Privacy Policy

Bizsure Insurance Brokers Limited is an insurance brokerage operating in Kenya. For personal data for which Bizsure determines the purposes and means of processing, Bizsure acts as a data controller. In some circumstances, Bizsure may process information on behalf of another organisation and may act as a data processor.

Contact details:

Bizsure Insurance Brokers Limited

Postal Address

P.o Box 2248-00100, Nairobi.

Telephone

0710 890994/ 0709 784222

Email

info@bizsure.co.ke

Privacy/Data Protection Contact

Caroline Chege - 0710890994

ODPC Registration Number(s), where applicable

Data controller&: 761-813C-72CE

Depending on the service requested, we may collect or receive:

• Identification information, including name, national identification/passport details, date of birth and other information required for identification or regulatory purposes.
• Contact information, including telephone number, email address and postal or physical contact details.
• Insurance information, including policy details, insurance history, risk information, beneficiaries, dependants and information needed to obtain, place, administer or renew cover.
• Vehicle and asset information, including vehicle registration, ownership, valuation, property and other insured-asset details.
• Financial and transaction information, including premium, payment and billing information. Bizsure should avoid storing full payment-card credentials unless specifically required and appropriately secured.
• Claims information, including accident, loss, damage, witness, third-party and supporting documentation.
• Health and medical information where necessary for medical, life, personal accident or related insurance products and claims. Health information is sensitive personal data and is handled with additional safeguards.
• Employment and business information where required for corporate, employee benefits, WIBA, liability or other commercial insurance.
• Communications, including enquiries, complaints, correspondence and records of interactions with us.
• Website and device information, such as IP address, browser/device information, pages visited and cookie or analytics data where such technologies are enabled.
• Any other information you voluntarily provide or that is reasonably required to provide the service requested.

We may collect personal data directly from you through our website, quotation forms, email, telephone, WhatsApp, physical forms, meetings or other communications.

Where permitted by law, we may also obtain relevant information from insurers, underwriters, loss assessors, medical providers, employers, authorised representatives, public registers, regulatory or government verification systems, financial institutions, service providers and other lawful sources.

Where we collect information indirectly, we will do so only where there is an appropriate lawful basis and in accordance with applicable data protection requirements.

We may process personal data to:

• respond to enquiries and quotation requests;
• assess insurance requirements and obtain quotations from insurers;
• arrange, place, administer, renew, amend or cancel insurance cover;
• verify identity, vehicle, asset or other relevant information;
• facilitate premium collection and payment administration;
• support and administer insurance claims;
• communicate policy, renewal, claims and service information;
• provide customer support and handle complaints;
• comply with legal, regulatory, audit, tax, anti-fraud and record-keeping obligations;
• prevent or investigate fraud, misuse, security incidents and other unlawful activity;
• improve our services, website and customer experience;
• maintain appropriate business and operational records; and
• send marketing communications where permitted and where the required consent or other lawful authority exists.

We will not use personal data for a purpose that is incompatible with the purpose for which it was collected unless permitted by law and, where required, after providing further notice or obtaining consent.

Depending on the circumstances, our processing may be based on one or more lawful grounds recognised under Kenyan law, including your consent, steps necessary to enter into or perform a contract, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest where applicable, or legitimate interests that do not override your rights and freedoms.

Where the law requires explicit consent for processing, including certain uses of sensitive personal data or cross-border transfers, we will seek that consent where applicable.

Insurance services may require the processing of sensitive personal data, particularly health information and financial/property information. We limit collection of sensitive information to what is necessary for the relevant insurance, underwriting, claims, verification, legal or regulatory purpose and apply appropriate safeguards.

Where information about children or dependants is required for insurance cover, we will seek appropriate information and authorisation from a parent, guardian or other legally authorised person as required by law.

