Privacy Policy
(Incorporating the Photography Policy and the Videography Policy)
Issued by Finsmart Hub Limited, trading as Finsmart Hub Africa
Website www.finsmarthub.africa
Last Updated 1 April 2026
This Policy remains in force until it is amended or withdrawn by Finsmart Hub Limited.
PART A: PRIVACY POLICY
1. Introduction
1.1 Finsmart Hub Limited, a limited liability company incorporated in the Republic of Kenya under the Companies Act, 2015, and trading as Finsmart Hub Africa (“Finsmart Hub”, “we”, “us” or “our”), provides financial literacy training, Masterclasses, workshops, advisory services and related learning programmes.
1.2 This Data Protection and Privacy Policy (“this Policy”) sets out the manner in which Finsmart Hub collects, records, organises, stores, uses, discloses, transfers and otherwise processes Personal Data, and the rights available to you in respect of that Personal Data.
1.3 This Policy is issued in compliance with:
(a) Article 31(c) and (d) of the Constitution of Kenya, 2010;
(b) the Data Protection Act, No. 24 of 2019 (the “Act”);
(c) the Data Protection (General) Regulations, 2021;
(d) the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021;
(e) the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021; and
(f) any other written law, regulation, guideline or determination issued by the Data Commissioner from time to time.
1.4 By accessing our website, registering for any of our courses or events, submitting an enquiry, or otherwise engaging with us, you confirm that you have read and understood this Policy.
1.5 If you do not agree with any part of this Policy, you should refrain from submitting your Personal Data to us and from using our services.
2. Definitions and Interpretation
2.1 In this Policy, unless the context otherwise requires:
“Act” means the Data Protection Act, No. 24 of 2019, and includes any subsidiary legislation made under it;
“Consent” means any manifestation of express, unequivocal, free, specific and informed indication of your wishes, by a statement or by a clear affirmative action, signifying agreement to the processing of Personal Data relating to you;
“Data Commissioner” means the Data Commissioner appointed under section 6 of the Act;
“Data Subject” means an identified or identifiable natural person who is the subject of Personal Data;
“ODPC” means the Office of the Data Protection Commissioner established under section 5 of the Act;
“Personal Data” means any information relating to an identified or identifiable natural person;
“Process” or “Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure or destruction;
“Sensitive Personal Data” has the meaning assigned to it under section 2 of the Act;
“Services” means the courses, Masterclasses, workshops, seminars, mentorship, advisory services, digital learning materials and events offered by Finsmart Hub;
“Website” means www.finsmarthub.africa and any subdomain, portal or application operated by Finsmart Hub.
2.2 Words importing the singular include the plural and vice versa, and words importing one gender include all other genders.
2.3 A reference to any statute includes that statute as amended, re-enacted or replaced from time to time.
2.4 Headings are inserted for convenience only and shall not affect the construction of this Policy.
3. Data Controller
3.1 For the purposes of the Act, Finsmart Hub is the Data Controller in respect of the Personal Data described in this Policy and determines the purposes and means of its Processing.
3.2 Finsmart Hub Processes Personal Data in its capacity as a Data Controller and discharges the obligations imposed on a Data Controller by the Act, including the registration obligations under section 18 of the Act to the extent that they apply to us.
3.3 Where we engage third parties to Process Personal Data on our behalf, those parties act as Data Processors under written contract and are bound by obligations no less protective than those set out in this Policy.
4. Scope of Application
4.1 This Policy applies to Personal Data collected from:
(a) visitors to and users of the Website;
(b) persons who register for, enrol in or attend our courses, Masterclasses, workshops, seminars and events, whether in person or online;
(c) persons who subscribe to our mailing lists, newsletters or promotional communications;
(d) persons who contact us by email, telephone, social media or through any form on the Website; and
(e) suppliers, partners, facilitators, consultants and other business contacts.
4.2 This Policy applies whether the Personal Data is Processed in physical or electronic form, and whether Processing takes place within or outside Kenya.
4.3 This Policy does not apply to the practices of third parties that we do not own or control. Clause 22 addresses third party links.
