Privacy Policy of rak.co.ke

1.    Introduction

We are committed to protecting your privacy. The following is a privacy notice issued by the REITS Association of Kenya (hereinafter referred to as ‘RAK’) for all connected purposes under this address;

The Exchange
55 Westlands Road
P. O. BOX 43633 – 00100 (GPO)
Nairobi, Kenya
Tel: +254 (020) 283 1000/ +254 100 849765
Email: raksecretariat@nse.co.ke Website: https://rak.co.ke/

2.    Office of the Data Protection Commissioner (ODPC) Registration.

The Organization is registered as a Data Controller and Data Processor with the Office of the Data Protection Commissioner.

  • Registration Number: 444-1175-C6C5     Registration Status:   Approved

3.    Our commitment to protecting your privacy.

  • This Privacy Notice explains what Personal Information the REITS Association of Kenya (RAK) collects about you, what we use it for, who we share it with and how we protect it. It also sets out your rights and who you can contact for more information or queries.
  • When used in this Privacy Notice, “we”, “us” and “our” refer to RAK. Information about you, is referred to as “Personal Information” which applies to data that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual.
  • “Sensitive Personal Information” on the other hand refers to revealing a data subject’s race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of the person's children, parents, spouse or spouses, sex or their sexual orientation.
  • The term “Processing” collectively refers to when we handle, collect, protect and store your Personal Information.

4.    What Personal Information we collect

  • A Data Subject is an identified or identifiable natural person who is the subject of personal data whose information may be collected in the following ways:
    1. you give it to us (for example, (1) when you complete and submit the membership registration form as part of the membership registration process (“Membership”) or (2) through the webpages of this website which links to this Privacy Notice (collectively referred to as the “Website”), or (3) through any other mode of interacting with you relating to RAK communications, (“Communication”);
    2. other people give it to us (for example, other entities or third- party service providers that we use to help implement our mandate); or
    3. it is publicly available.
  • When other entities or other third-parties give us Personal Information about you, we make sure they have complied with the relevant privacy laws and regulations. This may include, for example, that it has informed you of the processing, and has obtained any applicable and necessary permission for us to process that information as described in this Privacy Notice.
  • Log information, cookies and web beacons: We may process Personal Information from you when you interact with the Membership, Website or Communications. For example, we or our service provider(s) may also use cookies (small text files stored in a user's browser) or web beacons (electronic images that allow us to count users who have accessed particular content and to access certain cookies) to collect aggregate data. Where applicable, additional information on how we may use cookies and other tracking technologies, and how you can control these, can be found in the Cookie Notice on the applicable Website. More information on how we use cookies and other tracking technologies can be found in our cookie notice on the rak.co.ke Website.
  • The Personal and/or Sensitive Personal Information we process may include your: name; current job title; company name; (professional) e-mail address, country of residence, telephone and fax number(s), physical address(es); business & industry interests; gender; date of birth; marital status; employment and education details (such as learning history, work experience and skills); CV; geolocation; certificate or license number; account number; photograph, video or audio recording identifiable to an individual; your postings on any blogs, forums, wikis and any other social media applications that we provide; your IP address; your browser type and language; your access times; complaint details; correspondence with you; the newsletters you subscribe to; information relevant RAK to provide services to you; details of how you use RAK services, details of how you like to interact with us, and other similar information relevant to our relationship, information we collect when you access our premises; and any other information that you voluntarily provide to us. We may also collect or obtain Personal Information from you because of the way you interact with us or others.
  • If you choose not to provide, or – where applicable - object to us processing the information we collect (see section “Your rights” below), we may not be able to process your instructions or provide you tailored communication, service, or assistance.

5.    Children’s Data

  • Our services are not directed at, and we do not knowingly collect personal data from, individuals under the age of 18 ("children") without the consent of a parent or legal guardian.
  • Where we become aware that we have inadvertently collected personal data from a child without the requisite parental or guardian consent, we will take immediate steps to verify this, delete the data from our records within 14 days, and, where contact details are available, notify the parent or guardian accordingly.
  • Parents or guardians who believe their child's data has been collected without appropriate consent should contact us immediately at raksecretariat@nse.co.ke to request deletion.

6.    Consent

  • Where we rely on your consent as the lawful basis for processing your personal data, we will only do so after providing you with clear information about the purpose of the processing, and your consent will be obtained through a clear, affirmative, and unambiguous action (such as ticking a box, signing a form, or another deliberate opt-in step). We do not rely on silence, pre-ticked boxes, or inactivity as consent.

7.    Withdrawal of Consent

  • You have the right to withdraw your consent at any time, without affecting the lawfulness of any processing carried out based on your consent before its withdrawal. Withdrawal does not require you to give a reason.
  • To withdraw consent, you may:
    1. Email us at amwega@nse.co.ke , with the subject line "Withdrawal of Consent";
    2. Contact our Data Protection Officer at +254 100 849765
  • We will act on your withdrawal request within 7 days and will confirm once the relevant processing has ceased. Please note that withdrawing consent may affect our ability to provide certain services to you, where that consent was necessary for us to do so. Where this is the case, we will inform you of the specific consequences at the time of your request.

