Data Protection and Privacy Policy
DATA PRIVACY POLICY
1. About this Policy
1.1 This policy explains when and why we collect personal information about our shareholders, investors and staff, how we use it and how we keep it secure and their rights in relation to it.
1.2 We may collect, use and store your personal data, as described in this Data Privacy Policy and as described when we collect data from you.
1.3 We reserve the right to amend this Data Privacy Policy from time to time without prior notice. We may be required to amend this Data Privacy Policy due to regulations. For any significant changes you will be notified but you are advised to check our website for the latest Privacy Policy.
1.4 We will always comply with the Nigeria Data Protection Regulation (NDPR) when dealing with your personal data. For the purposes of the NDPR, we will be the “controller” of all personal data we hold about you.
2. Who are we?
We are Kinley Securities Limited. We can be contacted at:
55 Campbell St, Lagos Island, Lagos State, Nigeria.
3. What information we collect and why.
|
Which information |
What we do |
Why we do it |
Retention time How long do we keep your information |
|
Clients Biodata such as but not limited to: Name, Date of Birth, Biometrics, Passport Photograph Phone number, Account Details Clearing House Number etc. |
l Complete a task l Provide a service |
To comply with legal and regulatory obligations and requirements
|
For as long as it is necessary to comply with Kinley Securities Limited legal obligations and statutory functions
|
|
Staff Records such as but not limited to: Name, Date of Birth, Academic Qualifications, Passport Photograph, Account Details etc. |
l Complete a task l Provide a service
|
To comply with legal and regulatory obligations and requirements
|
For as long as it is necessary to comply with Kinley Securities Limited legal obligations and statutory functions |
|
|
|
|
|
|
Service Providers Details such as but not limited to: CAC documents, PENCOM Details, Tax Identification Number, Account Details etc. |
l Complete a task l Provide a service |
To comply with legal and regulatory obligations and requirements
|
For as long as it is necessary to comply with Kinley Securities Limited legal obligations and statutory functions |
4. How we protect your personal data
4.1 We will not transfer your personal data outside Nigeria without your consent.
4.2 We have implemented generally accepted standards of technology and operational security in order to protect personal data from loss, misuse, or unauthorised alteration or destruction.
4.3 Please note however that where you are transmitting information to us over the internet this can never be guaranteed to be 100% secure.
4.4 For any payments which we take from you on-line we will use a recognised on-line secure payment system.
4.5 We will notify you promptly in the event of any breach of your personal data which might expose you to serious risk.
5. Who else has access to the information you provide us?
5.1 We will never sell your personal data. We will not share your personal data with any third parties without your prior consent (which you are free to withhold) except where required to do so by law.
5.2 We may pass your personal data to third parties who are service providers, agents and subcontractors to us for the purposes of completing tasks and providing services to you on our behalf (e.g., to print newsletters and send you mailings). However, we disclose only the personal data that is necessary for the third party to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own purposes.
6. How long do we keep your information?
6.1 We will hold your personal data on our systems for as long as you are our client, service provider and staff for as long as is necessary to comply with our legal obligations. We will review your personal data every year to establish whether we are still entitled to process it. If we decide that we are not entitled to do so, we will stop processing your personal data except that we will retain your personal data in an archived form in order to be able to comply with future legal obligations e.g., compliance with tax requirements and exemptions, and the establishment exercise or defence of legal claims.
6.2 We securely destroy all financial information once we have used it and no longer need it.
7. Your rights
7.1 You have rights under the NDPR:
(a) to access your personal data
(b) to be provided with information about how your personal data is processed
(c) to have your personal data corrected
(d) to have your personal data erased in certain circumstances
(e) to object to or restrict how your personal data is processed
(f) to have your personal data transferred to yourself or to another business in certain circumstances.
7.2 You have the right to take any complaints about how we process your personal data
to the National Information Technology Development Agency (NITDA): [email protected]
For more details, please address any questions, comments and requests regarding our data
processing practices to our Data Protection Officer via [email protected]
DATA PROTECTION POLICY
1. The purpose of the policy
This Data Protection Policy states the basic principles on data protection for Kinley Securities Limited. Ensuring data protection is the foundation of trustworthy business relationships and the reputation of Kinley Securities Limited as an attractive employer.
It ensures the adequate level of data protection prescribed by the European Union Data Protection Directive and the Nigeria Data Protection Regulation 2019 for cross-border data transmission, including in countries that do not yet have adequate data protection laws.
2. Data protection principles
Kinley Securities Limited is committed to processing data in accordance with its
responsibilities under the Nigeria Data Protection Regulation.