5. Data Protection Principles
5.1 Finsmart Hub is bound by, and undertakes to observe, the principles set out in section 25 of the Act. Accordingly, we shall Process Personal Data:
(a) in accordance with your right to privacy;
(b) lawfully, fairly and in a transparent manner;
(c) for explicit, specified and legitimate purposes, and not in a manner incompatible with those purposes;
(d) in a manner that is adequate, relevant, limited to what is necessary and not excessive;
(e) with accuracy, and where necessary kept up to date, with every reasonable step taken to erase or rectify inaccurate data without delay;
(f) for no longer than is necessary for the purposes for which it was collected; and
(g) in a manner that ensures appropriate security, including protection against unauthorised or unlawful Processing and against accidental loss, destruction or damage.
5.2 The burden of proving compliance with these principles rests with Finsmart Hub in accordance with section 10 of the Act, and we maintain records of our Processing activities for that purpose.
6. Personal Data We Collect
6.1 Identity and contact data: full name, title, gender where voluntarily provided, national identification or passport number where required for certification or verification, email address, telephone number, postal and physical address, and country of residence.
6.2 Enrolment and learning data: course or Masterclass selected, cohort and intake details, attendance records, assessment and assignment submissions, examination or evaluation results, certificates issued, feedback and survey responses, and correspondence with facilitators.
6.3 Financial and transaction data: the payment channel used, transaction reference numbers, M-Pesa transaction codes, bank or wire transfer references, PayPal transaction identifiers, cryptocurrency wallet addresses and transaction hashes where that channel is elected, invoice and receipt records, amounts paid and payment dates.
6.4 Technical and usage data: internet protocol address, browser type and version, device type, operating system, time zone setting, referring URL, pages visited, duration of visit, and other diagnostic data collected through cookies and analytics tools.
6.5 Marketing and communication data: your preferences in receiving marketing communications from us, your subscription status, and your communication channel preferences.
6.6 Image and audiovisual data: photographs, video recordings, audio recordings and screen captures taken at our events and sessions, governed by Parts B and C of this Policy.
6.7 Any other information you voluntarily submit to us through a form, enquiry, application, testimonial, survey or direct communication.
6.8 We do not ordinarily seek to collect Sensitive Personal Data. Where such data is required, for example dietary or accessibility requirements disclosed for the purpose of accommodating you at a physical event, it shall be Processed only with your express Consent and only for the purpose for which it was disclosed.
7. How We Obtain Personal Data
7.1 Directly from you, when you complete a registration or enquiry form, correspond with us, attend an event, make a payment, or subscribe to our communications.
7.2 Automatically, through cookies and similar technologies deployed on the Website, as described in clause 12.
7.3 From third parties, including payment service providers, event ticketing platforms, online learning platforms, referral partners, and publicly available sources such as professional networking sites.
7.4 Where Personal Data relating to you is obtained otherwise than directly from you, we shall notify you of that fact within fourteen (14) days of collection, in accordance with the Data Protection (General) Regulations, 2021, save where an exemption under the Act applies.
8. Purposes and Lawful Basis of Processing
8.1 We Process Personal Data only where a lawful basis under section 30 of the Act exists. The purposes and corresponding lawful bases are as follows:
| Purpose of Processing | Lawful Basis |
|---|---|
| Registering you for a course, Masterclass, workshop or event | Performance of a contract to which you are a party, or steps taken at your request prior to entering into a contract |
| Processing payments, issuing invoices and receipts, and maintaining accounting records | Performance of a contract; compliance with legal obligations under the Tax Procedures Act, the Income Tax Act and the Companies Act, 2015 |
| Granting access to learning materials, portals and recorded sessions | Performance of a contract |
| Issuing certificates and verifying attendance or completion | Performance of a contract; our legitimate interests in maintaining the integrity of our certification |
| Sending course updates, schedules, venue changes and administrative notices | Performance of a contract |
| Responding to enquiries and providing customer support | Legitimate interests; steps taken at your request prior to contracting |
| Sending promotional offers, invitations and newsletters | Your Consent, which may be withdrawn at any time |
| Improving our Services, curriculum and learning experience through feedback and analytics | Legitimate interests, balanced against your rights and freedoms |
| Using photographs and video footage for marketing and educational purposes | Your Consent, obtained at registration or at the event |
| Preventing fraud, securing our systems and enforcing our terms | Legitimate interests; compliance with legal obligations |
| Establishing, exercising or defending legal claims | Legitimate interests; compliance with legal obligations |
8.2 Where we rely on legitimate interests, we have carried out a balancing assessment to satisfy ourselves that our interests are not overridden by your interests, rights and freedoms. You may request details of that assessment using the contact particulars in clause 27.
