Wananchi Group Data Protection Policy

1. Wananchi Privacy Statement

Wananchi Group is committed to protecting the privacy of the personal data it collects and to complying with applicable data privacy laws.

Wananchi Group recognises that data privacy and protection are the foundation of trustworthy relationships and of its reputation as a credible organisation. Wananchi Group will ensure that it protects the rights of data subjects and that the collection and processing of personal data is done in compliance with applicable legislation.

All Wananchi Group staff and external business partners must comply with this policy.

2. Purpose

This Data Protection Policy is the overarching policy for data security and protection for Wananchi Group entities. It establishes guidelines for the collection, use, storage and sharing of personal and sensitive information by Wananchi Group.

The objectives of the policy are to:

1. Ensure compliance by Wananchi Group employees and external partners (suppliers, outsourced partners, consultants and independent contractors) with the applicable data protection laws and regulations;
2. Protect the rights and privacy of data subjects from whom Wananchi Group collects personal data;
3. Outline the roles and responsibilities of all employees and external partners in implementing this policy;
4. Protect Wananchi Group from risks related to data protection and safeguard its reputation.

3. Scope

This policy applies to:

1. All Wananchi Group entities;
2. All Wananchi Group employees, and all external business partners of Wananchi Group (for example suppliers, outsourced partners, consultants, independent contractors and other stakeholders) who process personal data collected by or on behalf of Wananchi Group;
3. All personal data collected by Wananchi Group entities from data subjects, such as individual customers, suppliers, employees, consultants, independent contractors, visitors to its premises and other external business partners;
4. All personal data currently stored, maintained and handled by and on behalf of Wananchi Group entities, whether in hard copy or digital form.

4. Definitions

Consent means any manifestation of express, unequivocal, free, specific and informed indication of the data subject's wishes, by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to the data subject.

Data subject means an identified or identifiable natural person who is the subject of personal data.

Encryption means the process of converting the content of any readable data into coded form using technical means.

Personal data means any information relating to an identified or identifiable natural person.

Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as:

1. collection, recording, organisation, structuring;
2. storage, adaptation or alteration;
3. retrieval, consultation or use;
4. disclosure by transmission, dissemination, or otherwise making available;
5. alignment or combination, restriction, erasure or destruction.

Sensitive personal data means data revealing a natural person's race, health status, ethnic or social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (including the names of the person's children, parents, spouse or spouses), sex or sexual orientation.

5. Principles of Data Protection

Wananchi Group will ensure that personal data is:

a) Processed lawfully, fairly and in a transparent manner, in line with the right to privacy. Wananchi Group will only process personal data where it has a lawful basis to do so. Processing is lawful where the data subject has given consent for one or more specific purposes, or where the processing is deemed necessary:

1. For the performance of a contract to which the data subject is a party (for instance a contract of employment or a contract to provide services);
2. To comply with Wananchi Group's legal obligations;
3. To perform tasks carried out in the public interest or in the exercise of official authority;
4. To protect the vital interests of the data subject or another person;
5. To pursue Wananchi Group's legitimate interests, where those interests are not outweighed by the interests and rights of data subjects;
6. For historical, statistical, journalistic, literary, artistic or scientific research.

b) Collected only for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

c) Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

d) Accurate and kept up to date.

e) Not kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data is processed.

f) Processed securely, using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and accidental loss, destruction or damage.

g) Not transferred out of Kenya unless there is proof of adequate data safeguards or consent from the data subject.

6. Transfer of Data

To mitigate the risks associated with transferring data to third parties, Wananchi Group will only transfer data to a third party if:

1. The data is stripped of personal and identifiable information;
2. The transfer is based on one or more legitimate bases, including: explicit consent by the data subject; compliance with national or international law; or the exercise, establishment and defence of any contractual or legal obligations;
3. The personal data to be transferred is adequate, relevant, necessary and not excessive in relation to the purpose(s) for which it is being transferred;
4. The data subject has been informed, either at the time of collection or subsequently, about the potential transfer of their personal data;
5. The third party has in the past respected the confidentiality of personal data transferred to them by Wananchi Group; and
6. The third party maintains a high level of data security that protects personal data against the risk of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to it.

7. Data Subjects' Rights

A data subject has the right to:

1. be informed of the use to which their personal data is to be put;
2. withdraw consent at any time;
3. access their personal data in the custody of the data controller or data processor;
4. object to the processing of all or part of their personal data;
5. correction of false, inaccurate or misleading data;
6. deletion of false or misleading data about them;
7. request erasure of their personal data where it is irrelevant, excessive or was obtained unlawfully.

Wananchi Group shall maintain a Privacy Statement / Notice on its website that informs data subjects of their rights regarding the data collected and processed by Wananchi Group and its external partners.

8. Processing Data Relating to Children

Wananchi Group will not process data relating to a child unless consent is given by the child's parent or guardian, and the processing is carried out in a manner that protects and advances the rights and best interests of the child.

Wananchi Group will institute adequate mechanisms to verify age and obtain consent before processing the data.

9. Processing of Sensitive Personal Data

Wananchi Group will process sensitive personal data only when:

a) The processing is carried out in the course of legitimate activities with appropriate safeguards, relates solely to staff or to persons who have regular contact with the sensitive information, and the personal data is not disclosed outside Wananchi Group without the consent of the data subject. The departments that handle sensitive personal data shall work with the Data Protection Officer to obtain consent from the respective data subjects.

b) The processing is necessary for:

• the establishment, exercise or defence of a legal claim;
• carrying out the obligations and exercising the specific rights of the controller or of the data subject;
• protecting the vital interests of the data subject or another person, where the data subject is physically or legally incapable of giving consent.

10. Data Breach

Wananchi Group will report any data breach to the Data Protection Commissioner within 72 hours of becoming aware of it, in accordance with the Wananchi Group Data Breach Policy.

Wananchi Group will also communicate the data breach to the affected data subject as soon as is practical, unless the identity of the data subject cannot be established.

11. Data Protection Impact Assessments

Wananchi Group will undertake a data protection impact assessment whenever it identifies that a processing operation is likely to result in a high risk to the rights and freedoms of any data subject. The assessment will be completed before the data is processed.

12. Data Retention

Data will not be kept in a form that allows data subjects to be identified for longer than needed for the Company's legitimate purposes, or for the other purposes for which the Company collected it.

Wananchi Group shall take all reasonable steps to destroy or erase from its systems all personal data that is no longer required, in accordance with the Data Protection Retention Policy.

13. Compliance

It is every employee's responsibility to comply with this policy. Failure to comply may leave you personally liable for civil or criminal penalties, including fines.

14. Policy Review and Updates

This policy will be reviewed and updated periodically to make sure it remains effective, relevant and adhered to.

15. Contact Information

For any questions regarding this policy, please contact the Data Protection Department at dataprotection@ke.wananchi.com.