Privacy Policy and Cookies

• 
  1. Privacy Policy
  
• 
  2. Cookies
  

1. Privacy Policy

Definitions
The Act Means The (Kenya) Data Protection Act no. 24 of 2019.
GDPR Means the General Data Protection Regulation.
Data Subject Means an identified or identifiable natural person.
Personal data Means any information relating to an identified or identifiable natural person.
A personal data breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
Sensitive Personal Data means data revealing the natural person’s race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of the person’s children, parents, spouse or spouses, sex, or the sexual orientation of the data subject.
Responsible Person Means the Data Protection Officer for Eclectics International.
The Regulations

• The Data Protection (General) Regulations, 2021 – Legal Notice No. 263;
• The Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 —Legal Notice No. 264.
• The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 —Legal Notice No. 265.

Purpose of this policy
The policy provides guidance on how Eclectics will handle the data it collects. It helps Eclectics to abide by the data protection law and protect the rights of data subjects.
Application/Scope of the Policy
This policy applies to all personal data we process regardless of the location where that personal data is stored (e.g., on an employee’s own device, Eclectics International’s servers, Eclectics International’s website, etc.) and regardless of the data subject. All Eclectics International staff and others processing personal data on Eclectics International’s behalf must read it. A failure in strict compliance with this policy shall result in severe disciplinary actions. Eclectics International Heads of Departments are responsible for ensuring that all staff within their area of responsibility comply with this policy and should implement appropriate practices, processes, controls, and training to ensure compliance.
Ownership
Eclectics International has appointed an internal Data Protection Officer (DPO) who is responsible for overseeing the implementation of this policy. If you have any questions about this policy, including any requests to exercise your legal rights, please contact the data protection officer using the email below. Email Address: dataprotection@eclectics.io
Changes to this Policy
This version was last updated on September 23rd, 2022. This policy shall be reviewed on an annual basis or whenever there are changes to the data protection regulations and/or changes in our internal processes. Please visit this web page periodically to keep up to date with the changes in this policy
Rights of Data Subjects
As a data subject, you have the following rights.

• to be informed of the use to which your personal data is to be put.
• to request a copy of your personal data which shall be availed to you in a timely manner.
• to object to the processing of all or part of your personal data.
• to request correction or deletion of misleading information on your personal data.

Exercise of Rights of Data Subjects
A right conferred on a data subject may be exercised.

• • where the data subject is a minor by a person who has parental authority, or by a guardian.
  • where the data subject has a mental or other disability, by a person duly authorized to act as their guardian or administrator
  • in any other case, by a person duly authorized by the data subject.

  Data protection principles
  Eclectics International Limited commits to its stakeholders and general data subjects to always collect, process, store, and transfer personal data with the utmost professionalism and in accordance with its responsibilities as stipulated under the Act, the Regulations, the GDPR, and other relevant legislation. Eclectics shall ensure that personal data is —

  • • processed in accordance with the right to privacy of the data subject;
    • processed lawfully, fairly, and in a transparent manner in relation to any data subject;
    • collected for explicit, specified, and legitimate purposes and not further processed in a manner incompatible with those purposes;
    • adequate, relevant, and limited to what is necessary for relation to the purposes for which it is processed;
    • Eclectics International shall ensure that personal data is adequate, relevant, and strictly limited to what is necessary in relation to the purposes for which they are processed.
    • collected only where a valid explanation is provided whenever information relating to family or private affairs is required;
    • accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay;
    • kept in a form that identifies the data subjects or no longer than is necessary for the purposes for which it was collected; and not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject.

  Lawful, fair, and transparent processing

  • • To ensure its processing of data is lawful, fair, and transparent, Eclectics International shall maintain a Register of Systems.
    • The Register of Systems shall be reviewed at least annually.
    • Eclectics International’s clients and partners have the right to access their data and any such requests made to Eclectics International shall be dealt with in a timely manner.
    • Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be kept with the personal data.
    • All data processed by Eclectics International must be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
    • Where communications are sent to individuals based on their consent, the option for the individual to revoke their consent should be clearly available and systems should be in place to ensure such revocation is reflected accurately in Eclectics International’s systems.

  Collection of Personal Data
  Eclectics shall collect data directly from the data subject in a secure channel. Eclectics shall collect personal data indirectly where.

  • • • The data is contained in a public record
      • The data subject has deliberately made the data public
      • The data subject has consented to the collection from another source
      • The data subject has an incapacity, the guardian appointed has consented to the collection from another source.
      • The collection from another source would not prejudice the interests of the data subject.
      • Collection of data from another source is necessary

  For the prevention, detection, investigation, prosecution, and punishment of crime. For the enforcement of a law that imposes a pecuniary penalty. For the protection of the interest of the data subject or another person.
  Accuracy

  • • • • Eclectics International shall take reasonable steps to ensure personal data is accurate.
        • Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date.
        • All users shall be expected to provide accurate information at all times and will be required to immediately report any error or discrepancies in the data capture within the shortest period of discovering such error(s).

  Data Retention

  • • • • • Eclectics shall retain personal data only if may be reasonably necessary to satisfy the purpose for which it is processed unless the retention is required or authorized by law, reasonably necessary for a lawful purpose, authorized or consented by the data subject or for historical, statistical, journalistic literature and art or research purposes.
          • Where retention is not required under the above-mentioned grounds, then the data processor or controller shall delete, erase, anonymize or pseudonymize personal data not necessary to be retained under sub-section (1) of the Data Act in a manner as may be specified at the expiry of the retention period.

