CONSENT NOTICEThis Consent Notice outlines the purposes for which Kenpoly Manufacturers Limited will collect, receive, use, disseminate, and process personal and sensitive data of data subjects, i.e., staff, customers/clients, vendors/suppliers, and other related third parties, in accordance with the Data Protection Act, 2019.
PERSONAL INFORMATION:1.As used in this Notice: “consent” means any manifestation of express, unequivocal, free, specific and informed indication of the data subject’s wishes by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to the data subject. “personal information” will be used to refer to both personal data and sensitive data as defined in the Data Protection Act, 2019. “personal data” means information identifiable to an individual owing to their relationship with the company, which includes: name, gender, contact details, postal address, email address, birth date, nationality, ID/Passport information, KRA PIN, NSSF number, NHIF number, bank account information. “sensitive data” means information revealing the data subject’s health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of the person’s children, parents, spouse or spouses, sex or the sexual orientation of the data subject. “you” shall be used to mean the data subject, i.e., staff, customers/clients, vendors/suppliers.
2.Other terms used in this Notice shall have the meanings given to them as defined in the Data Protection Act, 2019.
COLLECTION AND PROCESSING OF PERSONAL INFORMATION:3.We may collect, use, and process personal information that is:
a) provided to us directly by you through one-on-one interaction, physical forms, online platforms, documents supplied by you.
b) provided by a personal representative duly authorized by you to disclose your personal information to us, and to which the personal representative has provided written consent.
c) collected through interaction with our duly authorized employees and/or contracted third parties.
d) part of public records or that has been made public by you.
4.We will ensure that collection of any personal information is done in a transparent manner and used for legitimate purposes known to you and that are compatible with the services sought by you.
5.We shall seek the consent of the parent and/or guardian when collecting personal information relating to a child.
6.We shall inform you of third parties to whom we will disclose your personal information, and safeguards that are put in place to ensure its protection.
7.Personal information collected directly or indirectly will be used for any or all of the following purposes:
a) administering and/or managing relationship between you and the company.
b) performance of a contract to which you are a party to.
c) carrying out tasks in relation to provision of the goods and/or services requested by you.
d) conveying direct or indirect marketing/promotional information about our goods and/or services.
e) handling inquiries, complaints and requests from you.
f) ensuring compliance with any laws and regulations to which the company is subject to.
g) transmitting to third parties including our third-party service providers and agents, and relevant governmental and/or regulatory authorities.
h) risk assessment, statistical and planning purposes.
i) any other purposes to which you have provided.
8.We shall seek your consent before collecting and processing personal information for any additional purpose that is not part of the original purposes that had been notified to you, except where authorised by law.
9.The personal information collected will be stored in storage locations and servers that are located in Kenya.
10. We may disclose your personal information to third party service providers or agents and other organisations, situated in Kenya, that we have engaged to perform any of the purposes listed above.
PROTECTION OF PERSONAL INFORMATION:11. We will ensure protection of your personal information from unauthorised collection, access, modification, destruction, storage and/or dissemination, and as such, we have established proper physical and logical access controls over the personal information that is held within the company in both physical and digital form.
12. We will constantly review and enhance our information security measures and capabilities to ensure timely detection and mitigation of any threats/breaches to your personal information.
13. In the event of a data breach affecting your personal information, we will inform you within a period of 72 hours. This notification will be through the official communication channels that you have provided to us, i.e., “email address” or “telephone number”. Further, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach. The communication to you will also include facts about the breach, its effects on you, and the remedial actions we have taken concerning the breach.
REVOCATION OF CONSENT:14. You may exercise your right of revocation or withdrawal of consent to the collection, processing and dissemination of your personal information. Such consent may be withdrawn by submitting a formal request in writing or via email to our Data Protection Officer using the contact details provided below.
15. The withdrawal of your consent shall not affect the lawfulness of processing based on prior consent before its withdrawal.
16. Upon receipt of your written request to withdraw your consent, we may require reasonable time for your request to be processed and for us to notify you of its consequences.
ACCESS AND RECTIFICATION OF PERSONAL INFORMATION:17. You may request access to your personal information that is in our custody.
18. You may request the rectification and/or update to any of your personal information that is inaccurate, out-dated, incomplete, or misleading. Such request should be made in writing or via email to our Data Protection Officer using the contact details provided below.
19. We will respond to your requests as soon as reasonably possible. If we are unable to fulfil a data access request, correct and/or update your personal information as requested, we shall inform you of our reasons except where we are not required to do so under the Data Protection Act, 2019
RETENTION OF PERSONAL INFORMATION:20. We may retain your personal information for as long as may be reasonably necessary to satisfy the purpose for which it is processed, unless the retention is;
a) required or authorized by law.
b) reasonably necessary for a lawful purpose.
c) authorized or consented by you.
d) for historical, statistical, journalistic literature and art or research purposes.
21. We will cease to retain your personal information and shall delete, erase, anonymize or pseudonymize it as soon as we (the company) have determined that its intended purpose is no longer applicable.
DATA PROTECTION OFFICER:22. The Data Protection Officer may restrict the processing of personal information where its accuracy is contested, it is no longer required for its initial purpose, the processing is unlawful, and/or you have objected to its processing.
23. Personal information that has been restricted shall only be processed with your consent and you shall be duly informed before withdrawal of the restriction.
24. You may contact the Data Protection Officer to request:
a) objection to the processing of personal information.
b) rectification of personal information that is inaccurate, out-dated, or misleading.
c) deletion of personal information that we are no longer authorized to retain.
25. You may contact our Data Protection Officer if you have any inquiries or feedback related to our data privacy and protection policies and procedures.
26. Our Data Protection Officer’s contact details are: Email: dpo@kenpoly.com
REVIEW AND CHANGES TO THE NOTICE:27. This Notice applies in concurrence with relevant data privacy regulations such as the Data Protection Act, 2019, the company’s privacy policies and procedures, and/or other terms and conditions that exist on our website, mobile applications, and e-commerce platform, in relation to the collection and processing of your personal information.
28. This Notice may be revised and/or updated periodically by providing formal notifications to you, including posting on our online platforms and official website.
ACKNOWLEDGEMENT AND CONSENT:By reading this notice and proceeding to transact with us, you agree to all the terms stated, and consent to the collection, use and processing of your personal information by Kenpoly Manufacturers Limited for the aforementioned purposes within this Notice.