• Company refers to our clients who we maintain a register of their investors i.e. shareholders, bondholders, unitholders, noteholders and, where applicable, beneficial owners.

• Data controller means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal information.

• Data processor means a natural or legal person, public authority, agency or other body which processes personal information on behalf of the data controller.

• DPA means the Data Protection Act of Kenya, 2019.

• Investor means shareholders, bondholders, noteholders, unitholders, and where applicable, beneficial owners.

This refers to information or a combination of information that could reasonably allow an individual to be identified. This includes but is not limited to;

• i) Personal details such as names, identification/passport numbers, nationality and residency, signature and specimen signatures, CDSC Account details.
• ii) Contact information such as addresses, telephone numbers and emails.
• iii)Investor records such as numbers and details of shares held, share purchases and disposals, dividend entitlements and payments, your votes.
• iv) Payment details i.e. mobile money details and bank account details.
• v) Correspondence information i.e your inquiries, complaints and other communications with you.
• vi) Voice and/or recordings of Investor meetings.

Our function as shares registrars is to maintain a register of the Company's Investors. We therefore obtain the personal information from:

• i) The Company.
• ii) Directly from the Investors.
• iii) Through third parties such as stockbrokers and agents.

Furthermore, we will only collect personal information that is necessary for the purpose stated at the time of collection or as required by law.

We collect and use personal data for specified, explicit and legitimate purposes including:

• To perform legal & contractual obligations.
• To maintain the register of Investors according to the law and discharge our duties as shares registrars in accordance with the terms of our service contracts.
• To facilitate payment of dividends.
• To send statutory communications or notices to Investors on behalf of the Company and only on specific instructions.
• To protect and advance the legitimate interests of the Investors, including ensuring accurate record-keeping, safeguarding Investor rights, enabling participation in corporate actions, and supporting effective communication between the Company and its Investors.
• To personalize Investors experience. We may use information in the aggregate to understand how our users as a group use our services and resources.
• To improve our services and website. We continually strive to improve our services based on the information and feedback we receive from you.
• To respond to questions, feedback and other request.

All information we hold is stored securely in a limited access and audited system. We take appropriate technological, legal as well as organizational measures to process and safeguard your personal information in line with best practices. We ensure that data is kept only for as long as needed for the purposes above and for periods required by law.

Image Registrars Limited is committed to protecting and safeguarding the personal information of our customers, employees, and any other individuals who entrust us with their data. In line with this commitment, we have implemented strict technological, legal and organizational measures to ensure the security and confidentiality of personal information.

As a shares registrar one of our roles is to keep and maintain the register and information of Investors of various Companies. We will therefore share the information with:

• The Company whose register we maintain.
• The Company's authorized professional advisers (such as transaction advisers, legal advisers, auditors, tax consultants, or corporate finance advisers), strictly in accordance with the Company's instructions and only where such disclosure is necessary.
• Regulators, government agencies, or other competent authorities, where required, to comply with legal, regulatory, or statutory obligations, including anti-money laundering, corporate governance, and securities-related requirements.
• With service providers or partners engaged by us to support our operational, technological, or administrative functions, provided that such parties are bound by appropriate confidentiality and data protection obligations.
• With third parties (such as stockbrokers, central depository agents, or paying agents), but only to the extent required to process the relevant transaction and in accordance with applicable laws and instructions from the Company.

• To be informed of the use to which your personal data is to be put.
• To access your personal information in our custody.
• To object to the processing of all or part of your personal information.
• To request the correction of false or misleading data.
• To delete false or misleading data about yourself.
• To appropriate security safeguards in the storage, transfer and processing of personal data.
• To withdraw consent to the processing of your personal data. However, this shall not affect the lawfulness of processing based on prior consent before its withdrawal.

All complaints or inquiries regarding personal data protection can be sent to dpo@image.co.ke. You should provide the following information when submitting a complaint or inquiry:

• Full Name
• Contact Details
• Nature of the complaint/inquiry
• Relevant Details Supporting the complaint/inquiry

This policy will be reviewed and updated from time to time to ensure compliance with applicable laws, technology and best practices. We encourage you to review this policy periodically for any updates.