This Data Protection Policy establishes Bizsure Insurance Brokers Limited's principles and internal requirements for responsible handling of personal data. It is intended to support compliance with Kenya's Data Protection Act, 2019 and applicable regulations and should be read together with Bizsure's information security, retention, incident response, HR and other relevant procedures. Reviewed annually and when material changes occur.
This Policy applies to personal data processed by Bizsure in electronic, paper or other form and applies to directors, employees, contractors, temporary staff and other persons who process personal data on Bizsure's behalf.
It covers personal data relating to prospective clients, policyholders, insured people, beneficiaries, dependants, claimants, third parties, employees, job applicants, suppliers, business contacts and website users.
Bizsure will process personal data in accordance with the principles required by Kenyan law. Personal data should be:
Management is responsible for ensuring that appropriate governance, resources and controls are in place. Bizsure will maintain records and procedures proportionate to its processing activities and risks.
A Data Protection Officer or designated privacy responsible person, where applicable, should coordinate compliance, advise on data protection obligations, support data-subject requests, maintain incident records, facilitate training and act as an appropriate point of contact with the ODPC.
Departments and staff remain responsible for protecting personal data within their day-to-day activities and must promptly escalate suspected breaches, unlawful disclosures, inappropriate access or other privacy concerns.
Bizsure should maintain an up-to-date understanding of the categories of personal data it processes, the relevant data subjects, sources, purposes, lawful grounds, recipients, systems, locations, retention periods and cross-border transfers.
New uses of personal data must be assessed before implementation. Personal data must not be repurposed incompatibly without an appropriate lawful basis, notice and, where required, consent.
Personal data should ordinarily be collected directly from the data subject unless indirect collection is permitted by law. Before or at the time of collection, Bizsure should provide an appropriate privacy notice explaining the collection, purpose, recipients, rights, security information, whether provision is mandatory or voluntary, and relevant consequences of failing to provide required information.
Forms and digital journeys should collect only information necessary for the stated insurance or business purpose.
Where Bizsure relies on consent, consent must be free, specific, informed, unambiguous and capable of being demonstrated. Consent should not be bundled unnecessarily with unrelated purposes.
Separate or explicit consent should be obtained where required by law, including for relevant sensitive data processing, direct marketing or international transfers. Withdrawal of consent must be made reasonably accessible.
Access to sensitive personal data must be limited to authorised people with a genuine business need. Health and medical information should be collected only where necessary for relevant insurance placement, underwriting, administration or claims purposes and shared only with authorised recipients.
Where children's or dependants' information is processed, Bizsure must apply age/relationship verification and obtain parental, guardian or other lawful authority where required.
Bizsure will maintain a process for receiving, verifying, recording and responding to requests relating to access, correction, objection, restriction, erasure, portability, consent withdrawal and automated decision-making rights.
Requests should be directed to info@bizsure.co.ke. Identity and authority should be verified proportionately. Requests and responses should be documented. Statutory timelines and permitted exemptions must be observed.
Personal data must not be used for direct marketing unless the applicable legal requirements are met. Marketing databases should record the source of contact information, consent/permission status and opt-out status where applicable.
Every direct marketing channel should provide a simple, free mechanism to opt out, and opt-out requests must be implemented promptly in accordance with applicable law. Sensitive personal data must not be used for direct marketing unless specifically lawful.
Reasonable steps should be taken to keep material client, policy, claims, contact and verification information accurate and up to date. Where inaccurate information is identified, it should be corrected or appropriately marked without undue delay, subject to legal record-keeping requirements.
Bizsure will maintain an approved retention schedule covering, at minimum, quotations, proposal forms, policy records, renewals, claims, complaints, verification/KYC records, accounting records, employee records, supplier records, marketing records and website logs.
Records should not be kept indefinitely because storage is available. When retention is no longer justified, information should be securely destroyed, deleted, anonymised or pseudonymised as appropriate, while preserving records that must be retained by law or for legitimate legal claims.
Bizsure will implement safeguards proportionate to risk. Controls should include, as appropriate:
Before engaging a service provider that will process personal data, Bizsure should conduct proportionate due diligence on the provider's ability to protect personal data.
Where required, a written data-processing agreement must define the subject matter and duration of processing, nature and purpose, categories of data and data subjects, confidentiality, security, breach reporting, use of sub-processors, assistance with data-subject rights, return/deletion of data, audit rights and the requirement to process only on Bizsure's documented instructions.
Personal data should be shared only where there is a lawful purpose, and the disclosure is necessary and proportionate. Staff must verify the identity and authority of recipients before disclosing personal data.
Routine sharing arrangements with insurers, administrators, verification providers and other organisations should be documented and reviewed. High-risk or large-scale data-sharing arrangements should be subject to additional assessment and contractual controls.
Before transferring personal data outside Kenya, Bizsure must identify the destination, recipient, purpose and applicable transfer mechanism and document the safeguards relied upon. Contracts with overseas recipients should contain appropriate data-protection provisions.
Where sensitive personal data is transferred outside Kenya, the additional requirements of the Act and Regulations, including consent where required, must be observed.
Privacy and data protection should be considered when designing new systems, digital forms, APIs, integrations, products, databases or material processing activities.
A Data Protection Impact Assessment (DPIA) should be conducted before high-risk processing where required by law or where proposed activity is likely to create significant risks to the rights and freedoms of individuals. Identified risks should be mitigated before deployment and the assessment retained as part of Bizsure's compliance records.
All staff and contractors must immediately report suspected loss, unauthorised disclosure, cyberattack, misdirected email, stolen device, compromised account or other personal-data incident through Bizsure's incident escalation procedure.
Bizsure will contain and investigate the incident, assess the affected data and likely harm, preserve evidence, record the facts/effects/remedial action and determine notification obligations. Where the statutory threshold is met, the Data Commissioner must be notified without delay and within 72 hours of Bizsure becoming aware of the breach. A processor should notify the controller without delay and, where reasonably practicable, within 48 hours of becoming aware of a breach. Affected individuals will be notified where required by law.
Bizsure must assess any automated or AI-enabled system that uses personal data for quotation triage, profiling, fraud detection, customer service or other decisions.
Personal data entered into external AI tools must not be disclosed unless the tool has been approved for the relevant data and appropriate contractual, security and privacy safeguards are in place. Staff should not enter confidential client information, identification numbers, health information, policy documents or claims records into unapproved public AI services.
Where a decision is based solely on automated processing and produces legal or similarly significant effects, Bizsure will observe the applicable rights and safeguards under Kenyan law.
People with access to personal data must receive appropriate privacy and security awareness training. Staff must understand that client, claims, medical, financial, employee and other personal information is confidential and may be accessed or disclosed only for authorised purposes.
Bizsure will periodically review this Policy, its processing activities, security controls, service-provider arrangements, data-subject request handling, retention practices and website privacy notices. Material non-compliance should be escalated to management and remedial action tracked to completion.