  Security

  • • • • • • Eclectics International shall conduct periodic data protection impact assessments (DPIA) to ensure the integrity, availability, and reliability of data are not compromised and that personal data is processed, controlled, transferred, and stored securely using modern software that is kept up to date.
            • Access to personal data shall be limited to personnel who need access and appropriate security should be in place to avoid unauthorized sharing of information.
            • When personal data is deleted this shall be done safely such that the data is irrecoverable.
            • Appropriate backup and disaster recovery solutions shall be in place.

  Breach
  In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data, Eclectics International shall promptly assess the risk to people’s rights and freedoms and if appropriate report this breach to the Data Commissioner as per the set guidelines per set Regulations and as per the provisions of the Act. Eclectics shall notify the data commissioner of a data breach within seventy-two hours of becoming aware of the breach. In case the delay is not made within the specified time, Eclectics shall submit a written document stating the reason for the delay.
  Breach Notification as a data processor
  Whenever there is a personal data breach Eclectics shall notify the relevant data controller within forty-eight hours of becoming aware of the breach.
  Breach Notification as a data controller
  Eclectics may restrict communication of a breach for the purpose of prevention, detection, or investigation of the incident. Eclectics may choose not to communicate the personal data breach to data subjects where the appropriate security safeguard has been implemented.
  Transfer of Personal Data outside Kenya
  In cases whereby Eclectics may transfer personal data to another country, the data commissioner shall be provided with appropriate safeguards aimed at ensuring the protection of personal data.
  – END OF POLICY –

2. Cookies Policy

Last update October 24, 2022
This Cookie Policy explains how ECLECTICS INTERNATIONAL (“Company”,”we”,”us” and “our”) uses
cookies and similar technologies to recognize you when you visit our website at https://eclectics.io,
(“Websites”). It explains what these technologies are and why we use them, as well as your rights to
control our use of them.
In some cases, we may use cookies to collect personal information, or that becomes personal
information if we combine it with other information.
What are cookies?
Cookies are small data files that are places on your computer or mobile device when you visit a website.
Cookies are widely used by website owners in order to make their website work, or to work more
efficiently, as well as to provide reporting information.
Cookies set by the website owner (in this case, Eclectics International) are called “first party cookies”.
Cookies set by parties other than the website owner are called “third party cookies”. Third party cookies
enable third party features or functionality to be provided on or through the websites (e.g. like
advertising, interactive content and analytics). The parties that set these third-party cookies can
recognize your computer both when it visits the website in question and when it visits certain websites.
Why do we use cookies?
We use first- and third-party cookies for several reasons. Some cookies are required for technical
reasons for our website to operate, and we refer to these as “essential” or “strictly necessary” cookies.
Other cookies also enable us to track and target the interests of our users to enhance the experience on
our online properties. Third parties serve cookies through our websites for advertising, analytics and
other purposes.
Types of Cookies we collect
Essential Website cookies
These cookies are necessary for the website to function and cannot be switched off in our systems. They
are usually only set in response to actions made by you which amount to a request for services, such as
setting your privacy preferences. You can set your browser to block or alert you about these cookies, but
some parts of the site will not then work. These cookies do not store any personally identifiable
information.
Performance and Functionality Cookies
These cookies enable the website to provide enhanced functionality and personalization. They may be
set by us or by third party providers whose services we have added to our pages. If you do not allow
these cookies, then some or all these services may not function properly. These cookies are used to

enhance the performance and functionality of our websites but are non-essential. However, without
these cookies, certain functionality (like videos) may become unavailable.
Analytics and customization cookies
These cookies collect information that is used either in aggregate form to help us understand how our
websites are being used or how effective our marketing campaigns are, or to help us customize our
website for you.
Advertising Cookies
These cookies are used to make advertising messages more relevant to you. They perform functions like
preventing the same ad from continuously reappearing, ensuring that ads are properly displayed for
advertisers, and some cases selecting advertisements that are based on your interests.
Social networking Cookies
These cookies are used to enable you to share pages and content that you find interesting on our
websites through third party social networking and other websites. These cookies many also be used for
advertising purposes.
What about other tracking technologies, like web beacons?
Cookies are not the only way to recognize or track visitors to a website. We may use other, similar
technologies from time to time, like web-beacons (sometimes called “tracking pixels” or “clear gifs”).
These are tiny graphics files that contains a unique identifier that enable us to recognize when someone
has visited our websites. This allows us, for example, to monitor the traffic patterns of users from one
page within a website to another, to deliver or communicate with cookies, to understand whether you
have come to the website from an online advertisement displayed on a third-party website, to improve
site performance and to measure the success of e-mail marketing campaigns. In many instances these
technologies are reliant on cookies to function properly, and so declining cookies will impair their
functioning.
Where can I get further information?
We may update this cookie policy from time in order to reflect. For example, changes to the cookies we
use or for other operational, legal or regulatory reasons.
Please revisit this cookie policy to stay informed about our use of cookies and related technologies.
If you have any question about our use of cookies policy or privacy policy, please email us at
dataprotection@eclectics.io

-END OF POLICY-