8.    Legal basis for processing information

  • We are required by law to set out in this Privacy Notice the legal grounds on which we rely in order to process your Personal Information. We rely on one or more of the following lawful grounds when we use your Personal Information for the purposes outlined above:
    1. the processing is necessary for compliance with a legal obligation we have such as keeping records or providing information to a public body or law enforcement agency;
    2. the processing is necessary for the purposes of a legitimate interest pursued by us or a third party (and are not outweighed by your privacy interests), such as the effective delivery of our Website and related services offered to you; the effective and lawful operation of our Website or Communications; to prevent fraud or criminal activity or to safeguard our technology systems and/or data security; to support or protect our business interests; to ensure that complaints are investigated; to evaluate, develop or improve our services or products; or
    3. you have consented to us processing your information for a specific reason, consent that you can always withdraw.
  • To the extent that we process any sensitive Personal Information relating to you for any of the purposes outlined above, we will do so because either: (i) you have given us your explicit consent to process that data; (ii) we are required by law to process that data, (iii) the processing is necessary for the establishment, exercise or defence of legal claims or
    (iv) you have made the data manifestly public.
  • Please note that in certain circumstances it may be still lawful for us to continue processing your information for separate purposes even where you have withdrawn your consent, if one of the other legal bases described above is applicable.

9.    Processing Purposes

  • We collect and process your personal data for the following specific purposes, each linked to a lawful basis under the Data Protection Act, 2019 ("the DPA"):
    1. Membership management - Processing applications, maintaining membership records, issuing membership credentials. This is necessary for the performance of a contract with you
    2. Event administration - Registration, attendance tracking, logistics, communication regarding events. This is necessary for the performance of a contract or your legitimate interest in attending events
  • Marketing and communications - Sending newsletters, promotional material, event invitations. This is based on your consent, which you may withdraw at any time.
  1. Analytics and service improvement - Analyzing usage patterns, improving our website and services. This is necessary for our legitimate interests, balanced against your rights.
  2. Regulatory compliance - Record-keeping, reporting to regulators, responding to lawful requests from authorities. This is necessary for compliance with a legal obligation.
  • Where we rely on a different lawful basis for a specific processing activity not listed above, we will inform you of that basis at the point of collection.

10.  Automated Decision-Making & Profiling

  • We do not carry out automated decision-making, including profiling, that produces legal effects or similarly significantly affects data subjects.
  • We may use automated means, including profiling, to [describe purpose, e.g. assess membership eligibility, personalize marketing communications]. Where such processing produces legal effects concerning you or similarly significantly affects you, you have the right to obtain human intervention, express your point of view, and contest the decision, by contacting [insert Data Protection Officer’s contact details].

11.  Sending you publicity information

  • We may use your information from time to time to inform you by letter, telephone, email and/or other electronic methods about services (including those of third parties) that may be of interest to you. Where we are legally required to obtain your consent to provide you with certain marketing materials, we will only provide you with such marketing materials where we have obtained such consent from you.
  • You may, at any time, ask us not to send marketing information to you by following the unsubscribe instructions in Communications from us, or contacting the Data Protection Officer at amwega@nse.co.ke or +254 100 849765.

12.  Disclosure of information to third parties

  • In connection with one or more of the purposes outlined in the “Information use” section above, we may disclose details about you for legitimate purposes; third parties that provide services to us; competent authorities (including authorities regulating us) and other third parties that reasonably require access to Personal Information relating to you for one or more of the purposes outlined in the “Processing Purposes” section above.
  • We may also need to disclose your Personal Information if required to do so by law, by a regulator or during legal proceedings.
  • Further details of the transfers described above, and the adequate safeguards used by us in respect of such transfers, are available from us. For such information, please contact us by using the “Contact information” section below.
  • We may share non-personal, de-identified and aggregated information with third parties for several purposes, including data analytics, research, submissions, thought leadership and promotional purposes.

13.  Cross-Border Transfers

  • In the course of our operations, including the use of cloud hosting and storage providers, your personal data may be transferred to and processed in countries outside Kenya. Such transfers are carried out in accordance with the law and are based on one or more of the following mechanisms:
    1. A determination by the ODPC that the destination country has adequate data protection safeguards; or
    2. Appropriate contractual clauses (standard contractual clauses) between us imposing obligations equivalent to those under the Data Protection Act, 2019; or
  • Your explicit consent, after being informed of the possible risks of such a transfer, where no other mechanism applies.

14.  Blogs, forums, wikis, and other social media

  • The Website may host various blogs, forums, wikis and other social media applications or services that allow you to share content with other users (collectively referred to as “Social Media Applications”).
  • Any Personal Information or other information that you contribute to any Social Media Application can be read, collected and used by other users of that Social Media Application over whom we have little or no control. Therefore, we are not responsible for any other user's use, misuse or misappropriation of any Personal Information or other information that you contribute to any of our Social Media Application.

