Privacy Policy

Effective Date: July 17, 2026

Finsbridge Limited ("Finsbridge", "we", "us", or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, engage us for financial consulting services, or otherwise interact with us.

This policy is drafted in strict compliance with the Kenya Data Protection Act, 2019 (the "Act") and the Data Protection Regulations. For the purposes of the Act, Finsbridge Limited acts as both a Data Controller (when determining the purpose and means of processing your data) and a Data Processor (when processing financial or payroll records on behalf of our corporate clients).

1. Information We Collect

To provide high-quality financial consulting, audit, tax advisory, and reconciliation services, we must collect and process certain categories of personal data.

A. Information You Provide Directly to Us

• Contact Information: Name, email address, physical/postal address, and telephone number.
• Identification Documents: National ID card numbers, passport details, Personal Identification Numbers (KRA PINs), and business registration certificates.
• Financial & Professional Information: Bank account details, transaction records, tax records, payroll registers, employee details (for payroll and PAYE management), and general ledger details.
• Communications: Any details or feedback you share when contacting our customer support or consulting teams.

B. Information We Collect Automatically

When you visit our website, we may collect technical information to improve your user experience, including:

• IP Address: The unique identifier for your device on the internet.
• Browser Type: The type of web browser you are using.
• Operating System: The software running on your device.
• Geographic Location: Your approximate location based on your IP address.
• Log Data: Information about your interactions with our site, such as pages viewed and time spent on those pages.

2. How We Use Your Personal Data

We will only use your personal data where the law allows us to. Most commonly, we use your data under the following legal bases:

• To Perform a Contract: To onboard you as a client, process your financial reconciliations, manage payroll, handle tax filings with the Kenya Revenue Authority (KRA), and provide general advisory services.
• To Comply with Legal Obligations: To meet our reporting obligations under Kenyan tax laws, the Companies Act, and the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA).
• Consent: Where you have given us clear and explicit consent to process your data for specific purposes (e.g., sending newsletters or marketing materials).
• Legitimate Interests: For security, fraud prevention, and to improve our website and business offerings.

3. Data Sharing and Disclosure

We do not sell or rent your personal data to third parties. However, we may share your information in the following circumstances:

• Statutory and Regulatory Bodies: We disclose your data to Kenyan government authorities such as the Kenya Revenue Authority (KRA), the Business Registration Service (BRS), and the Office of the Data Protection Commissioner (ODPC), where required by law.
• Third-Party Service Providers: We may share data with trusted IT vendors, cloud storage hosting providers, and accounting software providers (e.g., QuickBooks, Xero) who act as data processors under strict confidentiality agreements.
• Professional Advisors: When necessary, we may share data with legal counsel, auditors, or insurers to defend or assert our legal rights.

4. International Data Transfers

While we host and process most of our data within Kenya, some services (such as cloud-based accounting systems or email servers) may process data outside Kenyan borders.

In accordance with Section 48 of the Data Protection Act, we will only transfer personal data outside Kenya if:

1. The destination country has an adequate level of data protection: We will only transfer data to countries that provide a comparable level of data protection as guaranteed by the Data Protection Act.
2. We have implemented appropriate safeguards: We will implement necessary safeguards (such as Standard Contractual Clauses) with the recipient to ensure the protection of your personal data.
3. You have given us explicit consent: You must provide explicit consent for the transfer of your personal data outside Kenya.

5. Data Security

We have put in place robust technical and organizational security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed in an unauthorized manner.

• These measures include secure data encryption, firewalls, restricted access protocols (role-based access), and regular security audits.
.
• We limit access to your personal data to employees and third-party partners who have a legitimate business "need-to-know." They are strictly bound by confidentiality agreements.

6. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, accounting, tax, or reporting requirements.

• By default, Kenyan tax and corporate laws require us to maintain financial records for a minimum of seven (7) years from the date of the transaction. Once this retention period expires, data will be securely destroyed or permanently anonymized.

7. Your Legal rights

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:

• Right to be Informed: The right to know how your data is being collected, used, and stored.
• Right of Access: The right to request a copy of the personal data we hold about you.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure (Right to be Forgotten): The right to request deletion of your personal data where there is no legal or contractual ground for us to keep processing it.
• Right to Object: The right to object to the processing of your data, particularly for direct marketing purposes.
• Right to Portability: The right to request that we transfer your data to another service provider in a structured, commonly used format.

8. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. When we make updates, we will revise the "Effective Date" at the top of this page. We encourage you to review this policy periodically to stay informed about how we protect your information.

9. Contact Us & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, please contact us at:

• Company Name: Finsbridge Limited
• Email: info@finsbridge.co.ke
• Physical Address: Mountain Mall, Thika Road

If you believe we have not resolved your concern satisfactorily, you have the right to lodge a formal complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya via their official website (www.odpc.go.ke).