9. Consent and Withdrawal of Consent
9.1 Where Processing is founded on Consent, that Consent shall be obtained by a clear affirmative act and shall be recorded and retained by us as evidence.
9.2 Consent shall not be bundled with our terms and conditions and shall not be a condition of receiving a Service unless the Processing is necessary for that Service.
9.3 You may withdraw your Consent at any time by written notice to info@finsmarthub.africa or by using the unsubscribe facility contained in our electronic communications.
9.4 Withdrawal of Consent shall take effect prospectively and shall not affect the lawfulness of Processing carried out before the withdrawal.
9.5 Where Consent is withdrawn and no other lawful basis exists, we shall cease the relevant Processing and, where appropriate, erase the affected Personal Data.
10. Personal Data of Children
10.1 Our Services are directed at persons aged eighteen (18) years and above. We do not knowingly collect Personal Data from a child.
10.2 Where a child is to be enrolled in a programme, we shall obtain the verifiable Consent of the parent or guardian and shall apply appropriate mechanisms to verify age and the authority of the person granting Consent, in accordance with section 33 of the Act.
10.3 If we become aware that we hold Personal Data relating to a child without the requisite parental Consent, we shall erase that data without undue delay.
11. Payments and Financial Information
11.1 Payments for our Services may be made through M-Pesa, bank transfer, PayPal, SWIFT transfer or, where expressly offered, cryptocurrency.
11.2 All payment transactions are processed through the systems of licensed third party payment service providers. We do not collect, store or have access to your full card number, card verification value, mobile money personal identification number, online banking credentials or cryptocurrency private keys.
11.3 We retain only such transaction records as are necessary to confirm payment, issue a receipt or tax invoice, reconcile our accounts and comply with our statutory obligations.
11.4 Each payment service provider Processes your Personal Data as an independent Data Controller in accordance with its own privacy terms, and we encourage you to review those terms before transacting.
12. Cookies and Website Analytics
12.1 The Website uses cookies and similar technologies to operate correctly, remember your preferences, measure traffic and understand how visitors engage with our content.
12.2 The categories of cookies we deploy are:
(a) strictly necessary cookies, without which the Website cannot function, and which do not require Consent;
(b) performance and analytics cookies, which collect aggregated information about how the Website is used;
(c) functionality cookies, which remember choices you have made; and
(d) marketing cookies, which are used to deliver relevant advertising and measure campaign effectiveness.
12.3 Cookies falling within paragraphs (b), (c) and (d) of clause 12.2 are deployed only where you have given Consent through the cookie banner presented on your first visit.
12.4 You may withdraw or vary your cookie preferences at any time through the cookie settings on the Website or through your browser settings. Disabling certain cookies may impair the functionality of the Website.
12.5 Where analytics services operated by third parties are used, those parties may Process technical data on servers located outside Kenya. Clause 15 governs such transfers.
13. Disclosure of Personal Data
13.1 We do not sell, rent, lease or trade Personal Data.
13.2 We may disclose Personal Data to the following categories of recipients, and only to the extent necessary:
(a) facilitators, trainers, guest speakers and consultants engaged to deliver a programme in which you are enrolled;
(b) payment service providers, banks and mobile money operators, for the purpose of processing and reconciling payments;
(c) information technology, hosting, email, customer relationship management and online learning platform providers;
(d) professional advisers, including advocates, auditors and accountants, acting under a duty of confidentiality;
(e) insurers, venue operators and event management contractors, where necessary for the conduct of a physical event;
(f) regulatory authorities, law enforcement agencies, courts and tribunals, where disclosure is required by law or by an order of a competent authority; and
(g) an acquirer or successor in title, in the event of a merger, acquisition, restructuring or transfer of the whole or part of our business, subject to the recipient being bound by obligations equivalent to those in this Policy.
13.3 Every Data Processor engaged by us is bound by a written contract that requires it to Process Personal Data only on our documented instructions, to implement appropriate security measures, to assist us in responding to Data Subject requests, and to return or delete the data at the end of the engagement.
