Kestrel Capital (East Africa) Ltd (“Kestrel Capital”, “we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal data when you visit kestrelcapital.com or engage our services.

Kestrel Capital is licensed by the Capital Markets Authority (CMA) and is a Member of the Nairobi Securities Exchange (NSE). We process personal data in line with the Kenya Data Protection Act, 2019, the Capital Markets Act, and related laws.

1. Who We Are

Kestrel Capital is the data controller responsible for your personal data. Our office is located at 10th Floor, Pramukh Towers, Westlands Road, Nairobi, P.O. Box 40005-00100, Kenya.

2. Information We Collect

We collect personal data that you provide directly to us, data we generate through your use of our services, and data we receive from authorised third parties. This may include:

• Identification details such as your full name, national ID or passport number, date of birth, and KRA PIN
• Contact details, including postal address, email address, and phone numbers
• Financial details such as bank account information, source of funds, investment history, and CDS account details
• Employment and income information required for client onboarding and regulatory compliance
• Transaction and account activity data generated through your use of our trading and advisory services
• Digital information such as IP address, browser type, device data, and cookies when you visit our website

3. How We Use Your Information

We use your personal data to:

• Open and manage your trading or advisory account
• Execute transactions, provide research, and deliver our investment services
• Meet regulatory, legal, anti-money laundering, and tax reporting obligations
• Communicate with you about your account and relevant market updates
• Improve our website, platforms, and client experience
• Protect our clients and systems against fraud and unauthorised access

4. Legal Basis for Processing

We process your personal data based on the performance of a contract with you, compliance with our legal and regulatory obligations, our legitimate business interests, and where required, your consent.

5. How We Share Your Information

We do not sell your personal data. We may share it with:

• Regulatory authorities including the CMA, NSE, Central Depository and Settlement Corporation (CDSC), Kenya Revenue Authority, and the Financial Reporting Centre
• Banks, custodians, and other financial institutions involved in executing your transactions
• Service providers who support our operations, technology, and compliance functions, under strict confidentiality obligations
• Law enforcement or courts where required by law

6. International Data Transfers

Where personal data is transferred outside Kenya, we ensure appropriate safeguards are in place in line with the Data Protection Act, including adequacy assessments and contractual protections.

7. Data Security

We apply institutional-grade technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Access is restricted to authorised personnel on a need-to-know basis.

8. Data Retention

We retain personal data for as long as necessary to provide our services and to meet regulatory record-keeping obligations, after which it is securely deleted or anonymised.

9. Your Rights

Under the Data Protection Act, you have the right to access, correct, update, or request deletion of your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. Some rights may be limited where we are required to retain data for regulatory purposes.

To exercise these rights, contact us using the details below.

10. Cookies

Our website uses cookies and similar technologies to improve functionality, analyse usage, and remember your preferences. You can manage cookies through your browser settings.

11. Updates to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available on kestrelcapital.com, with the last reviewed date indicated above.

12. Contact Us

For questions about this Privacy Policy or how we handle your personal data, please contact:

Kestrel Capital (East Africa) Ltd

• 10th Floor, Pramukh Towers, Westlands Road, Nairobi
• P.O. Box 40005-00100, Nairobi, Kenya
• Email: info@kestrelcapital.com
• Telephone: +254 (0) 733-333-544 or +254 (0) 722-205-897