Last updated: May 12 ,2025
Introduction
This Privacy Policy outlines how we collect, use, store, and share your personal data when you register for or interact with our services. It reflects our commitment to data protection under local and international laws where applicable.
By providing your personal data, you consent to its processing as described in this policy.
1. Definitions
For the purposes of this privacy policy:
- Account means a unique record created for you in our registration forms or system.
- Company or NSE (referred to as either “the Company”, “We”, “Us”, “Our” or “NSE”
in this Agreement) refers to the Nairobi Securities Exchange Plc. - Country refers to Kenya (or your applicable jurisdiction).
Device means any device that can be used to provide personal information, such as a computer, mobile phone, or tablet. - Personal Data means any information relating to an identified or identifiable individual.
- Service refers to all the products and functions the Company offers, including websites, apps, and any in-person or physical services like events.
- Service Provider means any natural or legal person who processes data on behalf of the Company.
- Third-party refers to any platform not owned by the Company that may be used to engage with our services.
- Usage Data refers to data collected automatically through interaction with our platforms or communications.
- You means the individual providing information or the organization on behalf of which such individual is providing information.
2. Legal Basis for Processing
We process your personal data under one or more of the following legal bases:
- Consent – for marketing communications and optional services.
- Contractual necessity – to register and facilitate your participation in events or utilization of our services.
- Legal obligation – where required by law or regulatory frameworks.
- Legitimate interest – such as managing and improving events/services, security, and engagement analytics.
3. Types of Data Collected
We may collect the following types of personal data:
i. Full name
ii. Email address
iii. Phone number
iv. Gender
v. Personal Identification/Passport number/Tax Identification
vi. Age
vii. Address, city, county, and country
viii. Organization and job title
ix. Education and qualifications (if necessary)
x. Dietary or accessibility requirements
xi. Emergency contact (if necessary)
xii. Event participation history
xiii. Preferences for communication or future contact
xiv. Feedback, survey responses, and evaluations
We do not collect sensitive personal data unless it is strictly necessary for event or service delivery and provided with explicit consent.
4. Children’s Privacy
We do not knowingly collect personal information from children under the age of 18 without verified parental or guardian consent. If we discover that personal data from a child has been collected without appropriate consent, we will delete it promptly. For youth-focused events or services, only essential information will be collected, and only with verified guardian authorization.
5. Use of Your Personal Data
We use your personal data for the following purposes:
i. To register and manage your participation in events or utilization of our services.
ii. To communicate updates, confirmations, and reminders
iii. To provide personalized experiences and logistical support
iv. To analyze service utilization, attendance, feedback, and engagement metrics
v. To send marketing communications for future events (where you have consented)
vi. To comply with applicable laws and regulations
vii. To process applications made by you or your organization.
6. Marketing Communications
With your explicit consent, we may use your contact information to send promotional materials, newsletters, event invitations, or other communications we believe may interest you. You can opt out at any time by contacting us directly or utilizing opt out mechanisms that may be provided with the service.
7. Data Retention
We determine the length of data retention on a case-by-case basis, depending on factors such as the nature of the information, the purpose for its collection and processing, and any legal or operational retention requirements. Once your data is no longer necessary for these purposes, it will be securely deleted or anonymized.
8. Cross-Border Data Transfers
When personal data is transferred outside Kenya, we comply with the Data Protection Act, 2019, and ensure transfers are based on one or more of the following:
• Transfers to countries recognized as having adequate data protection.
• Use of standard contractual clauses, data transfer agreements, or other legally recognized safeguards.
• Binding corporate rules for intra-group transfers.
• Your explicit consent, where required.
We recognize that recipient countries may have different and potentially less stringent data privacy laws. Where necessary, we impose contractual obligations and require adherence to international codes of conduct to ensure your data is adequately protected.
9. Sharing of Personal Data
We may share your data with:
• Service Providers involved in service provision, event logistics, communications, and data processing
• Event Partners or Sponsors (only where relevant and with your consent)
• Regulators or legal authorities, when required by law or to protect rights
We do not sell or rent your personal data to third parties.
10. Security of Your Personal Data
We have procedures in place to respond to suspected personal data breaches and will notify you and any applicable regulators of a breach where we are legally required to do so. Access to your data is restricted to employees, agents, contractors, and third parties who have a business need to know. They will process your data only on our instructions and are subject to a duty of confidentiality.
11. Your Rights
Under the Kenya Data Protection Act and GDPR, you have the right to:
i. Access the personal data we hold about you
ii. Correct inaccurate or outdated data
iii. Request deletion of your data (right to be forgotten)
iv. Object to processing, especially for direct marketing
v. Withdraw consent at any time without affecting prior lawful processing
vi. Restrict processing under certain conditions
vii. Request portability of your data (where applicable)
viii. Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) or other supervisory authority
To exercise these rights, please contact us using the details provided below.
12. Automated Decision-Making
Should we ever engage in automated decision-making or profiling that produces legal or similarly significant effects, we will provide you with clear information about the logic involved and the potential consequences, as well as your rights relating to such processing.
13. Cloud Computing and Hosting
Your personal data may be held or processed in the cloud, in data centers or systems operated by approved third-party cloud providers located within or outside Kenya. All cloud providers engaged by NSE are required to comply with the Kenya Data Protection Act, GDPR (where applicable), and relevant international standards such as ISO/IEC 27001. We conduct due diligence and require contractual commitments (including SLAs) to maintain confidentiality, integrity, and availability of your data, including clarity on server location and ongoing monitoring of provider compliance.
14. External Links Disclaimer
Our website or services may, from time to time, contain links to external sites operated by partner networks, advertisers, or affiliates. Please note that these sites have their own privacy policies, and NSE does not accept responsibility or liability for their practices. We recommend reviewing their privacy statements before submitting any personal data.
15. Changes to This Privacy Policy
We reserve the right to update this policy from time to time to reflect changes in law, technology, or our practices. When we do, we will update the “Last Updated” date and provide appropriate notice for material changes.
Contact Us
If you have any questions, concerns, or wish to exercise your data rights, please contact: