Data Protection Policy

Furniture Palace Kenya Ltd

  1. Purpose and Scope
  2. Purpose

Furniture Palace Kenya Ltd values customer information privacy and aims to ensure that we are up-to date with the recent developments in Data Protection laws most recently, the Data Protection Act which came into force in 2019.

  1. Scope

This policy is meant to guide [insert business name], it’s employees and where applicable partners in how to ensure compliance with the Data Protection laws and other laws relating to the privacy of personal data. 

  1. Definitions
  1. Personal data: Any information relating to an individual who can be directly or indirectly identified. This might be by reference to an identifier, such as a name, an identification number, location data, and an online identifier, or to one or more factors specific to the identity of that individual.
  2. Sensitive personal data: Personal data which reveals any of the following “sensitive categories” about a data subject’s:
  • Race
  • Ethnic social origin
  • Health status
  • Conscience
  • Belief
  • Genetic or biometric data
  • Property details
  • Marital status
  • Family details
  • Spouse or spouses
  • Sex or the sexual orientation
  1. Data subject: This means an identified or identifiable natural person who is the subject of personal data.
  2. Processing: Any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, alteration, retrieval, dissemination, restriction, erasure or destruction.
  3. Anonymized data: Data that was once personal but has been converted into a form in which it no longer identifies individuals, and where the likelihood of re-identification of individuals (by TransUnion or anybody else) is reasonably impossible.
  4. Pseudonymized data: Personal data that has been modified so the information in it cannot be attributed to individuals without the use of additional information that is kept separately and is subject to appropriate technical and organizational measures to ensure it’s not used to re-identify the relevant data subjects.
  5. Data Controller: A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal data.
  6. Data Processor: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.
  7. Data Protection Act, 2019 and implementing regulations, 2021: The Data Protection Act, 2019 is a Kenyan law on data protection and privacy.
  8. Data Protection Commissioner: The national data protection authority for the Kenya; a local regulator for data protection law.
  9. Data protection principles

Furniture Palace is committed to processing data in accordance with its responsibilities under the Data Protection Act including the principles.

The Data Protection Act has laid out principles that guide the processing of personal data and include:

  1. Right to Privacy: processing of personal data shall be in accordance with the right to privacy of the data subject.
  1. Lawfulness, fairness and transparency: personal data shall be processed lawfully, fairly and in a transparent manner in relation to individuals;
  2. Legal basis: personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
  3. Data Minimisation: adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
  4. Accuracy: personal data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
  5. Storage Limitation: personal data shall be kept in a form which kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected; and
  6. Cross border data transfer: not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject.
  7. Lawful, fair and transparent processing 
  1. To ensure its processing of data is lawful, fair and transparent, the Organisation shall maintain a Register of Systems and processing activities. 
  2. The Register of Systems and processing activities shall be reviewed at least annually or upon the introduction of any new product/ solution or when the business procures new data from a data subject or a new data provider. 
  3. Individuals have the right to access their personal data and any such requests made to the Organisation shall be dealt with in a timely manner. 
  4. Lawful purposes
  5. All data processed by the Organisation must be done on one of the following lawful bases:
    1. Consent: the data subject should have consented to processing for one or more specified purposes.
  1. Necessity
  1. Contract: for the performance of a contract in which the data subject is a party or where the data subject requires the same prior to entering into a contract.
  2. Legal obligation: if the processing is in compliance with a legal obligation in which the Data Controller is subject.
  3. Vital interests: in order to protect the vital interests of the data subjects or other natural person.
  4. Public interest:  for the exercise, by any person in the public interest, of any other functions of a public nature.
  5. Legitimate interests:  for the legitimate interests pursued by the data controller or data processor by a third party to whom the data is disclosed, except if the processing is unwarranted in any particular case having regard to the harm and prejudice to the rights and freedoms or legitimate interests of the data subject
  1. The Organisation shall note the appropriate lawful basis in the Register of Systems and processing activities.
  2. Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be kept with the personal data. 
  3. Where communications are sent to individuals based on their consent, the option for the individual to revoke their consent should be clearly available and systems should be in place to ensure such revocation is reflected accurately in the Organisation’s systems.  
  4. Data minimisation
  5. The Organisation shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. 
  6. Accuracy
  1. The Organisation shall take reasonable steps to ensure personal data is accurate. 
  2. Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date. 
  1. Archiving / removal
  1. To ensure that personal data is kept for no longer than necessary, the Organisation shall put in place an archiving policy for each area in which personal data is processed and review this process annually. 
  2. The organisation shall also maintain a data retention schedule which shall detail the periods for which data is retained in the organisation’s systems.
  3. The archiving policy shall consider what data should/must be retained, for how long, and why. 
  4. Security
  1. The Organisation shall ensure that personal data is stored securely using modern software that is kept-up-to-date.  
  2. Access to personal data shall be limited to personnel who need access and appropriate security should be in place to avoid unauthorised sharing of information. The business shall maintain a record for who and what access is given to each associate. The organisation shall also consider having a timeline lapse for such access given.
  3. When personal data is deleted, this should be done safely such that the data is irrecoverable. However, there should be an audit trail for who, why, when and how the deletion happened.
  4. Appropriate back-up and disaster recovery solutions shall be in place. 
  5. Breach

