Data Protection Policy

1. Introduction:: In order to ensure the high level of data protection and the lawful processing of personal data, Gladys Technologies Limited (hereafter referred to as the “Company”) has drawn the Data Protection Policy based on the principles of data protection and the processing of personal data. This Policy refers to our commitment to treat information of customers, employees, stakeholders and other third parties with the utmost care and confidentiality. With this policy, we ensure that we gather, store and handle data fairly, transparently and with respect towards individual rights. This Data Protection Policy defines the principles and methods in which personal data is processed in the company.
1.1. Scope: This part of the rules and guidelines on data protection and the legal conditions that must be satisfied in relation to the obtaining, handling, processing, storage, transportation and destruction of personal information. The Data Protection Officer is responsible for ensuring compliance with the Laws and with this Policy.
1.2. Definitions: Personal Data: Any information that directly or indirectly identifies an individual.; Data Controller: means a person/organization/department who determines the purposes for which and the manner in which any personal data are, or are to be, processed. For the purpose of this Data Protection Policy, we are a Data Controller of your data.; Data Processor: the natural or legal person, public authority, service or other body which processes personal data for the account of the data controller.; Data subject: is any living individual who is the subject of Personal Data.; Processing: An operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of the data.; Third Party: An external organization with which the Company conducts business and is also authorized to, under the direct authority of the Company to process the personal data of Gladys Technologies Limited customers and shall include consultants and contractors.; Subscriber: A person or entity who has subscriber to the terms and conditions for use of Gladys wallet service.
2. Data Protection Principles
2.1. Lawfulness, fairness and transparency: Gladys Technologies respects the data sovereignty of each of our stakeholders being our clients employees, affiliates, partners and third parties. As such we shall, at the point of data collections, explicitly state the purpose for which that data is being collected. The terms and conditions for the use of any Gladys Products shall state categorically what we will collect and what they shall be used for. We shall mandate that we acquire all Customer consent for use of the data. We will uphold the concept of fairness in the processing of customer data means you won’t mishandle or misuse the data you collect.; Transparency is inherently linked to fairness: Being clear, open, and honest with data subjects about who you are, and why and how you’re processing their personal data is the definition of transparency. By following it, you act fairly towards your data subjects.
2.2. Purpose limitation: As a Company Gladys Technologies shall ensure that all personal data collected is collected only for specified, explicit and legitimate purposes and shall not be processed in a way that is not compatible with those purposes. The purpose for collection of the Customer’s data shall be to enable payment services through our Gladys Digital wallet.
2.3. Data minimisation: We shall uphold the principle of data minimization and only collect only that information necessary to enable payment processing and verify the authenticity of the account owner as per our service terms. Any further use of data not provided in this policy or the terms and condition for the use of the service shall mandate that the Company request for consent on collection for processing.; In the same spirit, the Company shall not keep personal data for longer than it requires to offer our customers the services they require. The Company shall store all personal and transactional data for a period of seven years or any other period as required by law. The foregoing notwithstanding, all Customers shall have the right to seek erasure when they no longer need the services subject to compliance with company policy. There are instances when the Company may keep personal data for longer such as for public interest archiving, scientific or historical research, or statistical purposes. The Company shall ensure that they erase and anonymize personal data when deleting or erasing the data where it becomes irrelevant, excessive, inaccurate or out of date.
2.4. Accuracy: The Company shall take reasonable steps to ensure personal data is accurate. The Company shall perform a records review exercise based on a customer’s category of risk. See Risk Categorisation document; Where necessary for the lawful basis on which data is processed, the Company shall take steps shall be put in place to ensure that personal data is kept up to date.; Where the personal data in the Company’s data that is inaccurate, considering the purposes for their processing, the Company shall notify the subscriber or data subject for rectification and where the request is not honored within a period of thirty days, the company shall be deleted without any delay.; The Company shall put in place data digital rectification process, that shall enable subscribers to place a request for rectification of information. All requests for rectification raised by Subscribers shall be resolved within seven days.; Client wallets shall be updated real time to reflect the transactions.