Article 5 of the General Data Protection Regulation (GDPR) requires that personal data shall be:
a) processed lawfully, fairly and in a transparent manner in relation to individuals;
b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and
f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
3. General provisions
a) This policy applies to all personal data processed by Kinley Securities Limited .
b) The Responsible Person shall take responsibility for Kinley Securities Limited ongoing compliance with this policy.
c) This policy shall be reviewed at least annually.
d) Individuals have the right to access their personal data and any such requests made to Kinley Securities Limited shall be dealt with in a timely manner.
4. Lawful purposes
a) All data processed by Kinley Securities Limited must be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests.
b) Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be kept with the personal data.
c) Where communications are sent to individuals based on their consent, the option for the individual to revoke their consent should be clearly available and systems should be in place to ensure such revocation is reflected accurately in Kinley Securities Limited systems.
5. Data minimisation
a) Kinley Securities Limited shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
6. Accuracy
a) Kinley Securities Limited shall take reasonable steps to ensure personal data is accurate.
b) Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date.
7. Archiving / removal
a) To ensure that personal data is kept for no longer than necessary, Kinley Securities Limited shall put in place an archiving policy for each area in which personal data is processed and review this process annually.
b) The archiving policy shall consider what data should/must be retained, for how long, and why.
8. Security
a) Kinley Securities Limited shall ensure that personal data is stored securely using modern software that is kept-up-to-date.
b) Access to personal data shall be limited to personnel who need access and appropriate security should be in place to avoid unauthorised sharing of information.
c) When personal data is deleted this should be done safely such that the data is irrecoverable.
d) Appropriate back-up and disaster recovery solutions shall be in place.
9. Breach
In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, Kinley Securities Limited shall promptly assess the risk to people’s rights and freedoms and if appropriate report this breach to the National Information Technology Development Agency (NITDA) via [email protected]
For more details, please address any questions, comments and requests regarding our
data processing practices to our Data Protection Officer via dpo@kinleysecuritiesltd.com
PRIVACY NOTICE
1. Scope
All data subjects whose personal data is collected, in line with the requirements of the Nigeria
Data Protection Regulation.
2. Responsibilities
2.1. The Data Protection Officer is responsible for ensuring that this notice is made available to data subjects prior to Kinley Securities Limited collecting/processing their personal data.
2.2. All Employees/Staff of Kinley Securities Limited who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and their consent to the processing of their data is secured.
3. Privacy notice
3.1. Kinley Securities Limited has an established reputation for providing financial market services to business enterprises, government (all tiers) and high net worth individuals of a very high standard in terms of service delivery, professionalism and integrity.
Our assigned Data Protection Officer Mr. George Chika can be contacted directly via:
55 Campbell Street, Lagos Island, Lagos State, Nigeria.
Tel: +234 708 751 7599
3.2. Consent
By consenting to this privacy notice you are giving us permission to process your personal data specifically for the purposes identified.
Consent is required for Kinley Securities Limited to process both types of personal data, but it must be explicitly given. Where we are asking you for sensitive personal data, we will always tell you why and how the information will be used.
You may withdraw consent at any time by contacting us at the details provided or in line with Withdrawal of Consent Procedure.
3.3. Disclosure
Kinley Securities Limited will not pass on your personal data to third parties without first obtaining your consent. We do not share your personal data without first obtaining your consent.
3.4. Retention period
Kinley Securities Limited will process personal data for the purposes of your enquiry and store information in line with statutory obligations and our cookie policy. Settings that enable our products to operate correctly or maintain preferences maybe stored on your device to assist you when returning to our site. Wherever possible personal data will be minimized and securely destroyed. Storage of personal data will follow statutory retention requirements.
3.5. Your rights as a data subject
At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
· Right to judicial review: in the event that Kinley Securities Limited refuses your request under rights of access, we will provide you with a reason as to why.
You have the right to complain as outlined in clause 3.6 below.
All of the above requests will be forwarded on should there be a third party involved in the processing of your personal data.
3.6. Complaints
In the event that you wish to make a complaint about how your personal data is being processed by Kinley Securities Limited (or third parties as described in 3.4 above), or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority and Kinley Securities Limited data protection representative the assigned Data Protection Officer / NDPR Owner, details as in 3.1.
3.7. On-line privacy statement
3.7.1. Personal data
Under the Nigeria Data Protection Regulation (NDPR) personal data is defined as: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an on-line identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
3.7.2. How we use your information
This privacy notice tells you how we, Kinley Securities Limited, will collect and use your personal data. We acquire and use information relating to commercial organisations and individuals for a variety of reasons:
1. Delivery of our services
2. Communications
3. Legal obligations
4. Marketing purposes
If you are requested to provide us with personal information you can of course refuse. If you choose not to provide the data that we require to provide our services then we may not be able to deliver that service for you.
3.7.3. The personal data collected from you
Contact data: We will request your full name, postal address, phone number and e-mail address.
Special category data: We may request on occasion such data about you that may be necessary to facilitate the execution of our services. This maybe data such as your current health for a vulnerability assessment.
Payment data: Where it is necessary to process your payment, if you are repaying debt or for payments of services supplied to you, then sensitive information, such as your debit card number, security code and cardholders address maybe requested but not stored by us. The payment is processed by our staff using secure processing websites with secure links operated by our approved card merchant service providers. The information is not stored on our systems or held with any of our personnel.
Business and relationships: We may collect such personal information that you provide to us relating to your contacts and business relationships.
Content: We may collect the content of any data files and communications that you may send us for the purposes of carrying out your instruction, together with any relevant physical documents that you may give us as well, when these are necessary to provide you with the offered service. Data we collect may include but not limited:
• address, subject line and body of an email
• video and/or audio recording of a video message
• written content of a text, similar app or other content of an instant message
• relevant social media messages
We may also collect information that you provide us with regards to client feedback for services provided. This information will be retained in line with our retention policy.
The personal data we collect will be used for the following purposes but not limited to:
• To carry out our business activities
• To enforce using the appropriate legal process
• Update existing information
• Manage our products and services
• Monitor and keep records of communications
• To improve the operations of our business where possible
• To comply with legal and regulatory obligations and requirements
Our legal basis for processing personal data:
• To provide products and service
• Legitimate interests
• Vulnerability assessments
• Public interest matters
• To comply with legal and regulatory obligations and requirements
Any legitimate interests pursued by us, or third parties we use, are as follows:
• Develop business partnerships
• To comply with legal and regulatory obligations and requirements
3.7.4. Need to collect and store personal data
In order for us to provide you with the services we offer we need to collect personal data for:
• General information processing: though we do not undertake automated decision making or profiling of personal data.
• Legitimate Business requirements
• Perform contractual and payment obligations
• Meet legal obligations and requirements
In any event, we are committed to ensuring that the information we collect and use is appropriate for this purpose, and does not constitute an invasion of your privacy. In terms of being contacted for marketing purposes Kinley Securities Limited would contact you for additional consent.
3.7.5. Sharing personal data
Any third parties that we may share your data with are obliged to keep your details securely, and to use them only to fulfil the service they provide you on our behalf. When they no longer need your data to fulfil this service, they will dispose of the details in line with Kinley Securities Limited procedures. If we wish to pass your sensitive personal data onto a third party we will only do so once we have obtained your consent, unless we are legally required to do otherwise.
3.7.6. Use of personal data
Kinley Securities Limited will process (collect, store and use) the information you provide in a manner compatible with the Nigeria Data Protection Regulation (NDPR). We will endeavour to keep your information accurate and up to date, and not keep it for longer than is necessary. Personal data may be held in addition to these periods depending on individual business needs.
3.7.7. The personal data that Kinley Securities Limited holds about you
If Kinley Securities Limited does hold personal data about you, you can request the following information:
• Identity the contact details of the person or organisation that has determined how and why to process your data.
• Contact details of the data protection officer, where applicable.
• The purpose of the processing as well as the legal basis for processing. If the processing is based on the legitimate interests of Kinley Securities Limited or a third party, information about those interests.
• The categories of personal data collected, stored and processed.
• Recipient(s) or categories of recipients that the data is/will be disclosed to.
• If we intend to transfer the personal data to a third country or international organisation, information about how we ensure this is done securely.
• The National Information Technology Development Agency (NITDA) has approved sending personal data to some countries because they meet a minimum standard of data protection.
In other cases, we will ensure there are specific measures in place to secure your information.
• How long the data will be stored.
• Details of your rights to correct, erase, restrict or object to such processing.
• Information about your right to withdraw consent at any time.
• How to lodge a complaint with the supervisory authority.
• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.
• The source of personal data if it wasn’t collected directly from you.
• Any details and information of automated decision making, such as profiling, and
any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
3.7.8. What forms of ID will I need to provide in order to access this?
Kinley Securities Limited accepts:
Passport Photograph
National ID Card
Driver’s License
Voter’s card (Permanent)
Nigerian International passport
4. Cookie Policy
Our website does use cookies for the purposes of analytics. A detailed outline of cookies is listed below:
4.1. About cookies
A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.
Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.
Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.
4.2. Cookies that we do and do not use
We do and do not use cookies for the following purposes:
(a) authentication – we do not use cookies to identify you when you visit our website and as you navigate our website
(b) status – we do not use cookies to help us to determine if you are logged into our website
(c) personalisation – we do not use cookies to store information about your preferences and to personalise the website for you
(d) security – we do not use cookies, as an element of the security measures used to protect user accounts, including preventing fraudulent use of login credentials, and to protect our website and services generally, as we do not have these credentials located anywhere
(e) advertising – we do not use cookies to help us to display advertisements that will be relevant to you
(f) analysis – we do use cookies to help us to analyse the use and performance of our website and services. Cookies used for this purpose are listed in the table below
(g) cookie consent – we do use cookies to store your preferences in relation to the use of cookies more generally.