14. Data Security
14.1 We implement appropriate technical and organisational measures, having regard to the state of the art, the cost of implementation and the nature, scope and purposes of Processing, to safeguard Personal Data against unauthorised or unlawful Processing, accidental loss, destruction or damage.
14.2 These measures include:
(a) encryption of data in transit through secure sockets layer or transport layer security protocols;
(b) role based access controls, with access granted on a need to know basis and reviewed periodically;
(c) unique user credentials, password policies and multi factor authentication on administrative accounts;
(d) confidentiality undertakings executed by employees, facilitators, interns and contractors;
(e) periodic staff training on data protection obligations;
(f) secure backup, and secure disposal of physical records by shredding and of electronic records by permanent deletion; and
(g) periodic review of our security posture and of the security assurances given by our Data Processors.
14.3 Notwithstanding the measures set out above, the transmission of information over the internet is not entirely secure. Where you transmit Personal Data to us electronically, you do so at your own risk, and our liability is limited to the extent permitted by law.
15. Transfer of Personal Data Outside Kenya
15.1 Some of the service providers we rely on, including cloud hosting, email, webinar, analytics and international payment providers, may store or Process Personal Data on servers located outside Kenya.
15.2 Any such transfer shall be effected only where the conditions in sections 48 and 49 of the Act are satisfied, that is to say where:
(a) we have given proof to the Data Commissioner of appropriate safeguards with respect to the security and protection of the Personal Data;
(b) the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre contractual measures taken at your request;
(c) you have given your express Consent to the proposed transfer after having been informed of the possible risks; or
(d) the transfer is necessary for the establishment, exercise or defence of a legal claim, or is otherwise permitted under the Act.
15.3 Appropriate safeguards may include contractual clauses imposing data protection obligations on the recipient, binding corporate rules, or a determination that the recipient jurisdiction affords commensurate protection.
15.4 You may request information on the safeguards applicable to a specific transfer by writing to us at info@finsmarthub.africa.
16. Retention of Personal Data
16.1 We retain Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or for such longer period as may be required by law.
16.2 Our retention periods are as follows:
| Category of Personal Data | Retention Period |
|---|---|
| Enquiries that do not result in enrolment | Twelve (12) months from the date of last contact |
| Course registration and enrolment records | Seven (7) years from the end of the programme |
| Financial, payment and tax records | Seven (7) years, in accordance with section 23 of the Tax Procedures Act |
| Certification and assessment records | Ten (10) years, or such longer period as is necessary to verify a certificate on request |
| Marketing contact details | Until Consent is withdrawn, or after thirty six (36) months of inactivity, whichever occurs first |
| Photographs and video recordings | Five (5) years from the date of capture, or until Consent is withdrawn, whichever occurs first |
| Website analytics and cookie data | Twenty six (26) months from collection |
| Correspondence and complaint records | Three (3) years from resolution |
| Records relating to an actual or anticipated legal claim | Until the claim is finally determined and the applicable limitation period under the Limitation of Actions Act has expired |
16.3 At the expiry of the applicable retention period, Personal Data shall be securely erased, destroyed or irreversibly anonymised.
16.4 Anonymised data that cannot be used to identify you may be retained indefinitely for statistical and research purposes.
17. Personal Data Breach
17.1 We maintain an internal breach response procedure and a breach register recording every incident, its effects and the remedial action taken.
17.2 Where Personal Data has been accessed or acquired by an unauthorised person and there is a real risk of harm to you, we shall notify the Data Commissioner without undue delay and in any event within seventy two (72) hours of becoming aware of the breach, in accordance with section 43 of the Act. Where notification is made after that period, it shall be accompanied by the reasons for the delay.
17.3 We shall communicate the breach to you in writing within a reasonably practicable period, unless the identity of the affected Data Subjects cannot be ascertained, in which case we shall publish a notice in a manner reasonably calculated to bring the breach to your attention.
17.4 Any Data Processor engaged by us is required by contract to notify us of a breach affecting Personal Data within forty eight (48) hours of becoming aware of it.
