Privacy policy

What personal data FIBI holds, why, and what you can ask us to do with it.

Last updated

This document is not yet in force. FIBI’s privacy policy is being prepared with legal counsel. The headings below show what it will cover. Nothing on this page creates rights or obligations, and it should not be relied on. For the risks of investing — which are set out in full and are current — read the risk disclosure.

1. Who is the data controller

Identifies the registered entity acting as data controller, its registration with the Office of the Data Protection Commissioner, and how to contact the data protection officer.

2. What data we collect

Covers account details, identity and verification documents collected to meet anti-money-laundering obligations, payment information, investment records, and technical data such as device and usage information.

3. Why we process it, and on what lawful basis

States a lawful basis for each purpose under the Data Protection Act 2019 — contract performance for administering investments, legal obligation for identity verification and record-keeping, legitimate interests for fraud prevention, and consent for marketing.

4. Who we share data with

Covers payment processors, identity verification providers, professional advisers, project counterparties, and disclosures required by law or by a regulator.

5. Transfers outside Kenya

Covers any processing outside Kenya and the safeguards relied on, as required where personal data leaves the jurisdiction.

6. How long we keep it

Sets retention periods by category, including the statutory minimum retention applying to anti-money-laundering records after an account closes.

7. Your rights

Covers the rights to be informed, to access, to correction, to erasure, to object, and to data portability, how to exercise each, and the right to complain to the Office of the Data Protection Commissioner.

8. Cookies and analytics

Covers cookies set by the platform, any analytics or advertising technology in use, and how to control them. Must match what the site actually sets — a policy describing tooling that is not deployed, or omitting tooling that is, is the most common compliance gap.

9. How we protect data

Covers technical and organisational security measures and the breach notification procedure.

10. Changes to this policy

Covers how material changes are notified and where prior versions sit.