4.3. Cookies used by our service providers
Our service providers use cookies and those cookies may be stored on your computer when you visit our website.
We use Google Analytics to analyse the use of our website. Google Analytics gathers information about website use by means of cookies. The information gathered relating to our website is used to create reports about the use of our website. Google’s privacy policy is available at: https://www.google.com/policies/privacy/.
4.4. Managing cookies
Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links:
• https://support.google.com/chrome/answer/95647?hl=en (Chrome);
• https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-websitepreferences (Firefox);
• http://www.opera.com/help/tutorials/security/cookies/ (Opera);
• https://support.microsoft.com/en-gb/help/17442/windows-internet-explorerdelete-manage-cookies (Internet Explorer);
• https://support.apple.com/kb/PH21411 (Safari); and
• https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy (Edge).
Blocking all cookies will have a negative impact upon the usability of many websites. If you block cookies, you may not be able to use all of the features on our website.
Data Breach Policy
1 Introduction
1.1 Kinley Securities Limited collects, holds, processes, and shares personal data, a valuable asset that needs to be suitably protected.
1.2 Every care is taken to protect personal data from incidents (either accidentally or deliberately) to avoid a data protection breach that could compromise security.
1.3 Compromise of information, confidentiality, integrity, or availability may result in harm to individual(s), reputational damage, detrimental effect on service provision, legislative non-compliance, and/or financial costs.
2 Purpose and Scope
2.1 Kinley Securities Limited is obliged under Data Protection legislation to have in place an institutional framework designed to ensure the security of all personal data during its life cycle, including clear lines of responsibility.
2.2 This policy sets out the procedure to be followed to ensure a consistent and effective approach is in place for managing data breach and information security incidents across Kinley Securities Limited.
2.3 This policy relates to all personal and special categories (sensitive) data held by Kinley Securities Limited regardless of format.
2.4 This policy applies to all employee of Kinley Securities Limited. This includes temporary, out-source or agency staff and contractors, consultants, suppliers and data processors working for, or on behalf of the Kinley Securities Limited.
2.5 The objective of this policy is to contain any breaches, to minimise the risk associated with the breach and consider what action is necessary to secure personal data and prevent further breaches.
3 Definitions / Types of breach
3.1 For the purpose of this policy, data security breaches include both confirmed and suspected incidents.
3.2 An incident in the context of this policy is an event or action which may compromise the confidentiality, integrity or availability of systems or data, either accidentally or deliberately, and has caused or has the potential to cause damage to the Kinley Securities Limited information assets and / or reputation.
3.3 An incident includes but is not restricted to, the following:
3.3.1 loss or theft of confidential or sensitive data or equipment on which such data is stored (e.g., loss of laptop, USB stick, iPad / tablet device, or paper record);
3.3.2 equipment theft or failure;
3.3.3 system failure;
3.3.4 unauthorised use of, access to or modification of data or information systems;
3.3.5 attempts (failed or successful) to gain unauthorised access to information or IT system(s);
3.3.6 unauthorised disclosure of sensitive / confidential data;
3.3.7 website defacement;
3.3.8 hacking attack;
3.3.9 unforeseen circumstances such as a fire or flood;
3.3.10 human error;
3.3.11 ‘blagging’ offences where information is obtained by deceiving the organisation who holds it.
4 Reporting an incident
Any individual who accesses, uses or manages Kinley Securities Limited information is responsible for reporting data breach and information security incidents immediately to the Data Protection Officer via [email protected]
4.1 If the breach occurs or is discovered outside normal working hours, it must be reported as soon as is practicable.
4.2 The report must include full and accurate details of the incident, when the breach occurred (dates and times), who is reporting it, if the data relates to people, the nature of the information, and how many individuals are involved. An Incident Report Form should be completed as part of the reporting process (refer to [The data Breach report form]).
5 Containment and recovery
5.1 The Data Protection Officer (DPO) will first determine if the breach is still occurring. If so, the appropriate steps will be taken immediately to minimise the effect of the breach.
5.2 An initial assessment will be made by the DPO in liaison with relevant officer(s) to establish the severity of the breach and who will take the lead investigating the breach, as the Lead Investigation Officer (this will depend on the nature of the breach; in some cases, it could be the DPO).
5.3 The Data Protection Officer will establish whether there is anything that can be done to recover any losses and limit the damage the breach could cause.
5.4 The Data Protection Officer will establish who may need to be notified as part of the initial containment and will inform the police, where appropriate.
5.5 The Data Protection Officer, in liaison with the relevant officer(s) will determine the suitable course of action to be taken to ensure a resolution to the incident.
6 Investigation and risk assessment
6.1 An investigation will be undertaken by the DPO With the Head of Information Technology / Head Internal Control department immediately and wherever possible, within 24 hours of the breach being discovered / reported.
