Understanding Our Data Protection and Privacy Policy in Kenya

In today’s fast-paced digital economy, data breaches and unauthorized access pose significant threats to businesses and individuals alike. Our Data Protection and Privacy Policy in Kenya is not just a legal formality; it is a core pillar of our corporate governance.

This policy applies to all clients, website visitors, job applicants, and third-party vendors who interact with Alkam & Mulila LLP. It serves as a transparent roadmap, detailing how our firm acts as a registered Data Controller and Data Processor under Kenyan law to guarantee the absolute confidentiality of your financial records.

The Types of Personal and Corporate Data We Collect

To provide our expert financial and advisory services, we must collect specific information. In accordance with our Data Protection and Privacy Policy in Kenya, we practice “data minimization,” meaning we only collect the data absolutely necessary for our stated purposes. The categories of data we collect include:

• Identity Data: Full names, National ID or Passport numbers, KRA PINs, and job titles.

• Contact Data: Billing addresses, email addresses, and telephone numbers.

• Financial Data: Bank account details, payroll records, tax statements, and historical corporate ledgers necessary for our audit and accountancy services.

• Technical Data: Internet Protocol (IP) addresses, browser types, and operating systems collected automatically when you browse our website.

• Employment Data: Resumes, educational backgrounds, and professional references submitted through our “We Are Hiring” portal.

How We Use Your Information

Transparency is a fundamental requirement of any compliant Data Protection and Privacy Policy in Kenya. We utilize the data we collect exclusively for the following professional purposes:

1. Service Delivery: To perform statutory audits, manage corporate bookkeeping, and file accurate KRA tax returns on your behalf.

2. Statutory Compliance: To register your business, update shareholding records, and file annual returns with the Business Registration Service (BRS).

3. Client Communication: To send you important updates regarding your accounts, changes in tax laws, or responses to your customer service inquiries.

4. Internal Operations: To optimize our website’s performance, conduct internal data analysis, and improve our service offerings.

The Lawful Basis for Processing Your Data

Under the Data Protection Act, 2019, businesses cannot process personal data without a clear legal justification. As a strictly compliant firm, our Data Protection and Privacy Policy in Kenya relies on the following lawful bases:

• Performance of a Contract: We process your data to fulfill the obligations outlined in our signed engagement letters for accounting and audit services.

• Legal Obligation: We are legally required to process and retain certain financial information to comply with ICPAK reporting standards and national tax regulations.

• Explicit Consent: When you voluntarily subscribe to our newsletter or submit a job application, you provide explicit consent for us to process your data. You may withdraw this consent at any time.

Data Sharing and Third-Party Disclosures

Alkam & Mulila LLP will never sell, rent, or illegally trade your personal or corporate data to unauthorized third parties. However, as stated in this Data Protection and Privacy Policy in Kenya, we may share your data with trusted entities under strict confidentiality agreements, including:

• Government Authorities: We routinely submit necessary financial and corporate data to the KRA, BRS, and other regulatory bodies as part of our agreed-upon company secretarial services.

• Technology Providers: We utilize secure, cloud-based accounting software (such as Xero or QuickBooks) whose servers may be hosted internationally. We ensure these third-party processors comply with stringent global data privacy standards.

• Legal Mandates: We may disclose your information if required to do so by a court order or to protect the legal rights and safety of our firm.

Data Security Safeguards and Retention

We take the security of your financial data incredibly seriously. A robust Data Protection and Privacy Policy in Kenya requires aggressive technical and organizational safeguards.

At Alkam & Mulila LLP, we employ advanced encryption protocols, secure firewall configurations, and strict role-based access controls. Only authorized personnel working directly on your portfolio have access to your sensitive files.

Furthermore, we do not keep your data forever. In alignment with ICPAK regulations, we retain corporate financial and audit records for a standard period of seven (7) years. Once this retention period expires, your data is securely and permanently destroyed.

Your Rights as a Data Subject

The Data Protection Act, 2019, grants you specific fundamental rights regarding your personal information. Through our Data Protection and Privacy Policy in Kenya, we guarantee your ability to exercise the following rights:

• The Right to Be Informed: You have the right to know exactly how your data is being used.

• The Right of Access: You may request a digital copy of the personal data we hold about you.

• The Right to Rectification: You can request that we correct any inaccurate or incomplete financial data.

• The Right to Erasure: Also known as the “right to be forgotten,” you may request the deletion of your data, provided it does not conflict with our legal data retention obligations.

• The Right to Object: You may object to the processing of your data for direct marketing purposes.

To exercise any of these rights, please contact our Data Protection Officer using the details provided at the bottom of this page.

Frequently Asked Questions (FAQ)

Why does an accounting firm need a Data Protection and Privacy Policy in Kenya?

Because accounting firms handle highly sensitive financial data, KRA PINs, and payroll information, a comprehensive Data Protection and Privacy Policy in Kenya is legally required by the ODPC to ensure this information is protected from cyber threats and unauthorized sharing.

Is my corporate data transferred outside of Kenya?

In some instances, yes. We use top-tier, international cloud accounting software. However, our Data Protection and Privacy Policy in Kenya dictates that we only partner with global providers who offer cross-border security measures that meet or exceed local Kenyan regulations.

How often is this Data Protection and Privacy Policy in Kenya updated?

We review and update our Data Protection and Privacy Policy in Kenya annually, or whenever there are significant amendments to the Data Protection Act, 2019, ensuring our clients always benefit from the highest standard of legal compliance.

What should I do if I suspect a data breach?

If you believe your personal or corporate information has been compromised, contact our Data Protection Officer immediately. We have strict internal protocols to investigate, mitigate, and report any breaches to the ODPC within the legally mandated 72-hour window.