Privacy Policy

1. WHO WE ARE

Development Bank of Kenya Limited registered office at Finance House 16^th Floor, Loita St, Nairobi, Kenya, we are the data controller responsible for your personal information when you subscribe to and access/ use any of our services available in our banking and non-banking subsidiaries. The services may be subscribed to/ accessed via personal contact, Development Bank of Kenya Limited’s websites, mobile app, and via telephone.

Our Privacy Policy explain our information (including correspondences) practices, including the information we process to support our Services.

This Privacy Policy applies to all Development Bank of Kenya services unless specified otherwise.

Please also read Terms and Conditions (“Terms”), which describe the terms under which you access and use our Services.

2. DEFINITIONS AND INTERPRETATION

For the purposes of this Privacy Policy, the following definitions apply:

• “Applicable Law”means the Constitution of the Republic of Kenya, all Acts of Parliament including regulations, rules, guidelines, guidance noted issued pursuant to the any Act of Parliament, legislative and regulatory requirements, and codes of practice applicable to the processing of personal data and/or applicable to a data controller or data processor as may be amended from time to time;
• “Personal Data”means any information relating to an identified or identifiable natural person (hereinafter “Data Subject”). For clarity, an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of such a natural person;
• “Controller”means the natural or legal person, authority, organization or other agency that makes decisions individually or together with other parties regarding the purposes and means for processing Personal Data;
• “Development Bank of Kenya Limited”includes all the subsidiaries and affiliates (hereafter referred to as “DBK”, “we”, “us” or “our”);
• “Processing” means an operation or activity or set of operations or activities performed on personal data whether or not by automated means;
• “Processor” is a natural or legal person, authority, organization or other agency that processesPersonal Data on behalf of the Controller.
• “Sub-processor” is the contractual partner of the Processor, engaged to carry out specificprocessing activities on behalf of the Processor and/or Controller.
• “Third Party” means a natural or legal person, public authority, agency or body other than the Data Subject, Controller, Processor, Sub-processor, and persons who, under the direct authority of the Controller, Processor or Sub-processor, are authorized to process Personal Data;
• “Website” means the website of DBK which is accessible through [https://www.devbank.com/]; and
• “Online and Mobile Banking Services” means the services we offer on our online and mobile platforms.

3. INFORMATION WE COLLECT

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you (“Personal Data”). The types of information we receive and collect depend on how you use our Services. Personally identifiable information may include, but not limited to:

• Identity data: includes name, username or similar identifier, Identity card/Passport number, PIN number, photo, marital status, fingerprints, Gender, nationality, ethnic or social origin, title, date of birth, and any other similar information;
• Contact data: includes postal address, physical address, email address and telephone numbers;
• Financial data: includes any bank account details and other electronic or non-electronic payment details;
• Transaction data: includes details about payments to and from you and other details of products and services you have acquired from us;
• Technical data: includes internet protocol (IP) address, your login identity data, browser type and version, time zone setting and location, browser plug-in types and versions, device information, operating system and platform, and other technology on the devices you use to access our systems;
• Profile data: includes your profile identification information, purchases or orders made by you, your interests, preferences, feedback and survey responses;
• Usage data: includes information about how you use our website, products and services;
• Marketing and communications data: includes your preferences in receiving marketing information from us and our third parties and your communication preferences;
• Biometric data: includes fingerprints, images, voice and other similar information, surveillance footages by CCTV cameras on our premises;
• We also collect, use and share aggregated data such as statistical or demographic data. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

4. HOW YOUR PERSONAL DATA IS COLLECTED

• Information you give us: This is information about you that you give us by filling in forms that we give to you or by corresponding with us by phone, e-mail or otherwise. We use different methods to collect data from and about you including through direct interactions. This includes the personal data you provide when you:
  1. Apply for or use our products or services;
  2. Open an account(s) with us;
  3. Subscribe to our services or publications;
  4. Request marketing information to be sent to you;
  5. Enter a competition, promotion or survey; or
  6. Give us feedback or contact us.
  7. Pay using our services.
• Information we collect about you: With regard to each of your user visits to our Website and your use of the Online and Mobile Banking Services we will automatically collect the following information:

1. Technical information, including the Internet protocol (IP) address used to connect your computer or mobile phone to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies;
2. Information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page and any phone number used to call our customer service number; and