6.2 The DPO With the Head of Information Technology / Head of Internal Control department will investigate the breach and assess the risks associated with it, for example, the potential adverse consequences for individuals, how serious or substantial those are and how likely they are to occur.
6.3 The investigation will need to take into account the following:
6.3.1 the type of data involved;
6.3.2 its sensitivity;
6.3.3 the protections in place (e.g. encryptions);
6.3.4 what has happened to the data (e.g. has it been lost or stolen;
6.3.5 whether the data could be put to any illegal or inappropriate use;
6.3.6 data subject(s) affected by the breach, number of individuals involved and the potential effects on those data subject(s);
6.3.7 whether there are wider consequences to the breach.
7 Notification
7.1 The DPO with the Head of Information Technology / Head of Internal Control department, in consultation with relevant colleagues will establish whether the Authority will need to be notified of the breach, and if so, notify them within 72 hours of becoming aware of the breach, where feasible.
7.2 Every incident will be assessed on a case-by-case basis; however, the following will need to be considered:
7.2.1 whether the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms under Data Protection legislation;
7.2.2 whether notification would assist the individual(s) affected (e.g., could they act on the information to mitigate risks?);
7.2.3 whether notification would help prevent the unauthorised or unlawful use of personal data;
7.2.4 whether there are any legal / contractual notification requirements;
7.2.5 the dangers of over notifying. Not every incident warrant notification and over notification may cause disproportionate enquiries and work.
7.3 Individuals whose personal data has been affected by the incident, and where it has been considered likely to result in a high risk of adversely affecting that individual’s rights and freedoms, will be informed without undue delay. Notification will include a description of how and when the breach occurred and the data involved. Specific and clear advice will be given on what they can do to protect themselves, and include what action has already been taken to mitigate the risks. Individuals will also be provided with a way in which they can contact Kinley Securities Limited for further information or to ask questions on what has occurred.
7.4 The Data Protection Officer must consider notifying third parties such as the police, insurers, banks or credit card companies. This would be appropriate where illegal activity is known or is believed to have occurred, or where there is a risk that illegal activity might occur in the future.
7.5 A record will be kept of any personal data breach, regardless of whether notification was required.
8 Evaluation and response
8.1 Once the initial incident is contained, the DPO will carry out a full review of the causes of the breach; the effectiveness of the response(s) and whether any changes to systems, policies and procedures should be undertaken.
8.2 Existing controls will be reviewed to determine their adequacy, and whether any corrective action should be taken to minimise the risk of similar incidents occurring.
8.3 The review will consider:
8.3.1 where and how personal data is held and where and how it is stored;
8.3.2 where the biggest risks lie including identifying potential weak points within existing security measures;
8.3.3 whether methods of transmission are secure; sharing minimum amount of data necessary;
8.3.4 staff awareness;
8.3.5 implementing a data breach plan and identifying a group of individuals responsible for reacting to reported breaches of security.
8.4 If deemed necessary, a report recommending any changes to systems, policies and procedures will be considered by Kinley Securities Limited.
8 Policy Review
9.1 This policy will be updated as necessary to reflect best practice and to ensure compliance with any changes or amendments to relevant legislation.
9.2 This policy was last reviewed in August 2021.
DATA SUBJECT ACCESS REQUEST POLICY
1 About this Policy: scope, purpose and users
1.1 This procedure sets out the key features regarding handling or responding to requests for access to personal data made by data subjects, their representatives or other interested parties. This procedure will enable Kinley Securities Limited (further: “Company”) to comply with legal obligations, provide better customer care, improve transparency, enable individuals to verify that information held about them is accurate, and increase the level of trust by being open with individuals about the information that is held about them.
1.2 This procedure applies broadly across all entities or subsidiaries owned or operated by the Company but does not affect any state or local laws or regulations which may otherwise be applicable.
1.3 This procedure applies to employees that handle data subject access requests such as the Data Protection Officer.
2 Data Subject Access Request (DSAR)
2.1 A Data Subject Access Request (DSAR) is any request made by an individual or an individual’s legal representative for information held by the Company about that individual. The Data Subject Access Request provides the right for data subjects to see or view their own personal data as well as to request copies of the data.
2.2 A Data Subject Access Request must be made in writing. In general, verbal requests for information held about an individual are not valid DSARs.
2.3 A Data Subject Access Request can be made via any of the following methods: email or post. DSARs made on-line must be treated like any other Data Subject Access Requests when they are received, though the Company will not provide personal information via social media channels.
3 The Rights of a Data Subject
The rights to data subject access include the following:
3.1 Know whether a data controller holds any personal data about them.
3.2 Receive a description of the data held about them and, if permissible and practical, a copy of the data.
3.3 Be informed of the purpose(s) for which that data is being processed, and from where it was received.
3.4 Be informed whether the information is being disclosed to anyone apart from the original recipient of the data; and if so, the identity of those recipients.