18. Your Rights as a Data Subject
18.1 Subject to the Act, you have the following rights in respect of your Personal Data:
| Right | Substance of the Right | Our Response Time |
|---|---|---|
| To be informed | To be informed of the use to which your Personal Data is to be put | At the point of collection |
| Of access | To obtain confirmation as to whether we hold Personal Data relating to you, and to be furnished with a copy | Seven (7) days, free of charge |
| Of rectification | To have inaccurate, outdated, incomplete or misleading Personal Data corrected | Fourteen (14) days, free of charge |
| Of erasure | To have Personal Data deleted or destroyed where it is no longer necessary, is excessive, or was obtained or Processed unlawfully | Fourteen (14) days, free of charge |
| To restrict Processing | To require that Processing be restricted on the grounds set out in section 34 of the Act | Fourteen (14) days |
| To object | To object to the Processing of all or part of your Personal Data, including for direct marketing | Seven (7) days |
| To portability | To receive your Personal Data in a structured, commonly used, machine readable format, or to have it transmitted to another controller where technically feasible | Thirty (30) days, upon payment of the prescribed fee |
| To withdraw Consent | To withdraw Consent previously given, without affecting the lawfulness of prior Processing | Upon receipt |
18.2 A request may be submitted in writing to info@finsmarthub.africa, or in Form DPG 1, DPG 3 or DPG 4 as set out in the First Schedule to the Data Protection (General) Regulations, 2021, as applicable to the right being exercised.
18.3 We may require you to furnish reasonable proof of identity before acting on a request, in order to prevent disclosure to a person not entitled to receive the Personal Data.
18.4 Where a request is made by a person purporting to act on your behalf, that person shall furnish written authority to act, and we shall act in your best interests in accordance with section 27 of the Act.
18.5 Where we decline a request, we shall notify you in writing within seven (7) days and shall state the reasons for the refusal and your right to lodge a complaint with the Data Commissioner.
18.6 A request that is manifestly unfounded, excessive or repetitive may attract a reasonable fee reflecting the administrative cost of compliance, or may be declined.
19. Direct Marketing
19.1 We shall send you promotional communications only where you have consented to receive them, or where you are an existing client and the communication relates to Services similar to those you have already obtained.
19.2 Every marketing communication shall identify Finsmart Hub as the sender and shall contain a clear and cost free means of opting out.
19.3 A request to opt out of direct marketing, or to restrict the disclosure of your Personal Data to a third party for direct marketing purposes, shall be honoured within seven (7) days and at no cost to you.
20. Automated Decision Making
20.1 We do not subject you to any decision based solely on automated Processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.
20.2 Should we introduce such Processing, we shall notify you in advance, explain the logic involved and the consequences of the Processing, and afford you the right to obtain human intervention and to contest the decision.
21. Data Protection Impact Assessment
21.1 Where a proposed Processing operation is likely to result in a high risk to your rights and freedoms, we shall conduct a Data Protection Impact Assessment before commencing that Processing, and shall submit the report to the Data Commissioner not less than sixty (60) days before Processing commences, in accordance with the Act and the Data Protection (General) Regulations, 2021.
22. Third Party Links
22.1 The Website may contain links to external websites, platforms, payment pages and social media channels operated by third parties.
22.2 The inclusion of a link does not constitute an endorsement, and we exercise no control over, and accept no responsibility for, the content, security practices or data handling of any third party platform.
22.3 You are advised to read the privacy notice of every external site before submitting Personal Data to it.
23. Complaints
23.1 If you are dissatisfied with the manner in which we have Processed your Personal Data or handled a request, you may lodge a complaint with us in writing at info@finsmarthub.africa, marked for the attention of the Data Protection Officer.
23.2 We shall acknowledge your complaint within seven (7) days of receipt and shall communicate our findings and any remedial action within thirty (30) days.
23.3 Without prejudice to clause 23.1, you retain the right under section 56 of the Act to lodge a complaint directly with the Data Commissioner:
Office of the Data Protection Commissioner Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi P.O. Box 30920 to 00100, Nairobi, Kenya Telephone: +254 20 780 1800 Email: info@odpc.go.ke Complaints portal: www.odpc.go.ke/file-a-complaint/
23.4 Nothing in this Policy limits your right under section 65 of the Act to seek compensation for damage suffered as a result of a contravention of the Act.
24. Amendment of this Policy
24.1 We may amend this Policy from time to time to reflect changes in our Processing activities, our Services or the applicable law.
24.2 This Policy is not subject to expiry. It remains in force from the date of its publication until it is amended or withdrawn by us.