• Information we receive from other sources:

1. Personal Data from third parties. We will receive Personal Data about you from various third parties to whom you have consented and public sources including but not limited to: companies registry, lands registry and other government registries; service providers we interact or integrate with now or in future; Integrated Personal Registration Systems, Kenya Revenue Authority and the National Transport and Safety Authority database.
2. Publicly accessible sources not listed above. We may also collect information about you from trusted partners, not listed above, who provide us with information about potential customers of our products and services;
3. We receive your Personal Data from third parties, where you purchase any of our products or services through such third parties; and
4. We collect Personal Data that you manifestly choose to make public, including via social media (e.g., we may collect information from your social media profile(s), to the extent that you choose to make your profile publicly visible.

• Our Website: may include links to third-party websites, plug-ins, cookies and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites or influence the data collected and are not responsible for their privacy policies. When you leave our Website, we encourage you to read the privacy policy of every website you visit and understand your rights therein.
• It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. If case you wish to correct or update your Personal Data that we hold, you may do so by writing to us at dbk@devbank.com

5. HOW WE USE INFORMATION

• We will only use your Personal Data where we have your consent or a legal basis to process the same. Most commonly, we will use your Personal Data in the following circumstances:

1. Where we need to perform the agreement we are about to enter into or have entered into with you;
2. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service or product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests; and/or
3. Where we need to comply with a legal obligation.

• We have set out below, in a table format, a description of all the ways we plan to use your Personal Data, and the basis we rely on to do so. We have also identified what our legitimate interests are where appropriate. Note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data.

6. AUTOMATED DECISION MAKING

If you apply to us for a product, your application may be processed by an automated decision making process which may carry out credit and affordability assessment checks to determine whether your application will be accepted. Where these automated processes suggest that your application should be rejected, we will manually review your application before making a final decision. We may also use automated processes to decide credit limits, to make decisions and to prevent money laundering, terrorism, fraud and other financial crime

7. INFORMATION SHARING

We may disclose your Personal Data to other entities with the affiliates of DBK, for legitimate business purposes (including providing services to you and operating our sites and systems), in accordance with applicable law. In addition, we may disclose your Personal Data to:

1. Government (including law enforcement) authorities and regulators e.g. Central Bank of Kenya
2. Other financial institutions through which your transactions are processed;
3. Other companies and financial institutions that we work with to provide services to you e.g. technology service providers, credit reference bureaus, employers, debt collection agencies and outsourced services vendors; fraud prevention/detection, private investigators, agencies tasked with conducting surveys on behalf of DBK group.
4. Third parties with accruing legal obligations e.g. Trustees and executors, guarantors, anyone holding a power of attorney to operate an account on your behalf and joint account holders;
5. Third parties with reference to acquisition, merger, asset sales, restructuring or by legal obligation or otherwise. We may also transfer your personal data to any of our subsidiaries, new owners, successor entities, or in case of change of business; your personal data may be used in the same way as this privacy policy;
6. Third parties who are service providers acting as processors, professional advisers including lawyers, bankers, auditors and those who provide consultancy, banking, legal, insurance and accounting services.
7. Restricted or publicly accessible government repository as a verification procedure in compliance with regulations.
8. Regulatory authorities, police or security agencies, courts of law or statutory authorities in response to litigation and demand issued on legal/regulatory grounds in accordance to the law.
9. Agencies tasked with conducting surveys on behalf of DBK
10. Emergency and disaster response providers in cases where a person’s health and safety is at stake when an emergency call is made.
11. Persons involved in delivering DBK products and services you use or order

We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

8. RETENTION AND DISPOSAL OF DATA

• We will only retain your Personal Data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
• To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
• By law we have to keep basic information about our customers (including contact, identity, financial and transaction data) for a minimum of seven years after they cease being customers. Our internal policy as amended from time to time may also require us to keep customer data for a longer period.
• In some circumstances, we will anonymize your Personal Data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. DISCLOSURE OF DATA

All of our rights and obligations under our Privacy Policy are freely assignable by us to any of our affiliates, in connection with a merger, acquisition, restructuring, or sale of assets, or by operation of law or otherwise, and we may transfer your information to any of our affiliates, successor entities, or new owner.

