Privacy Policy

Introduction

Custody and Registrars Services Limited (“C&R” “Company” “We”) is a limited liability company duly registered and operating in Kenya and Uganda. The Company offers a wide range of services including share register administration; value added services and data processing services.

We are committed to processing your personal information according to applicable data protection laws.

1. What is Personal Data?

Personal data includes information that can identify an individual, such as name, contact information, identification numbers, share ownership, dividend payment history, bank account, and mobile money payment details.

2. Who does this Policy apply to? This policy applies to individuals whose personal data is processed by us, including shareholders and anyone who interacts with us regarding our services. 3. What types of information do we process about you? We process personal data about you such as bio data, contact information, identification information, photographs, and your correspondence with us. We may also process sensitive personal data related to property (e.g., shareholding details), beneficiaries and next of kin. 4. How and why do we collect your personal data? We collect personal information directly from you through various means such as forms email, phone calls, and social media platforms or during visits to our offices, and indirectly from clients, industry players, website or social media interactions and CCTV installed in our office premises. The data is collected for different purposes such as improving our services, compliance with legal requirements, fraud prevention, analysis and verification of identity. We inform you beforehand if we need to use your data for any other purpose. Failure to provide requested information may have implications on our services and on our ability to process your transaction or update request. 5. With whom do we share your personal information?

We share your personal data with those who have a need-to-know within our company, as well as third-party service providers, agents, brokers, issuers and regulatory bodies such as UFAA, CMA and NSE. We may also share your information when required by law or by court order. We take necessary measures to secure the security of your data when shared with third parties.
6. What lawful bases do we rely on to processes your personal information?

We process personal information based on consent, fulfilling contractual obligations, legal compliance, legitimate interests and research purposes.
7. What happens if we transfer your personal information outside Kenya?
In the event that we need to transfer your personal information outside of Kenya, particularly when utilizing cloud applications, we ensure that such transfers are done in accordance with the law. Furthermore, we have put in place adequate measures to safeguard your personal information during these transfers.
8. What controls do we have in place to secure your personal information?
We have implemented various measures to protect your personal information including technical, physical, legal, and organizational measures, in accordance with applicable privacy and data security laws and our data protection policy.
9. How long do we hold your personal information?
We hold information in alignment with compliance and legal durations for confirming identity and legality of transactions processed.
10. What rights are you guaranteed under applicable data protection legislation?
You have various rights under data protection legislation. These include being informed of how we use your data, accessing and correcting your information, restricting processing, objecting to use, receiving your data in a machine-readable format, and revoking consent of use, where applicable. Revoking consent of use may have implications on our services.  You also have the right to request human intervention in automated decision-making and to inform us of any changes to your personal information.
11. How can you exercise these rights?
If you want to exercise any of the rights or duties mentioned above, please get in touch with us by sending an email to the address info@candrgroup.co.ke
12. Changes to this policy
We may contact you periodically to verify your personal information and to inform you of any changes in our privacy.