3.5 The right of data portability. Data subjects can ask that their personal data be transferred to them or a third party in machine readable format (Word, PDF, etc.). However, such requests can only be fulfilled if the data in question is: 1) provided by the data subject to the Company, 2) is processed automatically and 3) is processed based on consent or fulfilment of a contract.
3.6 If the data is being used to make automated decisions about the data subject, to be told what logic the system uses to make those decisions and to be able to request human intervention.
The Company must provide a response to data subjects requesting access to their data within 30 calendar days of receiving the Data Subject Access Request unless local legislation dictates otherwise.
4 Requirements for a valid DSAR
4.1 In order to be able to respond to the Data Subject Access Requests in a timely manner, the data subject should:
(a) Submit his/her request using a Data Subject Access Request Form.
(b) Provide the Company with sufficient information to validate his/her identity (to ensure that the person requesting the information is the data subject or his/her authorized person).
4.4 Factors that can assist in narrowing the scope of a search include identifying the likely holder of the information (e.g. by making reference to a specific department), the time period in which the information was generated or processed (the narrower the time frame, the more likely a request is to succeed) and being specific about the nature of the data sought (e.g. a copy of a particular form or email records from within a particular department).
5. DSAR process
5.1 Request
Upon receipt of a DSAR, the Data Protection Team will log and acknowledge the request. The requestor may be asked to complete a Data Subject Access Request Form to better enable the Company to locate the relevant information.
5.2 Identify verification
The Data Protection Team needs to check the identity of anyone making a DSAR to ensure information is only given to the person who is entitled to it. If the identity of a DSAR requestor has not already been provided, the person receiving the request will ask the requestor to provide two forms of identification, one of which must be a photo identity and the other confirmation of address.
If the requestor is not the data subject, written confirmation that the requestor is authorized to act on behalf of the data subject is required.
5.3 Information for DSAR
Upon receipt of the required documents, the person receiving the request will provide the Data Protection Team with all relevant information in support of the DSAR. Where the Data Protection Team is reasonably satisfied with the information presented by the person who received the request, the Data Protection Officer will notify the requestor that his/her DSAR will be responded to within 30 calendar days. The 30 day period begins from the date that the required documents are received. The requestor will be informed by the Data Protection Team in writing if there will be any deviation from the 30 day time-frame due to other intervening events.
5.4 Review of Information
The Data Protection Team composed of cross department representative will collate the relevant and required information as requested in the DSAR.
The Data Protection Team must ensure that the information is reviewed/received by the imposed deadline to ensure the 30 calendar day time-frame is not breached. The Data Protection Officer will ask the relevant department to complete a “Data Subject Disclosure Form” to document compliance with the 30-day requirement.
5.5 Response to access requests
The Data Protection Team will provide the finalized response together with the information retrieved and/or a statement that the Company does not hold the information requested, or that an exemption applies.
The Data Protection Team will ensure that a written response will be sent back to the requestor. This will be via email, unless the requestor has specified another method by which they wish to receive the response (e.g., post).
The Company will only provide information via channels that are secure. When hard copies of information are posted, they will be sealed securely and sent by recorded delivery.
5.6 Archiving
After the response has been sent to the requestor, the DSAR will be considered closed and archived by the Data Protection Team.
6 Exemptions
6.1 An individual does not have the right to access information recorded about someone else, unless they are an authorized representative.
6.2 The Company is not required to respond to requests for information unless it is provided with sufficient details to enable the location of the information to be identified, and to satisfy itself as to the identity of the data subject making the request.
6.3 In principle, the Company will not normally disclose the following types of information in response to a Data Subject Access Request:
6.3.1 Information about other people – A Data Subject Access Request may cover information which relates to an individual or individuals other than the data subject. Access to such data will not be granted, unless the individuals involved consent to the disclosure of their data.
6.3.2 Repeat requests – Where a similar or identical request in relation to the same data subject has previously been complied with within a reasonable time period, and where there is no significant change in personal data held in relation to that data subject, any further request made within a six month period of the original request will be considered a repeat request, and the Company will not normally provide a further copy of the same data
6.3.3 Publicly available information – The Company is not required to provide copies of documents which are already in the public domain.
6.3.4 Opinions given in confidence or protected by copyright law – The Company does not have to disclose personal data held in relation to a data subject that is in the form of an opinion given in confidence or protected by copyright law.
7 DSAR Refusals
There are situations where individuals do not have a right to see information relating to them. For instance:
7.1 If the information is kept only for the purpose of statistics or research, and where the results of the statistical work or research are not made available in a form that identifies any of the individuals involved.
