This Notice only applies to residents of any member state of the European Union
General Data Protection Regulation (GDPR)
Article 13 of Regulation EU 2016/679
This Privacy Notice provides mandatory information as required under Articles 13 and 14 of the European General Data Protection Regulation (GDPR) regarding the transparency of personal data processing. Definitions of certain terms within this notice are explained in the Appendix.
Securepoint is the Data Controller of the information you, as a Data Subject, provide to us.
In these circumstances Securepoint will be acting under a ‘Legitimate Interest’ to legally process the data for the provision to the Data Subject of information regarding Securepoint’ business, services and products or sale and purchase.
As a Data Subject you have rights under the GDPR set out below. Securepoint will always fully respect your rights regarding the processing of your Personal Data, and has provided below the details of the person to contact if you have any concerns or questions regarding how we process your data, or if you wish to exercise any rights you have under the GDPR.
The identity and contact details for the Data Protection Officer within Securepoint are as follows:
Chris Otieno
Address: 4th Floor Dereshe Towers, Murang`a Road, Ngara, Nairobi Kenya
Email Address: privacy@securepoint.co.ke
Securepoint has adopted the following principles to govern its collection and processing of Personal Data:
Personal Data shall be processed lawfully, fairly, and in a transparent manner.
Personal Data collected will only be those specifically required for the purposes set out in Section 2 above. Such data will only be processed for those purposes.
Personal Data shall only be retained for as long as it is required to fulfil contractual requirements, or to develop statistics for Securepoint’s benefit.
Personal Data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are collected and/or processed. Personal Data shall be accurate and, where necessary, kept up to date.
The Data Subject has the right to request from Securepoint access to and rectification or erasure of his/her Personal Data, to object to or request restriction of processing concerning the data, or to the right to data portability. In each case such a request must be put in writing as in Section 3 above.
The Data Subject has the right to make a complaint directly to a supervisory authority within his/her own country.
Securepoint’s Data Protection compliance is supervised by:
Chris Otieno
Address: 4th Floor Dereshe Towers, Murang`a Road, Ngara, Nairobi Kenya
Email Address: privacy@securepoint.co.ke
Personal Data shall only be processed based on the legal basis explained in Section 2 above, except where such interests are overridden by the fundamental rights and freedoms of the Data Subject which will always take precedent. If the Data Subject has provided specific additional consent to the processing, then such consent may be withdrawn at any time (but may then result in an inability to fulfil travel requirements).
Securepoint will not use Personal Data for any monitoring or profiling activity or process, and will not adopt any automated decision-making processes.
For the purposes set out in Section 2 above, Securepoint will in most cases deem it necessary to process Personal Data via a third party (these will include but are not limited to credit agencies, website or database hosting companies, address list hosting companies, email service providers, analytics companies, distribution companies, fulfillment companies, and other similar service providers). Personal Data shall only be transferred to, or processed by, third party companies where such companies are necessary for the fulfilment of the aforementioned work.
In order to provide its services, Securepoint may need to transfer Data Subject’s information from their respective countries of residence to another country in the usual course of its business. By dealing with Securepoint and submitting such personal information, the Data Subject agrees to the transfer, storage, and/or processing of their personal information outside of their countries of residence as set out below.
Transferring outside of the EEA
Securepoint may transfer personal information of Data Subjects to third party data processors located in countries outside of the European Economic Area (“EEA”). Such transfer will not be made without consent of the Data Subject.
Securepoint only transfers personal information of Data Subjects to those third parties where Securepoint can be sure that it can protect the privacy and rights of Data Subjects, for example the third party is located in a country which the EU has deemed to have adequate data protection laws in place, where that third party is certified on the EU-US Privacy Shield or where Securepoint has a contract in place with that third party which includes the European Commission’s standard data protection clauses. Additionally, Personal Data shall not be transferred to a country or territory outside the EEA unless the transfer is made to satisfy the Legitimate Interest of Securepoint in regard to its contractual arrangements with its clients.
Appendix – Definitions of certain terms referred to above:
“Personal Data”
means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. (Article 4 of the GDPR)
“Processing”
means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, erasure or destruction. (Article 4 of the GDPR)
“Legal Basis for Processing”
refers to at least one of the following being applicable:
Consent: a Data Subject has given clear consent for the processing of his/her personal data for a specific purpose.
Contract: the processing is necessary for compliance with a contract.
Legal obligation: the processing is necessary to comply with the law (not including contractual obligations).
Vital interests: the processing is necessary to protect someone’s life.
Public task: the processing is necessary to perform a task in the public interest, and the task or function has a clear basis in law.
Legitimate interests: the processing is necessary for the legitimate interests of the Data Controller unless there is a good reason to protect a Data Subject’s Personal Data which overrides those legitimate interests.
(Article 6 of the GDPR)
“Data Controller”
means the person or company that determines the purposes and means of processing Personal Data. (Article 4 of the GDPR)
“Data Processor”
means a natural or legal person, public authority, agency or any other body which processes Personal Data on behalf of the Data Controller. (Article 4 of the GDPR)
“Data Subject Rights”
refer to the eight rights to which each Data Subject is entitled. These are: