Privacy Policy

Ndovu Wealth Limited ("Ndovu", “we”, “us” or “our”) is the owner and operator of Ndovu, a registered trademark and investment platform. Your privacy is important to us.

1.1 This privacy statement explains the personal data Ndovu Wealth Limited (“Ndovu”) collects, uses, shares, processes and for what purposes and the rights you have. "Personal data" means any information that identifies you or that can be linked to you.

1.2 This statement applies to all customers, suppliers, agents, merchants, dealers and all visitors frequenting any of Ndovu’s premises, platforms and services.

1.3 It applies to you if you:

• visit our website or download and use the Ndovu mobile app;
• register, apply to invest, or invest with us, or are considering doing so;
• access our services through a partner, employer or other institution;
• act for a company, partnership, trust, society, pension scheme or other organisation that invests with us, for example as a director, authorised signatory, trustee, beneficial owner or contact person;
• are named by an investor as a next of kin, nominee, beneficiary, guardian or joint account holder; or
• contact us with an enquiry, request or complaint.

1.4 This statement should be read together with the Terms and Conditions of Use for other Ndovu products and services. Where there is a conflict, this statement will prevail.

References to

2.1 “You” means:

• i. customer- the person who subscribes to, uses or invests in any of the products and services on our platforms or accesses our websites and includes any person who accesses any of the products and services on our platforms.
• ii. Any Partner who has signed an agreement with us and is recognised as a partner in accordance with any applicable laws or Regulations.
• iii. Any visitor that is a person (including contractors/subcontractors or any third parties) who gains access to any Ndovu premises.
• iv. Any supplier who has been contracted by Ndovu and executed an agreement with Ndovu.

2.2 “Ndovu”, “we” or “us”, “our” and “ours” means Ndovu Wealth Limited

The word “includes” means that what follows is not necessarily exhaustive; therefore, the examples given are not the only things/situations included in the meaning or explanation of that text.

At Ndovu Wealth Limited, we take the collection of personal data from our clients and investors with the utmost care and responsibility

3.1 The information we collect depends on how you interact with us and which products you use. We collect your personal information with your knowledge and consent when you do any of the following (please note that this list is not exhaustive):

• a. when you register, complete onboarding and risk-profiling, give investment instructions, update your details, respond to surveys or contact us, visit, access or use Ndovu or third-party websites.
• b. Where lawful, we also obtain information from: identity-verification services and official registers used to confirm identity documents and company details; sanctions, adverse-media screening services; banks, mobile-money and other payment providers, in connection with your payments to and from us; fund trustees, custodians, other fund managers, fund administrators and brokers involved in your investments; publicly available sources, such as company registers and media reports; and regulators, law-enforcement or other authorities, where they are legally permitted to share it with us.
• c. Where we collect your personal data from another source and the law requires us to inform you, we will do so within the time the law allows
• d. We do not onboard minors (any person under 18 years of age) except where you additionally register on their behalf as their parent and/ or legal guardian. If you allow a child to use our services, you should be aware that their personal information could be collected as described in this statement.

3.2 Information Collected - It may include (please note that this list is not exhaustive):

• a. Identity information that is the Full name, date of birth, nationality, national ID or passport number and copy, KRA PIN, photograph, liveness check, signature, and gender where it appears on your identity document.
• b. Contact information including mobile number, email address, physical and postal address.
• c. Financial and payment information including bank account and mobile-money details used to fund or receive payments, occupation, employer, income range, and source of funds or source of wealth where required.
• d. Investments and transactions information on our platforms
• e. Tax identification numbers for other countries and related declarations.
• f. Answers to our risk-profiling questionnaire, investment goals and time horizon, the risk category and portfolio suggestion derived from them, and your product and communication preferences.
• g. For corporate and institutional investors: registration documents, and the identity and contact details of directors, trustees, authorised signatories, beneficial owners and contact persons.
• h. Details of next of kin, nominees, beneficiaries, guardians and joint account holders that you give us.
• i. Risk ratings; information about beneficial owners and controllers
• j. Whether you have agreed to or opted out of marketing, and how you respond to our messages and campaigns.

3.3 Use of Information-We may use and analyse your information for the following purposes:

• a. For the purpose of managing funds and providing related services. We use the data to analyze and make informed investment decisions, monitor portfolio performance, and fulfill regulatory requirements. This enables us to provide optimal fund management services to our clients and stakeholders, helping them achieve their financial goals.
• b. The data may also be used for statistical analysis and data aggregation, but always in an anonymized and aggregated form to protect the identity and privacy of the individuals.
• c. Used to improve our own products, services, and business operations, allowing us to continuously enhance the quality and effectiveness of our fund management offerings.
• d. Used for market research, statistical analysis, and data aggregation. However, rest assured that any such use will always be done in compliance with applicable data protection laws and regulations, and with the utmost care to protect the identity and privacy of the individuals.
• e. Processing investments, switches, withdrawals and payments; maintaining records of your holdings; issuing statements and confirmations
• f. Assessing your risk profile and the suitability of products for you
• g. Sending marketing about our products and services
• h. Administering any of our online platforms/websites.
• i. to enter into and perform our agreement with you, or to take steps you ask for before entering into it;
• j. to comply with laws and regulations that apply to us, such as capital-markets and others
• k. Answering enquiries and handling complaints, sending service messages (confirmations, statements, security alerts, changes to terms, regulatory notices),
• l. where the use is necessary for our reasonable business interests, such as keeping our platform secure and improving our services, and those interests are not overridden by your rights and interests; and
• m. only where the law requires it or no other basis is appropriate, for example certain marketing and non-essential cookies. You may withdraw consent at any time
• n. We use your personal data only for the purposes described in this Notice or for purposes compatible with them. If we wish to use it for a new, unrelated purpose, we will tell you first and, where required, ask for your consent.
• o. We may combine information into anonymised statistics (for example, on investor numbers or product trends). Anonymised information does not identify you and is no longer personal data.

3.4 Categories of Data

Categories of Personal Data as defined in the Data Protection Act of Kenya may be processed depending on the particular types of products and services you have subscribed to.

3.5 Lawful Basis for processing your information

We will process your personal information based on any of the lawful basis provided for under the Data Protection Law:

• to enter into and perform our agreement with you, or to take steps you ask for before entering into it;
• to comply with laws and regulations that apply to us;
• Ndovu’s legitimate business interests;
• Compliance with a mandatory legal obligation;
• Consent you provide;
• Public interest;
• Your vital interest.

4.1 We follow strict data retention policies to ensure that personal data collected from our clients and investors is retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations.

4.2 We keep personal data only for as long as we need it for the purposes in this Notice, including to meet legal, regulatory, accounting and reporting requirements. In deciding how long to keep it, we consider what the law requires, the nature and sensitivity of the data, the purpose for which we hold it, and whether we may need it for a complaint, dispute or legal claim.

4.3 The retention period of personal data depends on the nature of the fund management activities and the specific purposes for which the data was collected. We carefully assess the data retention requirements for each client or investor, taking into consideration legal obligations, the purpose of the fund management services, and the consent obtained from the individuals.

4.4 We may keep data longer if it is needed for an ongoing complaint, investigation, dispute or legal claim, or if a regulator or court requires it.

4.5 Once the data is no longer needed, we take appropriate measures to securely delete or anonymize it to prevent identification. Data deletion is carried out in accordance with industry-standard practices to ensure that the data is permanently and irreversibly removed from our systems.

4.6 In cases where anonymization is chosen as the method of data handling, we ensure that the anonymized data is stripped of any personally identifiable information and transformed into a format that cannot be used to identify individuals. Anonymized data may be used for research, analysis, or reporting purposes, but it will not contain any identifiable information.

At Ndovu Wealth Limited, we hold the privacy and confidentiality of personal data collected from our clients and investors as a top priority. We are committed to ensuring that such data is not disclosed to third parties without explicit consent, unless it is required by law or authorized by the individuals themselves.

In certain cases, we may engage third-party service providers to assist us with data collection, analysis, and reporting as part of our fund management activities. These service providers may include data collection agencies, data analysis firms, or technology partners who help us with data processing and management.

In such cases, we may need to share personal data with these service providers to enable them to perform their services on our behalf.

5.1 Any disclosure of your information shall be in accordance with applicable law and regulations.

5.2 We shall not release any information to any individual or entity that is acting beyond its legal mandate.

5.3 We will get your express consent before we share your personal data with any third party for direct marketing purposes.

We do not sell, rent, or trade personal data collected from our clients and investors to any third parties for marketing or commercial purposes. Our primary purpose for collecting personal data is for fund management and related services

At Ndovu Wealth Limited, we prioritize the security and confidentiality of the personal data collected from our clients and investors. We understand the importance of implementing robust technical and organizational measures to safeguard against unauthorized access, disclosure, alteration, or destruction of personal data.

6.1 We use technical and organisational measures appropriate to the risks involved, including but not limited to access controls, encryption, firewalls, user authentication, encryption of data where appropriate, secure hosting, system monitoring, staff confidentiality obligations and training, and contractual security requirements for our service providers. We review these measures regularly.

6.2 However, it's important to note that no method of data transmission over the internet or electronic storage is completely foolproof. Despite our best efforts, there is always a risk of unauthorized access or data breaches due to the inherent vulnerabilities of online communication and information systems. Therefore, while we take appropriate measures to protect personal data, we cannot guarantee absolute security against all potential threats.

6.3 In addition to technical measures, we also have strict policies and procedures in place to govern access to personal data, limit data access to authorized personnel only, and ensure that personal data is used only for the purposes for which it was collected. Our staff undergoes regular training on data protection and privacy to ensure compliance with our data handling practices and to maintain the confidentiality and security of personal data.

6.4 You can help. Keep your password, PIN and one-time codes confidential. Ndovu will never ask you for your password, PIN or one-time code by phone, email, SMS or social media. If you suspect that someone has accessed your account, contact us immediately.

7.1 From time to time we may need to transfer your personal information outside the Republic of Kenya to provide a particular product or service.

7.2 Where we send your information outside Kenya, we will make sure that your information is properly protected in accordance with the applicable Data Protection Laws.

8.1 We have procedures to detect, contain and respond to personal data breaches. Where the law requires, we will notify the ODPC (within 72 hours of becoming aware of a notifiable breach) and will inform affected individuals without undue delay, explaining what happened and what steps they can take to protect themselves.

9.1 Our website and app may link to websites, apps or services run by other organisations, such as payment providers or partners. We do not control them, and their own privacy notices apply. Please read them before providing your information

9.2 We do not endorse, recommend, approve or guarantee any third- party products and services by providing hyperlinks to an external website or webpage and do not have any co-operation with such third parties unless otherwise disclosed. We are not in any way responsible for the content of any externally linked website or webpage.

10.1 Subject to the conditions and exceptions in the law, you have the following rights:

• to access, correct any inaccuracies, update, and delete personal data that we hold, as well as to withdraw your consent for data collection and processing at any time.
• To know how your personal data is being used - which is the purpose of this Notice.
• To ask us to delete data that we no longer need, or that is inaccurate or was unlawfully obtained. We may be required by law to keep some data; if so, we will explain why.
• To object to our use of your data where we rely on legitimate interests.
• Where we rely on consent, to withdraw it at any time. This does not affect processing already carried out.

10.2 In addition, clients and investors have the right to request information about the data we hold about them, including the purposes for which it is being processed, the categories of recipients to whom it may be disclosed, and the legal basis for processing. We are committed to providing clear and transparent information about our data practices and will respond to such requests in a timely manner.

10.3 If you have concerns about how we handle your data, please contact us using the contact provided in the contact information section.

If you have any questions, concerns, or requests regarding our data privacy practices, please contact us at compliance@ndovu.co.

We reserve the right to update or modify this Data Privacy Statement at any time without prior notice to reflect changes in our data privacy practices or legal requirements. Any updates or modifications will be effective upon posting on our website or notifying participants through other appropriate channels.