Data Protection & Privacy Statement

1.1 Policy Statement

This protection and privacy statement sets out the basis on which GenAfrica Asset Managers Limited (“GenAfrica”, “we”, “us”, or “our”) may collect, use, disclose or otherwise process personal data during or after your relationship with us, in accordance with the Data Protection Act, 2019 (DPA), its attendant regulations, and with all other relevant legislation in all the jurisdictions that we operate in and applicable global legislations.

1.2 Definitions of Terms

• “GenAfrica”, “we”, “us”, “our” or the “Company” refers to GenAfrica Asset Managers Limited, a company incorporated in the Republic of Kenya and all its subsidiaries and branches whether established within Kenya or in a foreign country.
• “Data subject”, “you” refers to our clients including any person that you authorise to give us instructions, employees, service providers, agents, visitors, anyone who accesses our website, portals, applications and other stakeholders.
• The DPA defines personal information as “information relating to a natural person who is or can be identified, directly or indirectly.”

1.3 Who We Are

We are a leading fund manager providing investment management services to both institutional and retail investors. We also offer investment advisory for wealth and treasury management.

1.4 Principles and Obligations of Personal Data Protection

We commit to apply the principles of data protection in processing personal data and in compliance with the DPA and all other relevant legislation. We shall ensure that your personal data is:

• Processed in accordance with your right to privacy.
• Processed lawfully, fairly, and in a transparent manner.
• Collected for explicit, specified, and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
• Accurate and, where necessary, kept up to date.
• Kept in a form which identifies the data subjects for no longer than necessary.
• Not transferred outside Kenya unless there are adequate safeguards or consent from you.

1.5 Personal Data That GenAfrica Collects and Processes About You

We may collect, process, store, and transfer different kinds of personal data about you, including sensitive data. This may include your name, contact details, financial information, employment details, identification documents, and other information relevant to our services.

1.6 How We Collect Personal Data

We collect personal data directly when you engage with us or indirectly through third parties. This includes forms you fill, website visits, social media interactions, and information provided by authorized representatives.

1.7 How We Use Personal Data Collected

Your data is used to fulfil regulatory, contractual, and operational obligations including customer due diligence, account management, service delivery, marketing, HR management, and fraud prevention.

1.8 To Whom Personal Data May Be Disclosed

We may disclose personal data to affiliated entities, service providers, regulators, or legal authorities — only when legally permitted or required.

1.9 International Transfer of Personal Data

Transfers outside Kenya will only occur with adequate protection measures or consent. We ensure compliance with data protection laws and international standards such as GDPR.

1.10 How We Secure and Retain Personal Data

We implement physical, technical, and organizational measures to safeguard personal data. Data is retained for as long as necessary, typically up to seven years, after which it is securely destroyed.

1.11 Accessing Your Personal Data and Other Rights

You have the right to access, correct, delete, or restrict the processing of your personal data. You may also withdraw consent or lodge a complaint with the relevant authority.

1.12 Complaints

If you believe your privacy rights have been violated, you can file a complaint by contacting our Data Protection Officer at compliance@genafrica.com or by visiting our offices. You may also contact the ODPC in Kenya.

1.13 Cookies

We use cookies to enhance website functionality, remember preferences, and improve user experience. You may disable cookies via your browser settings, though some features may be limited.

1.14 Links to Other Websites

Our website may contain external links. We are not responsible for the privacy practices of such sites and encourage you to read their policies.

1.15 Clickstream Data and Use of Google Analytics

We use clickstream data and analytics tools to improve site performance and understand user behavior. The data collected is aggregated and anonymous.

1.16 Marketing

We may send marketing information about our products and services, subject to your consent and right to opt out at any time.

1.17 Processing Data Relating to a Child

We do not knowingly process data of minors without guardian consent. Verification mechanisms such as birth certificate checks are used where necessary.

1.18 Changes to This Statement

This statement was last updated in November 2022. Updates will be posted on our website, and material changes communicated via email or website notices.

1.19 Contact Us / Further Information