10. YOUR DATA PROTECTION RIGHTS

• Subject to legal and contractual exceptions, you have rights under applicable laws in relation to your Personal Data. These are listed below:
  1. Right to be informed that we are collecting your personal information and how we are processing it;
  2. Right to rectify your personal data where it is inaccurate or incomplete;
  3. Right to withdraw or objection your consent to processing of your personal data. However, we may continue processing your personal data for legitimate interests or legal grounds;
  4. Right to be forgotten, noting that we may continue to retain your information if we are entitled to do so or obliged by law;
  5. Right to access your Personal Data in our possession;
  6. Right to not be subjected to profiling or automated decision making data processes in regards to your data. However we may decline your request if we are obliged by law or entitled to do so;
  7. Right to request your personal data be processed in a restricted manner. Note that we may continue processing data and reject the request if we are entitled to or legally obliged;
  8. Right to data portability in a manner we may deem appropriate such as electronic format;
• We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
• We try to respond to all legitimate requests within reasonable time. Occasionally it could take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

11. HOW WE PROCESS YOUR INFORMATION

• The legal bases we rely on in certain instances when processing your data are:

1. Your Consent:

For collecting and using information you allow us to receive through the device-based settings when you enable them (such as access to your GPS location, camera, or photos), so we can provide the features and services described when you enable the settings. When we process data you provide to us based on your consent, you have the right to withdraw your consent at any time and to port that data you provide to us, under the Data Protection Act.

1. Our legitimate interests or the legitimate interests of a third party, where not outweighed by your interests or fundamental rights and freedoms (“legitimate interests”):

For people under the age of majority (under 18, in most EU countries and Kenya) who have a limited ability to enter into an enforceable contract only, we may be unable to process personal data on the grounds of contractual necessity. Nevertheless, when such a person uses our Services, it is in our legitimate interests:

• To provide, improve, customize, and support our Services as described in Our Services;
• To promote safety and security; and
• To communicate with you, for example, on Service-related issues.

The legitimate interests we rely on for this processing are:

• To create, provide, support, and maintain innovative Services and features that enable people under the age of majority to express themselves, communicate, discover, and engage with information and businesses relevant to their interests, build community, and utilize tools and features that promote their well-being;
• To secure our platform and network, verify accounts and activity, combat harmful conduct, detect and prevent spam and other bad experiences, and keep our Services and all of the Development Bank of Kenya and it’s Subsidiaries Products free of harmful or inappropriate content, and investigate suspicious activity or violations of our terms or policies and to protect the safety of people under the age of majority, including to prevent exploitation or other harms to which such individuals may be particularly vulnerable.

1. For all people, including those under the age of majority:

For providing measurement, analytics, and other business services where we are processing data as a controller. The legitimate interests we rely on for this processing are:

• To provide accurate and reliable reporting to businesses and other partners, to ensure accurate pricing and statistics on performance, and to demonstrate the value our partners realise using our Services; and
• In the interests of businesses and other partners to help them understand their customers and improve their businesses, validate our pricing models, and evaluate the effectiveness and distribution of their services and messages, and understand how people interact with them on our Services.

1. For providing marketing communications to you. The legitimate interests we rely on for this processing are:
   • To promote Development Bank of Kenya and its Subsidiaries Products and issue direct marketing.
   • To share information with others including law enforcement and to respond to legal requests. See our Privacy Policy under Law and Protection for more information. The legitimate interests we rely on for this processing are:
   • To prevent and address fraud, unauthorized use of the Development Bank of Kenya and its Subsidiaries Products, violations of our terms and policies, or other harmful or illegal activity; to protect ourselves (including our rights, property or Products), our users or others, including as part of investigations or regulatory inquiries; or to prevent death or imminent bodily harm.
   • To share information with the Development Bank of Kenya and its subsidiaries to promote safety and security. See our Privacy Policy under “How We Work with Other Development Bank of Kenya and its subsidiaries”
   • To secure systems and fight spam, threats, abuse, or infringement activities and promote safety and security across the Development Bank of Kenya and its Subsidiaries Products. You have the right to object to, and seek restriction of, such processing; to exercise your rights, visit How You Exercise Your Rights section of the Privacy Policy. We will consider several factors when assessing an objection including: our users’ reasonable expectations; the benefits and risks to you, us, other users, or third parties; and other available means to achieve the same purpose that may be less invasive and do not require disproportional effort. Your objection will be upheld, and we will cease processing your information, unless the processing is based on compelling legitimate grounds or is needed for legal reasons.
   • If you are under the age of majority in your country and have a limited ability to enter an enforceable contract, we will take particular account of the fact that you are below the age of majority and adjust our assessment of our legitimate interests and the balancing of your interests and rights accordingly.

