SCHEDULE 1

SHAREHUB NOMINEES LIMITED DATA PRIVACY NOTICE FOR SHAREHUB USERS

Last Updated: 22^nd March 2020

Overview

Your privacy is important to us. We respect the privacy rights of all individuals and we are committed to handling personal data responsibly and in accordance with all applicable laws. This privacy notice, together with the Addenda and other notices provided at the time of data collection, explain what personal data ShareHub Nominees Limited collects about you, how we use this data, and your rights to this data.

Please note that this notice applies to the handling of your personal data as a ShareHub User. Nothing in this notice should be construed to interfere with ShareHub Nominees Limited's ability to process a ShareHub User's data for purposes of complying with its legal obligations, or for investigating alleged misconduct or violations of the law, subject to compliance with applicable legal requirements.

ShareHub Nominees Limited's processing of personal data is in all cases subject to the requirements of the Data Protection Act No. 24 of 2019. To the extent this notice conflicts with the Data Protection Act No. 24 of 2019 and any applicable laws, such laws shall apply.

Personal Data that We Process (this may include data that you provide to us, that we collect about you, or that we assign to you.)

We collect, use, and maintain (collectively 'process') different types of personal data about you in in the operation of our business. As a ShareHub User, we process personal data about you primarily for managing our relationship with you in respect to the Services.

The data we process is limited to the following:

Name and contact data. Your first and last name, personal email address, postal address, phone number, photo, beneficiary and emergency contact details, and other similar contact data.

National identifiers. Your national ID/passport, residency and work permit status or other taxpayer/government identification number.

Employment details. Your job title/position, office location, employment contract, offer letter, hire date, termination date, performance history and disciplinary records, leave of absence, sick time, and vacation/holiday records.

Spouse/partner and dependents' information. Your spouse and dependents' first and last names, dates of birth, and contact details.

Background information. Academic and professional qualifications, education, CV/Resume and criminal records data (utilized for background check and vetting purposes where permissible and in accordance with applicable law and consultation requirements).

Financial information. Credit Score. We may also collect personal data about you from third parties or public sources as needed to support the performance of the Services. For example, during the course of the Services, we may collect information from a Credit Reference Bureau (CRB) for purposes of ascertaining your credit risk.

In some limited circumstances, we may collect personal data for research purposes or other non-Service related purpose, with your consent.

Why We Process Personal Data:

We collect your personal data for the purposes set out below. Failure to provide your personal data when requested may prevent us from being able to carry out these tasks and/or comply with our legal obligations.

1. To administer the Services as set out under this Agreement

We collect and use your personal data primarily for the purpose of managing our working relationship with you, and to fulfill our obligations under this Agreement including opening of a ShareHub Account, purchasing, selling and borrowing shares for purchase as further prescribed under this Agreement.

2. Other overriding and legitimate business purposes

We also may collect and use your personal data when it is necessary for other legitimate purposes, such as marketing and research related activities Provided Always That confidential information of the ShareHub User of his account is not provided or is suitably modified so as not be recognized as belonging or attributable to the ShareHub User without the use of additional information and such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable ShareHub User.

We may also use and collect your information for business practices including but not limited to quality control, training and ensuring effective systems operations in addition to management of network and information system security and business operations.

3. Legally required purposes

We also may use your personal data when we consider it necessary for complying with laws and regulations, including collecting and disclosing personal data as required by law (e.g., Know Your Customer requirements, tax, anti-corruption, anti-money laundering,), under judicial authorization, or to exercise or defend the legal rights of ShareHub Nominees Limited.

We may also share your information with our lawyers, auditors or other professional advisors in connection with any legal or audit proceedings.

Change of purpose

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need it for another purpose that is compatible with the original purpose and there is legal basis for the further processing. 

How and Why We Share Personal Data

ShareHub Nominees Limited will only share your personal data with those who have a legitimate need for it. Whenever we permit a third party to access personal data, we will make sure the data is used in a manner consistent with this notice (and any applicable internal data handling guidelines consistent with the sensitivity and classification of the data). Your personal data may be shared with our subsidiaries and affiliates and other third parties, including service providers, for legitimate purposes as follows:

1. In order to carry out the uses of personal data described above (See section titled: Why We Process Personal Data);
2. To enable third parties to provide services to us. Categories of recipients of data would include, data hosting service providers, system maintenance support service providers, insurance providers, tax service providers;
3. To comply with our legal obligations, regulations or contracts, or to respond to a court order, administrative or judicial process, such as a subpoena, government audit or search warrant. Categories of recipients would include counter-parties to contracts, judicial and governmental bodies;
4. In response to lawful requests by public authorities (such as national security or law enforcement);
5. To seek legal advice from external lawyers and advice from other professional advisers such as accountants, management consultants, etc.;
6. As necessary to establish, exercise or defend against potential, threatened or actual litigation (such as adverse parties in litigation);
7. In connection with the sale, assignment or other transfer of all or part of our business (such as a potential purchaser and its legal / professional advisers); or
8. Otherwise in accordance with your consent.