7.2 Requests made for other, non-data protection purposes can be rejected.
7.3 If the responsible person refuses a Data Subject Access Request on behalf of the Company, the reasons for the rejection must be clearly set out in writing. Any individual dissatisfied with the outcome of his/her Data Subject Access Request is entitled to make a request to the Data Protection Officer to review the outcome.
8 Responsibilities
8.1 The overall responsibility for ensuring compliance with a DSAR rests with the Data Protection Officer.
8.2 If the Company acts as a data controller towards the data subject making the request, then the DSAR will be addressed based on the provisions of this procedure.
8.3 If the Company acts as a data processor the Data Protection Officer will forward the request to the appropriate data controller on whose behalf the Company processes personal data of the data subject making the request.
- WEBSITE POLICY
- About this Policy
- This policy explains when and why we collect personal information about our website visitors, how we use it and how we keep it secure and your rights in relation to it.
- We may collect, use and store your personal data, as described in this Data Privacy Policy and as described when we collect data from you.
- We reserve the right to amend this Data Privacy Policy from time to time without prior notice. We may be required to amend this Data Privacy Policy due to regulations. For any significant changes you will be notified but you are advised to check our website for the latest Privacy Policy.
- We will always comply with the Nigeria Data Protection Regulation (NDPR) when dealing with your personal data. For the purposes of the NDPR, we will be the “controller” of all personal data we hold about you.
- Consenting to our use of cookies in accordance with the terms of this policy when you first visit our website permits us to use cookies every time you visit our website.
- Who are we?
We are Kinley Securities Limited.
We can be contacted at:
55, Campbell Street, Lagos Island, Lagos State, Nigeria
dpo@kinleysecuritiesltd.com or info@kinleysecurities.com
Tel: +234- 802 314 3570
- Collecting personal information.
The following types of personal information may be collected, stored, and used:
- information about your computer including your IP address, geographical location, browser type and version, and operating system;
- information about your visits to and use of this website including the referral source, length of visit, page views, and website navigation paths;
- information, such as your email address, that you enter when you register with our website;
- information that you enter when you create a profile on our website—for example, your name, profile pictures, gender, birthday, relationship status, interests and hobbies, educational details, and employment details;
- information, such as your name and email address, that you enter in order to set up subscriptions to our emails and/or newsletters;
- information that you enter while using the services on our website;
- information that is generated while using our website, including when, how often, and under what circumstances you use it;
- information relating to enquiries, complaints and feedback you make through our website, which includes your name, address, telephone number, email address, and credit card details;
- information that you post to our website with the intention of publishing it on the internet, which includes your user-name, profile pictures, and the content of your posts;
- information contained in any communications that you send to us by email or through our website, including its communication content and meta-data;
- any other personal information that you send to us.
Before you disclose to us the personal information of another person, you must obtain that person’s consent to both the disclosure and the processing of that personal information in accordance with this policy.
- Using your personal information
Personal information submitted to us through our website will be used for the purposes specified in this policy or on the relevant pages of the website. We may use your personal information for the following:
- administering our website and business;
- personalizing our website for you;
- enabling your use of the services available on our website;
- processing withdrawal applications on your retirement savings account (RSA) ;
- updating your profile on our database if need be;
- sending statements, invoices, and payment reminders to you, and collecting payments from you;
- sending you non-marketing commercial communications;
- sending you email notifications that you have specifically requested;
- sending you our email newsletter, if you have requested it (you can inform us at any time if you no longer require the newsletter);
- sending you marketing communications relating to our business or the businesses of carefully-selected third parties which we think may be of interest to you, by post or, where you have specifically agreed to this, by email or similar technology (you can inform us at any time if you no longer require marketing communications);
- providing third parties with statistical information about our users (but those third parties will not be able to identify any individual user from that information);
- dealing with inquiries and complaints made by or about you relating to our website;
- keeping our website secure and prevent fraud;
- verifying compliance with the terms and conditions governing the use of our website (including monitoring private messages sent through our website private messaging service);
If you submit personal information for publication on our website, we will publish and otherwise use that information in accordance with the license you grant to us.
Your privacy settings can be used to limit the publication of your information on our website and can be adjusted using privacy controls on the website.
We will not, without your express consent, supply your personal information to any third party for their or any other third party’s direct marketing.
- Disclosing personal information
We may disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers, or subcontractors as reasonably necessary for the purposes set out in this policy.
We may disclose your personal information to any member of our group of companies (this means our subsidiaries, our ultimate holding company and all its subsidiaries) as reasonably necessary for the purposes set out in this policy.
We may disclose your personal information:
- to the extent that we are required to do so by law;
- in connection with any ongoing or prospective legal proceedings;
- in order to establish, exercise, or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk);
- to the purchaser (or prospective purchaser) of any business or asset that we are (or are contemplating) selling; and
- to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that personal information. Except as provided in this policy, we will not provide your personal information to third parties.
