Before we start

What Cybersentinel collects Your business name, the 5 self-classification answers used to suggest your Implementation Tier, and your maturity assessment answers (which statements you agreed or disagreed with, and the levels you confirmed for each of the six domains). If you set a Target Profile, we also store that. If you complete Training Hub lessons, we store which ones and your quiz results. Why we collect it To generate your maturity assessment, show you tier-appropriate guidance, and — if you separately consent to research participation below — to use anonymised, aggregated data in academic research at United States International University-Africa (USIU-A). How it's stored and protected Your data is stored in a private database, not made public, and not linked to your name in any research output — only an anonymous pseudonym is used for research analysis. There is currently no login system; anyone with a direct link to your specific assessment or results page can view it, in the same way a shared document link works. Treat links to your own assessment as you would any private document. Your rights under the Data Protection Act, 2019 You have the right to access the data held about you, request its correction, and request its deletion. You can download your own assessment as a PDF at any time from your results page — this is your data-access/portability request already built into the tool. You can revoke research consent or delete your account entirely from your settings page (see the link on your results page). Kenya's data protection regulator is the Office of the Data Protection Commissioner (ODPC) — odpc.go.ke, info@odpc.go.ke, 0207801800. Retention Your data is kept for as long as your account exists, or until you request deletion. Deleting your account removes your business profile, assessments, targets, and training records permanently; a bare record that a deletion occurred (no personal data) is kept for audit purposes.

This tool is part of an academic study Cybersentinel was built as part of an MSc thesis at United States International University-Africa (USIU-A), researching cybersecurity maturity assessment for Nairobi digital SMEs. Participation is voluntary You are not required to take part. You can stop at any point, and you can revoke your research consent at any time afterward from your settings page without needing to give a reason and without affecting your ability to keep using the assessment tool itself. How your data may be used If you consent below, your anonymised and aggregated assessment data (never your business name) may be analysed and reported in the thesis and any related academic publications. Individual responses are never published in a form that could identify your business. How to withdraw Go to your settings page (linked from your results page) and select "Revoke research participation." This stops any future use of your data in the research, effective immediately — it does not delete data already analysed and written into the thesis by that point. Researcher contact Tevin Njenga, USIU-A — for questions about this research. Supervisor: Dr. Paula Musuva, USIU-A — pmusuva@usiu.ac.ke.