Privacy notice

DRAFT for KNCCI review. This notice follows the Kenya Data Protection Act, 2019 and its 2021 Regulations. KNCCI must check and approve it, add the Data Protection Officer's details and the registration number with the Office of the Data Protection Commissioner, before it replaces this draft.

1. Who we are

The Kenya National Chamber of Commerce and Industry (KNCCI), Telkom Plaza-Orange House, 2nd Floor, Ralph Bunche Road, P.O. Box 47024-00100, Nairobi, is the data controller for the personal data described here. Our county chapters process data on KNCCI's behalf.

2. What we collect

• Newsletter: your email address, optionally your phone number, the chapter you chose, and the date and version of the notice you accepted.
• Membership: the details in your application (business, contact people, KRA PIN, registration documents), invoices and payments, and your membership history.
• Website: technical data needed to run the site securely (for example a session cookie). We keep a coded fingerprint of your IP address for one day to stop abuse of our forms, never the address itself.

3. Why we use it and our lawful basis

• To send news and event invitations, on the basis of your consent, which you give by confirming the email we send you.
• To process membership applications, invoices, payments and certificates, to perform our membership agreement with you.
• To meet legal duties such as tax and accounting records.
• To protect the website and our members from fraud and abuse, in our legitimate interest.

4. Who we share it with

Only with the KNCCI chapter concerned, with service providers who process data for us under contract (for example hosting and email), and with authorities when the law requires it. We do not sell personal data. If data is transferred outside Kenya, we do so only as sections 48 to 50 of the Act allow, with appropriate safeguards.

5. How long we keep it

Newsletter data until you unsubscribe, then only a record that you unsubscribed. Membership and financial records for as long as the law requires (usually seven years after the membership ends). Form-abuse fingerprints for one day.

6. Your rights

Under sections 26 and 38 of the Act you may ask to be informed how your data is used, to see it, to have it corrected or deleted, to object to its use, to withdraw your consent at any time (every newsletter has an unsubscribe link), and to receive it in a portable format. Write to info@kenyachamber.or.ke. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

7. Security

Access to personal data is limited to authorised KNCCI staff, and each chapter sees only its own records.

8. Changes

When this notice changes we update its version. Consents are recorded against the version you accepted.