- International data transfers
1. Information that we collect may be stored, processed in, and transferred between any of the countries in which we operate in order to enable us to use the information in accordance with this policy.
- Information that we collect may be transferred to the following countries which do not have data protection laws equivalent to those in force in Nigeria, the United States of America, Russia, Japan, China, and India.
- Personal information that you publish on our website or submit for publication on our website may be available, via the internet, around the world. We cannot prevent the use or misuse of such information by others.
- You expressly agree to the transfers of personal information described in this Section 6.
- Retaining personal information
1. This Section 7 sets out our data retention policies and procedure, which are designed to help ensure that we comply with our legal obligations regarding the retention and deletion of personal information.
2. Personal information that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
3. Without prejudice to article 7.2, we will usually delete personal data based on our data retention policy.
4. Notwithstanding the other provisions of this Section 7, we will retain documents (including electronic documents) containing personal data:
-
- to the extent that we are required to do so by law;
- if we believe that the documents may be relevant to any ongoing or prospective legal proceedings; and
- in order to establish, exercise, or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk).
8. Security of your personal information
1. We will take reasonable technical and organizational precautions to prevent the loss, misuse, or alteration of your personal information.
2. We will store all the personal information you provide on our secure (password- and firewall-protected) servers.
3. All electronic financial transactions entered into through our website will be protected by encryption technology.
4. You acknowledge that the transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet.
5. You are responsible for keeping the password you use for accessing our website confidential; we will not ask you for your password (except when you log in to our website).
9. Amendments
We may update this policy from time to time by publishing a new version on our website. You should check this page occasionally to ensure you understand any changes to this policy. We may notify you of changes to this policy by email or through the private messaging system on our website.
10. Third party websites
Our website includes hyper-links to, and details of, third party websites. We have no control over, and are not responsible for, the privacy policies and practices of third parties.
11. Updating information
Please let us know if the personal information that we hold about you needs to be corrected or updated.
12. Cookies
Our website uses cookies. A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.
Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.
- The names of the cookies that we use on our website, and the purposes for which they are used, are set out below:
- we use Google Analytics and Adwords on our website to recognize a computer when a user visits the website / track users as they navigate the website / enable the use of a shopping cart on the website / improve the website’s usability / analyze the use of the website / administer the website / prevent fraud and improve the security of the website / personalize the website for each user / target advertisements which may be of particular interest to specific users / describe purpose(s)];
- Most browsers allow you to refuse to accept cookies—for example:
- in Internet Explorer (version 10) you can block cookies using the cookie handling override settings available by clicking “Tools,” “Internet Options,” “Privacy,” and then “Advanced”;
- in Firefox (version 24) you can block all cookies by clicking “Tools,” “Options,” “Privacy,” selecting “Use custom settings for history” from the drop-down menu, and unticking “Accept cookies from sites”; and
- in Chrome (version 29), you can block all cookies by accessing the “Customize and control” menu, and clicking “Settings,” “Show advanced settings,” and “Content settings,” and then selecting “Block sites from setting any data” under the “Cookies” heading. Blocking all cookies will have a negative impact upon the usability of many websites. If you block cookies, you will not be able to use all the features on our website.
- You can delete cookies already stored on your computer—for example:
- in Internet Explorer (version 10), you must manually delete cookie files (you can find instructions for doing so at http://support.microsoft.com/kb/278835 );
- in Firefox (version 24), you can delete cookies by clicking “Tools,” “Options,” and “Privacy”, then selecting “Use custom settings for history”, clicking “Show Cookies,” and then clicking “Remove All Cookies”; and
- in Chrome (version 29), you can delete all cookies by accessing the “Customize and control” menu, and clicking “Settings,” “Show advanced settings,” and “Clear browsing data,” and then selecting “Delete cookies and other site and plug-in data” before clicking “Clear browsing data.”
- Deleting cookies will have a negative impact on the usability of many websites.
- Your rights
You may instruct us to provide you with any personal information we hold about you; provision of such information will be subject to the following:
- the payment of an administrative fee where applicable; and the supply of appropriate evidence of your identity we will usually accept a photocopy of your International Passport, Driver’s License, National ID Card, INEC Registration Card plus an original copy of a utility bill showing your current address.
- to access your personal data
- to be provided with information about how your personal data is processed
- to have your personal data corrected
- to have your personal data erased in certain circumstances
- to object to or restrict how your personal data is processed
- to have your personal data transferred to yourself or to another business in certain circumstances.
We may withhold personal information that you request to the extent permitted by law.
You may instruct us at any time not to process your personal information for marketing purposes.
In practice, you will usually either expressly agree in advance to our use of your personal information for marketing purposes, or we will provide you with an opportunity to opt out of the use of your personal information for marketing purposes.
For more details, please address any questions, comments and requests regarding our data processing practices to our Data Protection Officer via dpo@kinleysecuritiesltd.com.ng