24.3 The current version shall at all times be published on the Website bearing the date on which it was last updated.
24.4 Where an amendment is material, we shall give you notice by email or by a prominent notice on the Website not less than fourteen (14) days before the amendment takes effect.
24.5 Your continued use of the Website or the Services after an amendment has been published constitutes acceptance of the amended Policy, save that where the amendment relies on Consent, fresh Consent shall be obtained.
25. Severability
25.1 If any provision of this Policy is held to be invalid, illegal or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.
26. Governing Law and Jurisdiction
26.1 This Policy is governed by and shall be construed in accordance with the laws of the Republic of Kenya.
26.2 Subject to clause 23, the courts of Kenya shall have jurisdiction in respect of any dispute arising out of or in connection with this Policy.
27. Contact
27.1 All notices, requests and enquiries relating to this Policy shall be addressed to the Data Protection Officer using the particulars set out in the Schedule.
PART B: PHOTOGRAPHY POLICY
28. Purpose and Application
28.1 This Part governs the capture, use, storage and dissemination of photographs taken at or in connection with Finsmart Hub events, Masterclasses, workshops, seminars, training sessions and networking activities.
28.2 A photograph in which a living individual can be identified constitutes Personal Data. Accordingly, this Part is to be read together with Part A of this Policy.
28.3 Finsmart Hub is committed to conducting all photography in a manner that respects the dignity, safety and privacy of every participant.
29. Photography at Events
29.1 Photography may take place at any Finsmart Hub event. Notice to that effect shall be given in the event registration materials and, where practicable, by signage at the venue.
29.2 By attending an event, you acknowledge that photography may occur.
29.3 If you do not wish to be photographed, you shall notify a member of our team before the commencement of the event or at registration, and we shall make reasonable arrangements to accommodate that request, which may include seating arrangements outside the photographed area or the use of a visible non photography indicator.
30. Authorised Photographers
30.1 Photography at our events may be undertaken only by:
(a) employees or officers of Finsmart Hub acting in the course of their duties;
(b) professional photographers engaged by Finsmart Hub under written contract; or
(c) attendees, strictly for personal and non commercial purposes.
30.2 Commercial photography by any person not authorised in writing by Finsmart Hub is prohibited.
30.3 Every contracted photographer shall execute a written agreement addressing confidentiality, assignment of copyright to Finsmart Hub, and compliance with the Act.
31. Consent and Image Rights
31.1 By registering for and attending a Finsmart Hub event, you grant Finsmart Hub a non exclusive, royalty free, worldwide licence to use photographs in which you appear for the following purposes:
(a) promotional and marketing materials, whether in print or online;
(b) content published on our Website and social media channels;
(c) educational and instructional materials; and
(d) event documentation, reports and internal records.
31.2 The licence in clause 31.1 is granted for the retention period stated in clause 16.2 and is revocable in accordance with clause 33.
31.3 Your name and contact particulars shall not be published alongside a photograph without your express written Consent.
31.4 Group and general audience photographs may be published without identifying individual participants.
31.5 A photograph shall not be used in a manner that suggests your endorsement of a product, service or position without your separate written Consent.
31.6 Photographs shall not be licensed, sold or supplied to any third party for that party’s own commercial purposes.
32. Guidelines for Participants
32.1 A participant taking photographs at an event shall observe the following:
(a) photography shall not disrupt the session, the presenters or other attendees;
(b) a photograph of another attendee shall not be published or shared without that attendee’s consent;
(c) photographing slides, handouts, workbooks or any other proprietary course material is prohibited;
(d) photography is not permitted in areas designated as private or restricted; and
(e) flash photography shall be avoided unless expressly permitted by the organisers.
32.2 A breach of clause 32.1 may result in removal from the event without refund and, where the circumstances warrant, referral to the appropriate authority.
33. Withdrawal of Consent
33.1 You may withdraw Consent to the use of a photograph in which you appear by written notice to info@finsmarthub.africa, identifying the event, the approximate date and, where possible, the photograph concerned.
33.2 Upon receipt, we shall cease further use of the identifiable image and shall remove it from materials under our control within fourteen (14) days.
33.3 We shall use reasonable endeavours to secure removal from materials no longer within our control, but we cannot guarantee retrieval of images already published, printed, distributed or reproduced by third parties.