2.5. Accountability: The Company shall be responsible in how it uses personal data. The company shall place appropriate measures and records in place to be able to demonstrate security of data and compliance with data protection laws.
3. Rights and Responsibilities
3.1. Customers rights: 3.1.1. Right of access: As a customer shall have the right to access Personal Data about them at any time upon request to the company.; 3.1.2. Right to rectification/erasure: A customer has the right to request amendment or modification of their personal data, where it is inaccurate, incomplete, erroneous or obsolete, and can demand that it be deleted, corrected or supplemented. A customer or data subject shall have the right to request the deletion or removal of Personal Data where there is no compelling reason for us to keep using it. Upon request, Customers and Data Subjects have the right to obtain from the Company the erasure of its personal data. As a Data Controller, the Company shall take necessary actions (including technical measures) to inform the third-parties who use or process that data to comply with the request. The right to erasure shall be subject to exceptions including where we are required to hold the data by law or where you have failed to make good of payment obligations owed to us. We shall keep Personal data for no longer than is necessary for the purposes for which the personal data is processed.; 3.1.3. Right to object: Our Customers have the right to object to the processing of their data, and this must be taken into account if the protection of his/her interests takes precedence over the interest of the data controller owing to a particular personal situation. This shall however not apply if a legal provision requires the data to be processed or where a loan has already been disbursed to the customer and the same has not been paid up. Objections to processing of data shall be handled within five (5) days of receipt of request.; 3.1.4. Right to withdraw consent: All customers and Data subjects shall have the right to withdraw consent to the processing of their personal information.; 3.1.5. Right to complain: The data subject and our customers have the right to file a complaint with the Regulator on the belief of misappropriation of their data contrary to the Data Protection Regulations.
3.2. Company’s responsibilities: A. The Company shall have the following responsibilities to our customers with regard to data protection;; 3.2.1. Place appropriate technical measures to guarantee safety and protection of customer data;; 3.2.2. Ensuring our payment platforms meet the required security standards;; 3.2.3. To obtain all our customer’s consent to process their data;; 3.2.4. To ensure third party service providers confirm their acceptance to this policy or employ proper data protection strategies in compliance with the law;; 3.2.5. To transfer your data to any other person under the Client’s direction;; 3.2.6. To conduct team-specific training for our employees that incorporates unique data protection requirements and addresses specific risk factors;; 3.2.7. To establish clear procedures for reporting privacy breaches or data misuse and alert of our clients when the same has occurred;; 3.2.8. To notify all affected client of any breaches with regards to their personal data; and; 3.2.9. To ensure strict compliance to all data protection Act.; B. The DCO’s responsibilities include:; i. Informing and advising the Company and its employees about their obligations to comply with the Data Protection laws, and best practice procedures.; ii. Monitoring compliance with the data protection laws, including managing internal data protection activities, advise on data protection impact assessments;; iii. train staff and conduct internal audits.; iv. Acting as the first point of contact for regulatory authorities and for data subjects whose data is processed (employees, customers etc).
3.3. Documentation: Where the Company is a controller for personal data, they shall register with the ODPC. Further to this the Company shall maintain evidentiary documentation in a manner consistent with laws consent was acquired from the Subscribers and other data Subjects.; Where the Company is a processor for personal data, they shall maintain documentation in a manner consistent with law confirming that the Data Controllers have acquired consent for the use of personal data. They shall maintain Data Processing Agreements with the controllers for such arrangements. Where the company processes special category or information, the company will employ special technical and other infrastructure to ensure the data is well protected.; All requests by data subjects in accordance with their rights mentioned above shall be well documented and stored for a period of seven years from date of request.; The Company shall acquire disclosure consents from their company and shall have standard forms from their parties confirming that the partners have acquired the consent s from their consumers to process the data.
