Introduction

Kapa Oil Refineries Limited (hereinafter referred to as “we”) is registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC) (Identification: 940-0279-5B9D), and we are committed to ensuring that the data we process is handled in accordance with data protection laws.

Kapa Oil Refineries premises is located along Mombasa Road in Machakos County and Mavoko Sub-County. The premises has a system of Closed Circuit Television (CCTV) cameras located in various areas. These cameras record and collect images and videos of employees, contractors, staff, and all visitors of the premises and surrounding areas.

This Policy describes the types of data we may collect from the data subject (hereinafter referred to as “you”) when visiting our premises and describes our policies and practices for collecting, using, protecting, and disclosing that data.

This Policy may change from time to time, so check the Policy periodically for the most current version.

If you have any questions about the meaning or interpretation of this Policy, kindly reach us through dataprotection@kapa-oil.com with a copy to legal@kapa-oil.com.

The date of the Policy was last revised is identified at the bottom of the policy. It is your responsibility to review this Policy for any changes. By continuing to visit our premises, you agree to any changes in the Policy.

Your Rights in Relation to your Data

The Data Protection Act 2019 gives you, the data subject, various rights in relation to your personal data that we hold and process. These rights are set out in Section 26 of the Data Protection Act, 2019. They are as follows:

The right to:

• Be informed of the use to which your personal data is to be put;
• Access your personal data in custody of a data controller or data processor;
• To object to the processing of all or part of your personal data;
• To correction of false or misleading data; and
• To deletion of false or misleading data about you.

Other rights provided in the Data Protection Act 2019 include:

• Right to withdraw consent of data processing at any time
• Right to data portability
• Right of rectification of inaccurate, out-dated, incomplete or misleading data
• Right to erase or destroy without undue delay personal data that is no longer authorised to be retained by the data controller, is irrelevant, excessive or was obtained unlawfully

Full details of these rights can be found in the Data Protection Act or by reference to guidance produced by the Office of the Data Protection Commissioner (ODPC).

In the event that you wish to exercise any of these rights you may do so as provided for in the section “Accessing, Correcting and Deleting Your Personal Data” in this Policy.

Consent to have your Data Processed  

By entering our premises, you consent to collection of your data through CCTV systems in accordance with this policy.

Your decision to provide consent for collection of your data under this policy is entirely voluntary. However, please be aware that refusing to consent may affect your ability to access Kapa Oil Refineries’ Premises.

You have the right to object to processing of your personal data through CCTV systems. You may exercise this right by refraining from entering our premises.

You may object to further processing of your personal data through CCTV systems at any time by sending an email request to dataprotection@kapa-oil.com with a copy to legal@kapa-oil.com. We may choose whether or not to accommodate an objection based on the circumstances surrounding the request.

Data We Collect About You

We collect images and videos caught on camera, and no voice is recorded.

How We Collect your Data

Personal data is obtained from individuals who are filmed by CCTV cameras which are located across Kapa Oil Refineries’ premises both inside and outside buildings.

The collection and retention of CCTV footage will be limited to what is necessary for the stated purposes. Unnecessary recording of private areas will be avoided.

CCTV monitoring will only be conducted for the authorized purposes stated in this policy. Continuous monitoring will be avoided unless deemed necessary for the stated reasons.

In the event that an incident captured by CCTV needs further analysis, the footage will be handled by the security manager for further investigations 

Why we Process your Personal Data 

We collect data through CCTV systems for various reasons including but not limited to the following:

• Public Safety
• Safety and security of personnel, assets and Kapa Oil Refineries’ premises
• Prevention and detection of crime
• Apprehension and prosecution of offenders
• Exercise of criminal proceedings
• Implementation of company regulations, policies, and procedures.

Disclosure of your Personal Data to Third Parties

We do not sell or otherwise disclose personal information collected on CCTV cameras, except as described here.

We do not share your personal information with unaffiliated third parties for their own marketing purposes without your consent.

We may share the information we collect from and about you in the following ways:

• Among Kapa Oil Refineries Limited’s affiliated companies
• To our third party service providers retained to perform a business, professional or technical support functions for us to the extent necessary or desirable to fulfil the purposes listed in the ‘Why we Process Your Personal Data’ section herein. These service providers may have access to personal information collected through CCTV systems if it is needed to perform their functions for Kapa Oil Refineries Limited, but they are not authorized by Kapa Oil Refineries Limited to use or disclose the information except as necessary to perform services on Kapa Oil Refineries Limited’s behalf or to comply with legal requirements
• As is necessary to investigate or prevent an actual or suspected crime or injury to yourself or others, as permitted by law
• If we believe that there has been a violation of our policies or our rights or the rights of any third party
• To respond to judicial process or provide information to law enforcement authorities, regulatory agencies, or other government officials, or otherwise as required by law
• During the normal course of our business, we may sell or purchase assets. If another entity acquires us or any of our assets, information we have collected about you may be transferred to such entity. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, such information may be considered an asset of ours and may be sold or transferred to third parties. Should a sale or transfer occur, we will use reasonable efforts to try to require that the transferee use personal information provided through the CCTV systems in a manner that is consistent with this Policy.

You may access, view, edit, modify and delete your data shared to any third parties by emailing dataprotection@kapa-oil.com with a copy to legal@kapa-oil.com with your request. 

Accessing, Correcting and Deleting Your Personal Data

You may access and correct your data by emailing dataprotection@kapa-oil.com with a copy to legal@kapa-oil.com to request access to, correct, or delete any personal data that you have provided. We may choose not to accommodate a request to change or delete data if we believe the change or deletion would violate any law or legal requirement or cause the data to be incorrect.

Security Measures to be taken to Ensure Integrity and Confidentiality of your Personal Data

The security of your information is important to us. We have taken certain administrative, technical, and physical steps to safeguard the information we collect through CCTV systems against unauthorized use, disclosure, alteration, or destruction.

Among the safeguards employed include:

• Restricting access to CCTV footage – only authorised personnel are authorised to access the CCTV systems and data collected on a need-to-know basis. Access logs can be accessed upon receipt of a legitimate approved request
• The ICT Department is responsible for the administration and oversight of the CCTV system
• We have implemented strong authentication controls including strong passwords on CCTV systems to prevent unauthorised access
• We have ensured that the network infrastructure supporting the CCTV system is secured using firewalls.
• We keep our CCTV management software up-to-date with the latest security patches to minimise exposure to vulnerabilities.
• Personnel with access to CCTV systems will receive training on the responsible use of the CCTV system

While we make every effort to help ensure the integrity and security of our network and systems, we cannot guarantee our security measures to be free from vulnerabilities.

How Long We Retain Your Personal Data

We retain your personal data collected through CCTV footage for a defined period based on the organization’s operational and legal requirements. The current retention period as per company policy is 2 Months from the date of collection.

 Contact Information

Kapa Oil Refineries Limited is domiciled in Kenya, Machakos County, Mavoko Sub-County along Mombasa Road

You may contact us on email through dataprotection@kapa-oil.com with a copy to legal@kapa-oil.com to raise a complaint or to make any inquiries whatsoever.

This Policy will be reviewed from time to time and updated as necessary to reflect changes in technology, legal requirements, and organizational practices

This Policy shall take effect on 10^th January 2024

This Policy was last revised on 10^th January 2024