Document Control Revision History

Title: Car and General Kenya Plc – Privacy Policy

Author: Legal and Compliance Department

Date Created: May 2024

Custodian: Legal and Compliance Department

Introduction

We are committed to ensuring we respect your right to privacy and shall ensure all necessary measures are implemented to protect personal information you entrust to us. This policy describes the practices that Car and General Kenya Plc (C&G, “we,” “us,” or “our”) follow when handling personal information that we collect or receive from you during business operations. It describes how we treat personal information through our services, products, websites, user applications, and other interactions.

Definition of Personal Information

Personal Information refers to any data relating to an identified or identifiable person. This includes identifiers such as names, identification numbers, and online identifiers or other data that can identify a person.

Anonymized information and corporate information (e.g., company names and addresses) are not considered personal data under this policy.

Scope of the Privacy Policy

• Employees, contractors, or consultants acting on behalf of C&G
• Customers subscribing to or using C&G products and services
• Agents, dealers, and merchants engaged with C&G
• Visitors accessing C&G premises
• Suppliers with executed contracts with C&G

1. Personal Data We Collect

• Basic personal details (e.g., name, ID, job title)
• Contact data (e.g., phone number, email, address)
• Financial data (e.g., payment details, bank accounts)
• Demographic data (e.g., address, interests)
• Website usage and cookies data
• Investor-related personal data, including special categories of data
• Identification data (e.g., passport, utility bills, KYC documents)
• Recruitment-related data (e.g., CVs, education, employment history)
• Event registration or attendance data

2. How We Collect Personal Information

• Directly from you (e.g., emails, forms, or website registrations)
• Through monitoring interactions with our websites and services
• From third parties (e.g., recruitment agencies, KYC sources)
• Publicly available sources (e.g., LinkedIn)

3. Use of Personal Information

We use personal data only under applicable laws:

• Contract performance: To fulfill contracts with you.
• Legal obligation: To comply with legal requirements.
• Legitimate interests: To further legitimate business interests while respecting your data rights.
• Legal claims: To pursue or defend legal claims.
• Consent: Where you explicitly consent to processing your data.

4. Sharing Your Personal Information

We may share your personal data with:

• Dealers and authorized service centers
• Tax authorities, regulators, and law enforcement
• Court and legal entities for legal proceedings
• Anti-fraud and credit reference agencies
• Debt collection agencies
• Professional advisors, bankers, and auditors
• Insurers and insurance brokers
• External technology and cloud service providers
• Survey agencies conducting research on our behalf

5. International Data Transfers

We may transfer personal data outside Kenya to trusted partners, ensuring all necessary safeguards are in place in compliance with applicable data protection laws.

6. Retention of Personal Information

We retain personal data as long as needed for business or legal requirements. Data is deleted once it no longer serves its purpose, unless required by law to retain it longer.

7. Safeguarding and Protection of Information

We implement security measures to protect your data from unauthorized access or loss. This includes secure storage and restricted access. Users are responsible for safeguarding their passwords and complying with security procedures.

8. Your Data Privacy Rights

You have the following rights:

• Right to be informed: Receive transparent information on data processing.
• Right to access: Request access to personal data we hold.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure: Request deletion of data under certain conditions.
• Right to restrict processing: Limit data processing where applicable.
• Right to data portability: Request transfer of your data.
• Right to withdraw consent: Revoke consent at any time.
• Right to object: Object to certain processing activities.

9. Direct Marketing

You may opt out of marketing communications at any time by adjusting your preferences on our website or contacting us directly.

10. Use of Cookies

We use cookies to personalize your experience on our website. For more information, please read our cookie policy.

11. Hyperlinks

Our website contains hyperlinks to third-party websites. We are not responsible for the content or privacy practices of these websites.

12. Right to Lodge a Complaint

If you have concerns about your data, please contact us at info@cargen.com.

13. Applicable & Governing Law

This Privacy Notice is governed by the laws of the Republic of Kenya.

14. Amendments to This Notice

We may update this Privacy Notice periodically. Please review it regularly to stay informed.