Please note that where legal requirements limit the sharing of your data, ShareHub Nominees Limited will respect such requirements. 

Your Rights to Your Personal Information

In addition to the above, you may have certain rights under the Data Protection Act No.24 of 2019. Please see the Addendum to this notice. 

Other Important Privacy Information

Security of Your Personal Data

ShareHub Nominees Limited is committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure. For example, we store the personal data you provide on computer servers with limited access that are located in controlled facilities, and, when we transmit certain highly confidential or sensitive personal information, we protect it through the use of encryption.

Where We Store and Process Personal Data

ShareHub Nominees Limited may share your data with third party service providers outside of Kenya such as data hosting service providers and system maintenance service providers.

When we transfer your personal data to a different country, for hosting or processing purposes, we will ensure that adequate measures and safeguards are put in place prior to this transfer of such data and that such data is not transferred to jurisdictions without commensurate data protection laws in accordance with the Data Protection Act No. 24 of 2019 and all other applicable laws.

Our Retention of Personal Data

Personal data will be stored according to applicable laws or regulatory requirements and kept as long as is necessary to fulfill the purposes for which the personal data was collected.

Changes to this Privacy Notice

We may occasionally update this privacy notice. When we do, we will revise the "last updated" date at the top of the privacy notice. If there are material changes to this notice or in how ShareHub Nominees Limited will use your personal data, we will use reasonable efforts to notify you either by prominently posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to periodically review this privacy statement on ShareHub to learn how ShareHub Nominees Limited is protecting your personal data.

How to Contact Us

For copies of additional privacy documents mentioned in this notice, or if you have a privacy concern or question related to this notice, please contact

ShareHub Nominees Limited

P.O. Box 8484-00100, Nairobi, Kenya

Telephone number: +254 20 223 0518

E-mail address: info@sharehub.co.ke

ADDENDUM:

Data Subjects Rights, Consent and change of details.

In addition to the information shared above, as a data subject, you have certain rights as specified in this addendum pursuant to the provisions of the Data Protection Act No. 24 of 2019.

We may update the privacy notice and addendum at any time but if we do so, we will provide you with an updated copy of both as soon as reasonably practical.

It is important that you read and retain the privacy notice and addendum, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.

We will comply with all the aforementioned data protection laws in place and we are obliged to ensure the personal information we hold about you must be:

1. processed in accordance with your right to privacy as a data subject;
2. processed lawfully, fairly and in a transparent manner;
3. collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes;
4. adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
5. collected only where a valid explanation is provided whenever information relating to family or private affairs is required;
6. accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay;
7. kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected; and
8. not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject

You may exercise the below-listed rights regarding the processing of your personal data by means of submitting a request to ShareHub Nominees Limited. Upon your submission of a request relating to your rights as a data subject, , such request shall be finalized by the ShareHub Nominees Limited free of charge, at the latest within thirty days, depending on the nature of the request..

In this respect, ShareHub Users are entitled to the following rights;

• to be informed of the use to which their personal data is to be put;
• to access and ascertain their personal data that is in the custody of ShareHub Nominees Limited or any third party with whom ShareHub Nominees Limited has shared data;
• to object or restrict to the processing of all or part of their personal data by ShareHub Nominees Limited or any third party with whom ShareHub Nominees Limited has shared data;
• to have false or misleading data about them corrected;
• to have false or misleading data about them deleted;
• to be notified of the purpose for which the personal data is collected, the categories of the intended recipients of the data, the contacts of the data controller or processor and to be informed on whether any other entity may receive their collected personal data;
• to be informed whether the data collection exercise is made pursuant to any law and whether such collection is voluntary or involuntary;
• to be informed of the consequence of the data subject not providing all or any of the requested data
• Request for an explanation on the processing of data and the outcome of such data
• to be provided with a description of the technical and organizational security measures taken to ensure the integrity and confidentiality of the data;

In collecting or processing personal data, ShareHub Nominees Limited will ensure that data collected is complete, accurate, up to date and not misleading having regard to the purpose for the collection or processing of the personal data.

Updating your details

If any of the information that you have provided to ShareHub Nominees Limited changes, for example if you change your email address, name or mobile phone number or if you wish to delete your ShareHub account, please let us know of the same by sending an e-mail to info@sharehub.co.ke

Consent

If ShareHub Nominees Limited changes its data privacy notice, we will post the changes on the ShareHub application, so that you may be aware of the information we collect and how we use it at all times. We will also e-mail you should we make any changes so that you may consent to our use of your information in that way. Continued use of the service will signify that you agree to any such changes.

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact info@sharehub.co.ke. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.