15.  Privacy practices of third parties

  • This Privacy Notice addresses only the use and disclosure of information we collect through your interaction with the Association or Communications. Other websites or applications that may be accessible through links from the Association and Communications have their own privacy notices and Personal Information collection, use and disclosure practices.
  • We encourage you to familiarize yourself with the privacy notices provided by these other parties prior to providing them with information.

16.  Do not track

  • "Do Not Track" is a preference you can set in your web browser to let websites and applications you visit know that you do not want them collecting information about you.
  • The Websites do not currently respond to a "Do Not Track" or similar signal.

17.  Information security

  • We use a range of physical, electronic and managerial measures to keep your Personal Information secure, accurate and up to date. These measures include:
    1. education and training to relevant staff so that they are aware of our privacy obligations when handling Personal Information;
    2. administrative and technical controls to restrict access to Personal Information on a ‘need to know’ basis;
    3. technological security measures, including fire walls, encryption and anti-virus software; and
    4. physical security measures, such as staff security passes to access our premises.
  • Although we use appropriate security measures once we have received your Personal Information, the transmission of data over the internet (including by e-mail) is never completely secure. We endeavour to protect Personal Information, but we cannot guarantee the security of data transmitted to us or by us over the internet.

18. Data Breach Notification

  • In the event of a breach that compromises the security, confidentiality, or integrity of your personal data and is likely to result in a real risk of harm to you, we undertake to notify the ODPC within seventy-two (72) hours of becoming aware of the breach, and notify the affected data subjects within a reasonably practicable time, unless doing so is not possible due to the volume of affected individuals (in which case a public notice will be used instead).
  • Notifications will, where applicable, include the nature of the breach, the data affected, likely consequences, and measures taken or proposed to address it.
  • If you suspect a data breach involving your personal data, please report it immediately to us through the following channel, marked "Data Breach Report."

Email: amwega@nse.co.ke

19. Information retention

  • We retain Personal Information only for as long as necessary to fulfil the purposes for which it was collected in accordance with the following retention schedule;

 

Data Category

Retention Period

i. Financial/ Tax/ Transaction

Five years from the end of the reporting period

ii. Employee/payroll records

Minimum of five years and three years after termination

iii. Membership records (active members)

Duration of the membership

iv. Membership records (former members)

6 years after membership ends

v. Event registrations and attendee lists

3-7 years

vi. Marketing Data

Until consent is withdrawn

vii. Website/ Analytics Data

14 – 26 months

viii. Contractual and dispute-related correspondence

Six years

20. Your rights

  • You have various rights in relation to the processing of your Personal Information. You have a right to:
    • withdraw consent to processing at any time;
    • receive certain information about the Controller's Processing activities;
    • request access to your Personal Information that we hold;
    • prevent our use of your Personal Information for direct marketing purposes. You may click "unsubscribe" in any marketing email, reply “stop” to any marketing SMS or contact us directly. Opting out of marketing does not withdraw consent for other processing activities, and you may continue to receive non-marketing communications necessary for the services you use.
    • ask us to erase Personal Information if it is no longer necessary in relation to the purposes for which it was collected or processed or to rectify inaccurate data or to complete incomplete data;
    • restrict processing in specific circumstances;
    • challenge processing which has been justified on the basis of our legitimate interests or in the public interest;
    • request a copy of an agreement under which your Personal Information is transferred outside of Kenya;
    • object to decisions based solely on Automated Processing, including profiling (ADM);
    • prevent processing that is likely to cause damage or distress to the Data Subject or anyone else;
    • be notified of a data breach which is likely to result in high risk to their rights and freedoms;
    • make a complaint to the supervisory authority;
    • in limited circumstances, receive or ask for your Personal Information to be transferred to a third party in a structured, commonly used and machine-readable format;
  • To help us maintain the accuracy of your Personal Information, please contact us by using the “Contact information” section below if any of your personal details have changed.
  • If you are unsatisfied with the way in which we have handled your Personal Information or any privacy query or request that you have raised to us, please contact us by using the “Contact information” section below or you have a right to complain to the data protection authority.

21.  Verification of Personal Information requests

  • For certain Personal Information requests, we must first verify your identity before processing your request. To do so, we may ask you to provide us with your full name, contact information, and relationship to RAK. Depending on your request, we may ask you to provide additional information. Once we receive this information, we will then review it and determine whether we are able to match it to the information at the RAK about you to verify your identity.

22.  Third party requests

  • If you are submitting a Personal Information request on behalf of someone other than yourself, please contact us by using the “Contact information” section below and include proof that you are authorized to make the request. This may be in the form of a written authorization signed by the person whom you are acting on behalf of or a valid power of attorney.

23.  Contact information

24.  Changes to this Privacy Notice

  • We may modify or amend this Privacy Notice from time to time. To let you know when we make changes to this Privacy Notice, we will amend the date at the top of this page. The new, modified, or amended Privacy Notice will apply from that revision date. Therefore, we encourage you to periodically review this Privacy Notice to be informed about how we are protecting your information.
  • This Privacy Notice was written in English. To the extent any translated version of this Privacy Notice conflicts with the English version, the English version supersedes.