• Beneficial owner means a person or entity that enjoys the benefits of ownership of a company, even though the legal title may be held by another person or organization.

• Data commissioner means the authority established under section 5 of the DPA to oversee and implement data protection laws in Kenya.

• Data controller means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal information.

• Data processor means a natural or legal person, public authority, agency or other body which processes personal information on behalf of the data controller.

• Data subject means an identified or identifiable natural person who is the subject of personal information whether it is stored electronically, on paper or on other materials.

• DPA means the Data Protection Act of Kenya, 2019.

• Company refers to our clients who we maintain a register of their shareholders and beneficial owners (if any).

• Personal Information refers to information or a combination of information that could reasonably allow an individual to be identified. This includes but is not limited to; i) Personal details such as names, identification/passport numbers. ii) Contact information such as addresses, telephone numbers and emails. iii) Shareholder records such as numbers and details of shares held, share purchases and disposals, dividend entitlements and payments, your votes. iv) Correspondence information: your inquiries, complaints, and other communications with you. v) Voice and/or recordings of shareholder meetings.

• Stockbrokers means a professional individual or firm that facilitates the buying and selling of securities, such as shares and bonds, on behalf of their client.

• Professional Advisors is a professional individual or firm that offers advice or consultancy services to a company and may include but is not limited to auditors, accountants, legal specialist, bankers, insurers etc.

Our function as shares registrars is to maintain a register of shareholders of a Company which should contain information about the Company's shareholders and beneficial owners, if any. We therefore obtain the personal information from:

• The Company.
• Directly from the shareholders.
• Through third parties such as stockbrokers.
• Through information provided on our website.

Furthermore, we will only collect personal information that is necessary for the purpose stated at the time of collection or as required by law.

We collect and use personal information only for specified, explicit and legitimate purposes including:

• To maintain the register of shareholders and beneficial owners according to the law and discharge our duties as shares registrars in accordance with the terms of our service contracts.
• To facilitate payment of dividends.
• To send statutory communications or notices to shareholders on behalf of the Company and only on specific instructions.
• To personalize shareholders experience. We may use information in the aggregate to understand how our users as a group use our services and resources.
• To improve our services and website. We continually strive to improve our services based on the information and feedback we receive from you.
• To respond to questions, feedback and other request.

All information we hold is stored securely in a limited access and audited system. We take appropriate technological, legal as well as organizational measures to process and safeguard your personal information in line with best practices.

Image Registrars Limited is committed to protecting and safeguarding the personal information of our customers, employees, and any other individuals who entrust us with their information. In line with this commitment, we have implemented strict technological, legal and organizational measures to ensure the security and confidentiality of personal information.

As a shares registrar one of our roles is to keep and maintain the register and information of members/shareholders as well as beneficial owners (if any) of various companies. We will therefore share the information with the Company, its professional advisers (as instructed from time by the Company), and in order to comply with legal and regulatory requirements, in accordance with our service contracts with the Company.

Image Registrars will only transfer personal information out of Kenya only when it has:

• Proof of appropriate measures for security and protection of the personal information.
• Consent from the data subject and the proof provided to the Data Protection Commissioner;
• Confirmed appropriate safeguards have been taken to ensure the jurisdictions which the personal information is being transferred have commensurate data protection laws in line the DPA.

• To be informed of the use to which your personal information is to be put.
• To access and update your personal information in our custody.
• To object to the processing of all or part of your personal information.
• To request the correction of false or misleading information.
• To delete false or misleading data about yourself.
• To appropriate security safeguards in the storage, transfer and processing of personal information.
• To withdraw consent to the processing of your personal information. However, this shall not affect the lawfulness of processing based on prior consent before its withdrawal.

This policy will be reviewed and updated from time to time to ensure compliance with applicable laws, technology and best practices in Kenya. We encourage you to review this policy periodically for any updates. The date of the last revision will be indicated at the bottom of this page. If you have any additional questions about the security or retention of personal information, you can contact us at info@image.co.ke.