Where necessary and lawful, we may share relevant personal data with:

• insurance companies, reinsurers and underwriting partners;
• medical providers, medical administrators and related health-service providers where relevant;
• loss assessors, investigators, surveyors, valuers, garages, repairers and claims service providers;
• government agencies, regulators, courts, law-enforcement bodies or statutory authorities where required or permitted by law;
• identity, vehicle or other verification service providers and authorised data sources;
• banks, payment service providers, accountants and auditors;
• technology, cloud hosting, communications, cybersecurity, document-management and professional service providers;
• lawyers and other professional advisers; and
• other parties authorised by you or reasonably necessary to provide the requested service.

We seek to disclose only the personal data reasonably necessary for the relevant purpose and require service providers to handle personal data on our behalf to protect it appropriately.

Some insurers, reinsurers, international medical networks, technology providers, cloud platforms or other service providers may process or store personal data outside Kenya.

Where personal data is transferred outside Kenya, Bizsure will take reasonable steps to ensure that the transfer is permitted under the Data Protection Act and applicable regulations, including by relying on an applicable adequacy basis, appropriate safeguards, contractual protections, necessity recognised by law or explicit consent where required. Sensitive personal data will be transferred in accordance with the additional requirements applicable to such data.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet insurance, contractual, legal, regulatory, tax, accounting, claims, dispute-resolution and legitimate record-keeping requirements.

Retention periods may differ according to the type of record and applicable obligations. At the end of the applicable retention period, information will be securely deleted, destroyed, anonymised or otherwise handled in accordance with our retention procedures, unless continued retention is required or permitted by law.

We use reasonable technical, organisational and physical safeguards appropriate to the nature and sensitivity of the information we handle. These may include access controls, passwords and authentication measures, malware protection, firewalls, secure backups, encryption where appropriate, confidentiality obligations, staff awareness, restricted physical access and procedures for managing security incidents.

No internet transmission or information system can be guaranteed to be completely secure. We therefore continually review safeguards considering risk and operational requirements.

Where a personal data breach occurs, Bizsure will assess the incident and take appropriate containment and remediation steps. Where a breach creates a real risk of harm and notification is required by Kenyan law, Bizsure will notify the Data Commissioner without delay and within the applicable statutory period and communicate with affected data subjects where required.

Subject to applicable law and any lawful limitations or exemptions, you may have the right to:

• be informed about the use of your personal data;
• request access to personal data held about you;
• object to or request restriction of certain processing;
• request correction of inaccurate, false or misleading information;
• request deletion/erasure where the applicable legal conditions are met;
• withdraw consent where processing is based on consent, without affecting prior lawful processing;
• request data portability where applicable;
• object to direct marketing; and
• request reconsideration of certain decisions based solely on automated processing where applicable.

To exercise a right, contact info@bizsure.co.ke We may need to verify your identity before acting on a request. Some information may need to be retained despite a request for deletion where retention is required by law, necessary for a legal claim or otherwise permitted by applicable law.

We will use personal data for direct marketing only in accordance with applicable law. Where consent is required, we will seek it. Marketing communications should provide a clear and simple way to opt out. You may withdraw from direct marketing at any time without charge by using the unsubscribe/opt-out mechanism provided or contacting us.

Opting out of marketing will not prevent us from sending necessary service communications relating to quotations, policies, renewals, claims, payments, security or other existing business relationships.

Our website may use cookies and similar technologies for essential functionality, security, preferences, analytics and, if enabled, marketing.

Bizsure should publish or configure a cookie notice that accurately reflects the technologies actually used on the website. Non-essential analytics or marketing cookies should be managed in accordance with applicable consent requirements. Users should be able to adjust available cookie preferences through the website or browser settings where applicable.

Our website may contain links to insurers, payment providers, regulators or other third-party websites. Bizsure is not responsible for the privacy practices or content of third-party websites. You should review the privacy information of the relevant third party before providing personal data to it.

If you have a question, request or complaint about how Bizsure handles personal data, please contact:

Privacy/Data Protection Contact

Caroline Chege

Email

info@bizsure.co.ke

Telephone

0721766749/0710890994

Address

P.O. Box 2248-00100 Nairobi

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in accordance with applicable Kenyan law.

We may update this Privacy Policy to reflect changes in law, regulation, technology, our services or our processing practices. The current version will be published on our website with its effective or last-updated date.