This policy is meant to ensure that personal data is not exposed to risk however, it is impossible to be immune to breach. Therefore, In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, the Organisation shall promptly assess the risk to people’s rights and freedoms and if appropriate report this breach to the Office of the Data Protection Commissioner pursuant to the Data Protection Act. 

  1. Data Subject Rights
  2. Information

A data subject has a right to be informed of the use for which their personal data is put.

  1. Access

A data subject as a right to request for information held regarding them by a data controller or data processor. They are also entitled to information as to:

  1. The purposes for the processing of their data;
  2. Categories of personal data concerned;
  3. Recipients of the information whether in the past, present or the future. These should also include recipients abroad.;
  4. The retention period for the personal data. If this cannot be provided then a criterion that will be used to determine the period; and
  5. Where information is not collected from the data subject, the source of the information should be provided. 
  6. Portability

 A data subject has a right to port or copy their data or have their right transferred from one Data Controller or Processor to another.

  1. Withdrawal of consent

A data subject shall have a right to withdraw their consent to the processing of their personal data at any time.

  1. Rectification

A data subject may request the rectification of information which is: misleading, untrue, incomplete, inaccurate, outdated or incomplete. This request shall not be subject to any charges.

  1. Restriction

A data subject has a right to request for the restriction of the processing of all or part of their personal data under the following grounds:

  1. Where they contest the accuracy of their personal data;
  2. Where personal data has been processed unlawfully and the data subject does not want the information deleted but requests for restriction instead;
  3. Where we need the information for the establishment, exercise or defence of a legal claim;
  4. Where a data subject has objected to the processing of their data but we are considering legitimate grounds for such processing.
  5. Objection

A data subject is entitled to object to the processing of all or part of their data. Where processing is for direct marketing purposes, this serves as an absolute right.

  1. Deletion

Also referred to as the right of erasure, a data subject has a right to request a data controller or processor to delete or erase personal information they hold where:

  1. The personal data is no longer necessary for the purpose for which it was collected;
  2. The data subject withdraws the consent which was the legal basis for which the data was processed;
  3. The data subject objects to the processing of the data and no overriding interest is present for the processing of the data;
  4. The data subject objects to the processing of personal data for direct marketing activities;
  5. The processing is unlawful;
  6. Erasure is necessary to comply with a legal obligation.
  7. Automated Decision Making

Data subjects have a right not to be subjected to automated decision making including profiling.

  1. General provisions
  1. This policy applies to all personal data processed by the Organisation. 
  2. The Responsible Person shall take responsibility for the Organisations’ ongoing compliance with this policy. 
  3. This policy shall be reviewed at least annually. 
  4. The Organisation shall register with the Office of the Data Protection Commissioner as an organisation that processes personal data.