Kenya Trade Network Agency Data Privacy Statement
PRIVACY STATEMENT
This Privacy Statement provides information on how and why the Kenya Trade Network Agency (KenTrade) collects and processes your personal data.
This statement should be read together with the Terms and Conditions of use for other KenTrade Services. Where there is a conflict, this privacy statement will prevail.
This statement applies to all KenTrade staff, stakeholders, consultants, 3rd parties, system users, development partners and all visitors to any of KenTrade premises.
2. DEFINITIONS
The Agency/KenTrade/We/our/ours/us/ means the Kenya Trade Network Agency established under The National Electronic Single Window System Act, No. 25 of 2022 (NESWS Act).
The Act means the National Electronic Single Window System Act, No. 25 of 2022 and NESWS Regulations.
Data Protection Officer is a person designated or appointed by the Authority to monitor compliance with the Data Protection Act, No. 24 of 2019 and the Regulations made under the Act.
Data Collection means gathering of information that relates to you.
Personal data means information about you that identifies you directly or indirectly as a unique individual such as name, identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person.
Processing means any operation or sets of operations which is performed on your personal data whether or not by automated means, such as: collection, recording, organization or structuring; Storage, adaptation or alteration; Retrieval, consultation or use; Disclosure by transmission, dissemination, or otherwise making available; Alignment or combination, restriction, erasure or destruction.
Sensitive personal data is data revealing your racial or ethnic origin, political opinions, professional membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s gender.
System means the National Electronic Single Window System established under the National Electronic Single Window System Act No. 25 of 2022.
Third Party – means a natural or legal person, public authority, agency or body other than you and KenTrade, who under the direct authority of KenTrade are authorized to process your personal data.
You/ Your (s) means:
- User – a person who is registered to use the System.
- Any staff who has been employed by Kenya Trade Network Agency
- Any stakeholder who has signed an agreement with us and is recognized as our stakeholder in accordance with any applicable laws or Regulations.
- Any visitor that is a person (including contractors/subcontractors or any third party) who gains access to any KenTrade premises.
- Any supplier/ service provider who has been contracted by KenTrade.
- Any external lawyer who has tendered his/her application and/or signed a service level agreement with KenTrade.
- Any consultant who has signed an agreement with KenTrade.
3. PROCESSING OF PERSONAL DATA
The Kenya Trade Network Agency processes your personal information as permitted by the applicable Act, Data Protection Act, 2019, Regulations and its internal policies:
- With your consent.
- Where processing is necessary for carrying out the mandate of the Agency.
- For the performance of a contract to which you are party to or at your request before entering a contract.
- In compliance with any legal obligation to which KenTrade is subject.
- For protecting the vital and legitimate interests of KenTrade or another person.
- For the performance of a task carried out in public interest.
- For historical, statistical, or scientific research.
- Collection of Personal Data
KenTrade collects your personal data both directly and indirectly in accordance with the law. We collect your personal information with your knowledge and consent with the exception to cases where prior consent cannot be obtained for real reasons and the processing of the data is permitted by law.
The personal data we collect may include your name, email, national identification number/passport number, date of birth, employer, address, phone number, profession, business ownership, property, photographs, videos, PIN numbers, citizenship, educational qualifications, or any other data of a personal nature.
KenTrade also collects information that cannot be used to personally identify you such as anonymous usage data, general demographic information, referring/exit pages and URLs, platform types, preferences that are generated based on the data that you submit and number of clicks.
- Sensitive Personal Data
The Agency may collect sensitive personal data about you including details of your race, health status, ethnic origin, belief, biometric data, property details, marital status, family details including details of your children, parents, spouse or spouses and gender.
KenTrade shall ensure that sensitive personal data about you is processed in accordance with your right of privacy and as permitted in Part V of the Data Protection Act, 2019.
- Use of Personal Data
| Data Subject | Personal data collected | Purpose |
| System User | Identity number, KRA PIN number, TCC Number, name, designation, photos, postal and physical address, location, phone number, date and place of birth, email address, signature, age, gender, bank account details, licenses. | User registration and account management, system access, Validation of Tax compliance, Fees payment and refund processing, responding to queries, user training, statistics. |
| Staff | Identity number, signature, name, KRA PIN, SHIF Number, NSSF Number, postal and physical address, location, phone number, date of birth, email address, age, gender, dependent details, next of kin details academic/professional details, biometric information such as fingerprints and facial recognition, health records, ethnicity, spouse (s), religion, bank details, earnings and deductions, disability status. | Management of Employment relationship, benefit processing, reporting and compliance. |
| Staff dependents | Identity number, name, postal and physical address, location, phone number, date of birth, email address, age, gender. | Employee dependent benefit processing |
| Interns and attachés | Identity number, name, signature, KRA PIN, SHIF Number, NSSF Number, postal and physical address, location, phone number, date of birth, email address, age, gender, dependent details, referee information next of kin details academic/professional details, biometric information such as fingerprints and facial recognition, health records, ethnicity, spouse (s), religion, bank details, earnings and deductions, disability status. | Internship and attachment processing. |
| Researchers | Identity number, name, signature, KRA PIN, postal and physical address, location, gender, phone number, email address, bank details, biometrics. | Validation of requests, approval for access, identification, payment processing. |
| Development partners /representatives | Identity number, name, KRA PIN, postal and physical address, location, gender, phone number, email address, signature, bank details, biometrics. | Management of relationships with development partners |
| Individual Internet and website Users | name, location, email address, signature, browser history, IP address. | Network and infrastructure resources access, stakeholder feedback. |
| Other individuals e.g., consultants, vendors, bidders, visitors etc. | Identity number, name, signature, KRA PIN, TCC number, bank details, postal and physical address, location, phone number, date of birth, email address, age, gender, academic details, profession, disability status, referee information, surveillance footage. | Administration of procurement functions, contracts, payments processing and referencing, physical access control. |
- Access to your Personal Data
Access to your personal data is restricted based on need to know and least privilege principle. We take steps to ensure that your personal data is not altered by unauthorized entities or persons. All authorized persons accessing your personal data are bound by confidentiality.