3.4 Transmission of Data: Transmission of personal data to recipients outside the Company or to third parties is subject to the authorization requirements for processing this policy. The Company shall mandate that data recipients be required to use the data only for the defined purposes and in compliance to this policy. The company shall acquire consent for transmission of data to third parties through the terms and conditions. When we do collect personal data, it may be transferred to partners and affiliate companies in countries other than Kenya. Whenever we do so, we require that our partners ensure a level of protection of such data comparable to that provided for under Kenyan law. We mandate that our affiliates and partners enhance their platforms to guarantee protection of our customer’s date. Further to these, we review these security mechanisms every year to confirm that they are updated with changing technology and customer needs.
4. Data Protection Officer: To ensure Compliance with Data Protection laws in Kenya and this policy, the Company shall appoint a Data Protection Officer (DPO). The DPO’s responsibility shall be to monitor internal compliance, inform and advise on the Company’s data protection obligations, provide advice regarding Data Protection Impact Assessments (DPIAs) and act as a contact point for data subjects and the Office of the Data Protection Commissioner (ODPC).; The DPO shall be independent, an expert in data protection, adequately resourced, and report to the Board. The DPO should have the authority shall have immediate access to all data including viewing rights to all systems. Further to this they shall have power to investigate data issues and breaches. All employees are mandated to provide information in reply to DPOs queries and must do so within five days. The DPO may mandate a shorter submission period.
5. Lawful Basis for Processing Data: All data processed by the Company shall be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests. The sole goal of these processing operations is to enable the Company to provide and optimise its payment services and services ancillary to its business activities. Ancillary activities shall be those to support payment processing business, enable due diligence for our customers, security services to enable safe and secure platforms, conducting marketing research exclusively for Company use.; Gladys Technologies takes cognizance of the lawful basis of processing personal data. They shall develop customized engagement terms for all its products which shall be the legal basis for which the authority and consent to collect and process personal data shall be derived from. All contracts between the Company and its Customers shall adhere to this policy on issues of Data protection and Processing of personal data. All Company mobile applications shall contain terms and conditions that shall be the binding contract between the subscribers and the company. The Company shall ensure that clients using its other products shall also subscribe to terms and conditions between the parties.; Where consent is relied upon as a lawful basis for processing data, Company shall record the evidence of the consent and the same shall be stored with the Client’s personal data records. The company has implemented clear systems to allow an opt out option for clients who revoke their consent or require erasure/ deletion of their accounts subject to completion of a client’s pending obligations to the Company. Where consent is withdrawn by a Gladys Subscriber, then the same shall be deleted from the system within fourteen (14) days. The requirement for deletion shall only be subject to the Client’s deletion policies.; The Subscriber shall have the ultimate authority with regard to their data and where they seek to withdraw the consent then the Company shall implement the same. The Company shall ensure that they place digital mechanisms on the Gladys mobile App/wallet to ensure that a customer can make a request for restriction/ objection to the processing of personal Information. The same shall also be implement to allow for a subscriber to raise an objection to messages/marketing etc.
6. Security: The Company shall ensure that personal data is stored securely using modern software that is kept- up-to-date. Access to personal data shall be limited to personnel who need access and appropriate security should be in place to avoid unauthorised sharing of information. When personal data is deleted the company shall ensure that this is done safely and that such that the data is irrecoverable.; The Board shall ensure that the company put in place appropriate back-up and disaster recovery solutions shall be in place.; In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data, the Company shall promptly assess the risk to customer rights and freedoms and if appropriate report this breach.
7. Compliance and Reporting: All principles described in this policy must be strictly followed. A breach of data protection guidelines will invoke disciplinary and possibly legal action.
8. Training and Awareness: The company shall conduct a mandatory annual training on the requirements of this Policy.; It shall also be the responsibility of the Human Resource Manager to ensure that the onboarding procedures entail a Data Compliance Training session where new employees are taken though through the Data Protection Compliance induction training. The Data Protection Officer must sign a consent form confirming that all new employees have been sufficiently trained on Data Protection and their roles regarding the same.; The Data Protection officer shall include the members trained annually in his annual compliance report.