Privacy Policy

1. Introduction

Oceania Single Step Investments Limited ("we", "our", or "us") respects your privacy and is committed to protecting your personal and corporate data. This privacy policy will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

This policy complies with the strict guidelines set forth by the Kenya Data Protection Act, 2019 (KDPA) and other relevant regional data protection frameworks.

2. The Data We Collect About You

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: includes first name, last name, username or similar identifier, and title.
• Contact Data: includes corporate email address, telephone numbers, and office locations.
• Financial Data: includes bank account details for investment disbursements or consultancy invoicing (processed securely via our upcoming Client Portal).
• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, and other technology on the devices you use to access this website.
• Profile Data: includes your investment interests, training requests, feedback, and survey responses.

3. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you (e.g., executing a business consultancy agreement).
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation, such as the Capital Markets Authority (CMA) regulations regarding investments.

4. Data Security

We have put in place appropriate, enterprise-grade security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. Our cloud architecture employs strict Role-Based Access Control (RBAC), data encryption at rest, and Web Application Firewalls (WAF).

In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a corporate need to know. They will only process your personal data on our instructions and they are subject to a strict duty of confidentiality.

5. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

6. Your Legal Rights

Under the Kenya Data Protection Act, you have rights under data protection laws in relation to your personal data, including the right to:

• Request access to your personal data.
• Request correction of your personal data.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing your personal data.
• Request transfer of your personal data.
• Right to withdraw consent.