1. Compliance with a legal obligation:

For processing data when the law requires it, including, for example, if there is a valid legal request for certain data.

1. Protection of your vital interests or those of another person:

The vital interests we rely on for this processing include protection of your life or physical integrity or that of others, and we rely on it to combat harmful conduct and promote safety and security, for example, when we are investigating reports of harmful conduct or when someone needs help.

1. Tasks carried out in the public interest:

For undertaking research and to promote safety and security, as described in more detail in our Privacy Policy under How We Use Information, where this is necessary in the public interest as laid down by the Data Protection Act to which we are subject.

When we process your data as necessary for a task carried out in the public interest, you have the right to object to, and seek restriction of, our processing. In evaluating an objection, we’ll evaluate several factors, including: reasonable user expectations; the benefits and risks to you and third parties; and other available means to achieve the same purpose that may be less invasive and do not require disproportional effort.

Your objection will be upheld, and we will cease processing your information, unless the processing is based on compelling legitimate grounds or is needed for legal reasons.

12. COOKIES

13.1 About cookies

A cookie is a small text file that a website you visit asks your browser to store on your computer or mobile device.

13.2 How we use cookies

We use cookies to understand, secure, operate, and provide our Services. For example, we use cookies:

• To provide Development Bank of Kenya for web and desktop and other Services that are web-based, improve your experiences, understand how our Services are being used, and customize our Services;
• To understand which of our FAQs are most popular and to show you relevant content related to our Services;
• To remember your choices, such as your language preferences, and otherwise to customize our Services for you; and
• To rank the FAQs on our website based on popularity, understand mobile versus desktop users of our web-based Services, or understand popularity and effectiveness of certain of our web pages.

13.3 How to control cookies

Many web browsers are automatically set to accept cookies. You may change your computer’s web browser settings to either reject cookies or notify you when a cookie is about to be placed on your computer. Please note, however, that rejecting cookies while visiting our Website may result in certain parts of the website not operating as efficiently as if the cookies were allowed.

13. THE USE OF HYPERLINKS

• Other URLs may be referenced through hyperlinks on our website. Clicking on these links may open webpages operated by third parties not associated with us. These hyperlinks are for the dissemination of information and for you to have a good user experience.
• By clicking on a hyperlink, you will leave the DBK webpage and accordingly be subject to the terms of use, privacy and cookie policies of the other website that you choose to visit. By navigating to an externally linked website on the DBK webpage, you will be exiting our website and you will be exposed to new terms of use, privacy policy and cookie policies of the website you have visited. We do not in any way promote, recommend, endorse, guarantee or approve a third party products and services offered through hyperlinks for external webpages. Material or content found in hyperlinks for external websites is not in our control and data processing is in accordance to their privacy policy.

14. PERSONAL DATA TRANSFERS OUTSIDE KENYA

• We may need to transfer or store your information in another jurisdiction to fulfill a legal obligation, for our legitimate interest and to protect the public interest.
• If the other jurisdiction does not have the same level of protection for Personal Data, when we do process the data, we shall put in place appropriate safeguards e.g. contractual commitments to ensure the data is adequately protected.
• We ensure your Personal Data is protected by requiring all our related companies to follow the same rules when processing your Personal Data.
• Where third parties are based in other jurisdictions, their processing of your Personal Data will involve a transfer of data to their jurisdiction.

15. UPDATES TO OUR POLICY

We will notify you before we make changes to this Privacy Policy and give you the opportunity to review the revised Privacy Policy before you choose to continue using our Services.

16. CONTACT INFORMATION

If you have questions about our Privacy Policy, please contact us or write us here:

Development Bank of Kenya LTD

16th Floor, Finance House. Loita St

P.O. Box 30483-00100

Nairobi, Kenya.

Tel: + 254 20 3340401

Email: dpo@devbank.com