagnostic, and the 48-Hour Data Request.

This matters most for the tools where you type things about real people and real money — the names of proposed shareholders in the Corporate Structure Designer, the names of proposed postholders in the Organogram Planner, and your capital and funding assumptions in the Venture Builder. Those never leave your device.

• Your inputs are not transmitted to JK or to any server. There is no database, no account, and no upload.
• We use no cookies, no analytics, no advertising or tracking technologies, and no social-media pixels.
• Because nothing is sent to us, we cannot access, view, link or sell your inputs.

3. Personal data we process

Given the design above, the only personal data involved is:

(a) Information you send us

If you use a "contact" or "talk to JK" link, your own email application opens a draft addressed to us. If you send that email, we receive your email address, your name (if you include it) and whatever you choose to write — which may include information about your airline. You decide what to share.

(b) Technical data handled by our service providers

As with any website, when your browser loads our pages our hosting/content-delivery provider automatically processes limited technical data — such as your IP address, the page requested, browser type and timestamp — to deliver the page and keep it secure. We do not use this data to identify you and we do not build profiles from it. See sections 6 and 7.

Our typefaces are served from this same domain, so loading a page discloses your IP address only to our hosting provider and to no one else.

4. Purposes and lawful bases

Under section 30 of the Act we process personal data only where we have a lawful basis:

• Responding to your enquiry and taking steps toward a possible engagement — basis: your consent in choosing to contact us, and the necessity of taking steps at your request prior to entering a contract.
• Delivering and securing the website (technical data via providers) — basis: our legitimate interest in operating a safe, functioning website, balanced against your rights.

Where we rely on consent, you may withdraw it at any time by contacting us; this does not affect processing already carried out.

5. Local storage on your device

To make the tools usable, your browser stores your entries under keys beginning jk_ or dn_ — for example jk_airline_scorecard_v3, jk_structure_v3, jk_organogram_v3, jk_venture_file_v3 and dn_operating_model_canvas_v1. This is local storage, not a cookie: it stays in your browser, is not sent in network requests, and is not visible to us. You remain in control:

• Use the "Reset" / "Clear" buttons in the tools, or
• Clear your browser's site data for this domain, or
• Use a private/incognito window, which discards it when you close the window.

Exporting your workspace

The Venture Control Room can export everything the tools have saved — the whole workspace, including any names and financial assumptions you entered — into a single .json file that your browser downloads to your device. We do not receive that file and it is not uploaded anywhere. Two things follow, and you should weigh both:

• The file is a plain, readable copy of your inputs. Treat it with the same care as any other confidential document — it is only as protected as wherever you save it.
• Once you send it to someone — a colleague, a lender, an adviser — it is outside our design and outside our control. Nothing in this notice can protect data you have chosen to forward.

Importing a workspace file replaces what the tools currently hold on that device. The import runs entirely in your browser and reads only keys belonging to this site.

6. Who else is involved (processors & third parties)

We keep third parties to the minimum needed to serve a static website:

• Hosting / content delivery: Netlify and/or Vercel host the static files and serve them over HTTPS.
• Web fonts: none. Our typefaces are self-hosted on this domain. Earlier versions of this site loaded them from Google Fonts, which disclosed your IP address to Google on every page view; that is no longer the case, and no third-party font, script, analytics or advertising service is loaded anywhere on this site.
• Email: if you email us, our email provider processes that message so we can read and reply.

These providers act as our processors or as independent controllers of the technical data described above. We do not sell or rent personal data, and we do not share your tool inputs with anyone because we never receive them.

7. International data transfers

Our hosting and content-delivery providers operate infrastructure outside Kenya, including in the United States and other countries. Consequently, loading the site, and any email you send us, may involve transferring the limited data described above outside Kenya. In line with sections 48 and 49 of the Act, such transfers are made in reliance on the providers' own data-protection commitments and appropriate safeguards. If you would like more detail on a specific provider's safeguards, contact us.

8. Retention

• Your tool inputs: retained only on your device, for as long as you keep them; we hold no copy.
• Emails and enquiry data: kept only as long as necessary to handle your enquiry and any resulting engagement, and to meet legal or accounting obligations, after which they are deleted or anonymised.
• Provider technical logs: retained by those providers under their own retention schedules.

9. Your rights

Subject to the Act (in particular section 26), you have the right to:

• be informed of the use of your personal data;
• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion or erasure of your data;
• object to, or request restriction of, processing;
• data portability, where applicable; and
• not be subject to a decision based solely on automated processing. (Our tools score only the figures you enter, on your device, and produce indicative guidance — they make no decision about you.)

To exercise any right, email us at . We will respond within the timeframes set by the Act and may need to verify your identity first.

10. Complaints to the ODPC

If you believe we have not handled your personal data lawfully, please contact us first so we can put it right. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya: website www.odpc.go.ke, email info@odpc.go.ke.

11. Children

This site is a professional tool intended for airline executives and is not directed at children. We do not knowingly collect the personal data of anyone under 18.

12. Security

The site is served over HTTPS with security headers (including content-security-policy controls on embedding). Because your tool inputs never leave your device and we operate no central store of them, the most sensitive data simply never reaches us. Email you send us is protected by our provider's security measures.

13. Changes to this notice

We may update this notice from time to time. The "last updated" date at the top shows the current version; material changes will be reflected here.

14. How to contact us

For any privacy question or to exercise your rights, contact [and/or the registered postal address above].

Read our Terms of Use →