- Transfer of Personal Data
KenTrade may transfer personal data with your consent and in a manner that is compatible with the purpose for which it was collected.
We may transfer or disclose the personal data we collect to third parties who provide support to KenTrade in providing its services. We may also disclose or process your personal data to a third party when required by law and the request has been authorized by the designated Data Protection Officer.
It is our policy to use only third-party providers that are bound to maintain appropriate levels of security and confidentiality, to process personal information only as instructed by us.
Where necessary KenTrade may transfer personal data to other countries, stakeholders, partners or entities outside Kenya so long as those countries, stakeholders, partners or entities have equivalent data protection laws.
In the event that KenTrade undergoes a business transformation, your personal data may be among the assets to be transferred to new platforms or entities and the acquirer of data assets may continue to process the personal data.
- Direct Marketing
You may be required to opt in or give any other form of explicit consent before receiving marketing messages from us.
You can ask us to stop sending you marketing messages at any time by writing to us or unchecking relevant boxes to adjust your marketing preferences or by following the optout links on any marketing message sent to you or by contacting us at any time through the contacts provided.
Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product, service already taken up, warranty registration, product or service experience or other transactions.
- Protection of Personal Data
The Agency ensures that access to electronic and physical repositories containing your personal data is controlled based on reasonable and appropriate administrative, physical, and organizational safeguards.
We implement security measures designed to protect your information from unauthorized access.
Your account is protected by your account password and KenTrade urges you to take steps to keep your personal information safe by not disclosing your password and by logging out of your account after each use.
By using the Agency’s systems, sites and access services, you acknowledge that you understand and agree to assume these risks. You also accept responsibility not to disclose your PIN and login information to suspicious individuals or for non-official reasons.
- Retention of Personal Data
We will only retain your personal data to fulfil the purposes for which we collect your data and to satisfy any legal requirements to which we are subject. To determine the appropriate retention period, we consider the size, nature and sensitivity of the personal data, the purposes for which we process the data, the need to comply with internal policies and the applicable legal requirements.
Due to the nature of our mandate, we may retain your personal data indefinitely in compliance with any other legal obligation.
You may, however, request destruction of your personal data before expiry of the retention period as provided in law. Such requests shall be processed in accordance with the Data Protection Act, 2019 and the KenTrade Data Protection and Privacy Policy.
4. USE OF COOKIES, EMBEDDED PLUG-INS, WIDGETS & LINKS
The Kenya Trade Network Agency website uses “cookies” to give you more personal, convenient website visits. This enables us to recognise you during subsequent visits. A cookie is a text file that is placed on your hard disk by a Web page server. Data stored in a cookie is created by the server upon your connection. This data is labelled with an ID unique to you and your computer and can only be read by a web server in the domain that issued the cookie to you.
You can accept or decline cookies. If you choose to decline cookies, you may not be able to fully experience the interactive features of the Kenya Trade Network Agency services or web sites you visit.
Within the Kenya Trade Network Agency’s Corporate Website, there are embedded applications, plug-ins, widgets or links to non-Kenya Trade Network Agency Websites (collectively “sites”). These sites operate independently of the Kenya Trade Network Agency and have their own privacy policies. When you visit these sites, you leave our website and no longer will be subject to our privacy and security policies. The Kenya Trade Network Agency is not responsible for the privacy or security practices or the content of other sites, and as such does give an endorsement of those sites or their content.
Subject to legal and contractual exceptions, you have rights under data protection laws in relation to your personal data. These are listed below: –
- Right to be informed that we are collecting personal data about you;
- Right to access personal data that we hold about you and request for information about how we process it;
- Right to request that we correct your personal data where it is inaccurate or incomplete;
- Right to request that we erase your personal data noting that we may continue to retain your information if obligated by the law or entitled to do so;
- Right to object and withdraw your consent to processing of your personal data. We may continue to process if we have a legitimate or legal reason to do so;
- Right to request restricted processing of your personal data noting that we may be entitled or legally obligated to continue processing your data and refuse your request;
- Right to request transfer of your personal data in [an electronic format].
If you wish to exercise any of the rights set out above, please contact us on dpo@kentrade.go.ke.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within a reasonable time. Occasionally it could take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
- ACCESS TO AND UPDATING YOUR INFORMATION
To update your information, you may contact our Data Protection Officer using the contacts provided to be given access to your personal information. You can change or update your personal information and how we get in touch with you and your account details whenever you like.
- AMENDMENT TO THIS STATEMENT
We reserve the right to amend this privacy statement at any time. All amendments to this privacy statement will be posted on KenTrade’s website. Unless otherwise stated, the current version shall supersede and replace all previous versions of the privacy statements.
- CONTACT
KenTrade as a data controller is required to have a data protection officer whose role is to oversee and ensure compliance to the Data Protection Act, 2019. The contact details of KENTRADE’s data protection officer is as follows:
Mr. Bonface Asiligwa
Designation: Data Protection Officer
Email: dpo@kentrade.go.ke
Telephone: 0709950000
KenTrade welcomes your questions or concerns about how it processes your personal data or if you want to exercise any of your rights in relation to your personal data, on Tel. No. 0709950000 or by writing to us on email: dpo@kentrade.go.ke.
Statement Effective Date
1st October 2024