34. Intellectual Property
34.1 Copyright in all photographs taken by Finsmart Hub or by a photographer engaged by Finsmart Hub vests in Finsmart Hub in accordance with the Copyright Act, 2001.
34.2 Reproduction, distribution, adaptation or commercial exploitation of such photographs without our written authority is prohibited.
34.3 Clause 34.1 does not derogate from your rights as a Data Subject under Part A of this Policy.
PART C: VIDEOGRAPHY POLICY
35. Purpose and Application
35.1 This Part governs the recording, use, storage and distribution of video and audio content captured at Finsmart Hub events, Masterclasses, workshops, training sessions and online sessions.
35.2 Video and audio recordings from which an individual can be identified constitute Personal Data, and this Part is to be read together with Part A of this Policy.
36. Recording at Events
36.1 Finsmart Hub may record video and audio at its events for educational, promotional, documentation and quality assurance purposes.
36.2 Notice that recording is to take place shall be given in the event registration materials and shall be repeated at the commencement of the session.
36.3 If you do not wish to appear in a recording, you shall notify our team before or at the commencement of the session, and we shall make reasonable arrangements, which may include seating you outside the camera field, muting your microphone, or disabling your camera in a virtual session.
37. Authorised Recording
37.1 Recording may be undertaken only by:
(a) employees or officers of Finsmart Hub;
(b) media professionals engaged by Finsmart Hub under written contract; or
(c) the recording function of the digital platform on which a virtual session is hosted.
37.2 Recording by a participant without our prior written approval is prohibited.
38. Use of Recorded Content
38.1 Recordings produced by or for Finsmart Hub may be used for:
(a) marketing and promotional campaigns, online and offline;
(b) social media content and Website publications;
(c) educational resources and course materials made available to enrolled participants;
(d) event highlights, recap videos and reports; and
(e) internal training, facilitator development and quality improvement.
38.2 Full names, contact particulars and any Sensitive Personal Data disclosed by a participant during a session shall be edited out before publication, unless the participant has given express written Consent to their inclusion.
38.3 Where a participant asks a question or makes a contribution that is to be published, we shall seek that participant’s Consent before publication.
39. Guidelines for Participants
39.1 Where recording by participants is expressly permitted for personal and non commercial use, the following apply:
(a) recording shall not interfere with the delivery of the session or the experience of other attendees;
(b) recording another participant without their knowledge or consent is prohibited;
(c) recording proprietary course content, presentations or materials is prohibited;
(d) recorded content shall not be shared, published, uploaded or distributed on any platform without our written Consent; and
(e) recording in restricted or private areas of a venue is prohibited.
40. Online and Virtual Sessions
40.1 Finsmart Hub reserves the right to record live virtual sessions for educational and quality assurance purposes.
40.2 Participants shall be informed at the commencement of a session when recording is active.
40.3 Screen recording, re recording or capture of a live session by a participant is prohibited.
40.4 A recording made available to participants after a session is licensed for individual study only and shall not be downloaded for redistribution, shared with non enrolled persons, or uploaded to any platform.
40.5 The digital platform used to host a virtual session Processes participant data in accordance with its own privacy terms. Where that platform stores data outside Kenya, clause 15 applies.
41. Storage and Retention
41.1 Recordings are stored on access controlled systems and are available only to authorised personnel.
41.2 Recordings shall be retained for the period stated in clause 16.2, after which they shall be securely deleted or irreversibly anonymised.
42. Withdrawal of Consent
42.1 You may withdraw Consent to the use of footage in which you appear by written notice to info@finsmarthub.africa, identifying the session and the approximate date.
42.2 We shall use reasonable endeavours to remove or obscure the identifiable footage within fourteen (14) days, where technically and practically feasible.
42.3 Footage already broadcast, published or distributed by third parties may not be fully retrievable, and we make no warranty as to its removal.
43. Intellectual Property
43.1 Copyright in all video and audio content produced by or for Finsmart Hub vests in Finsmart Hub.
43.2 Reproduction, distribution, editing, adaptation or commercial exploitation of such content without our written authority is prohibited and may attract civil and criminal liability under the Copyright Act, 2001.
44. Violations
44.1 A participant found to be in breach of this Part may be:
(a) required to cease recording immediately and to delete any unauthorised footage in the presence of a Finsmart Hub officer;
(b) removed from the event or session without refund;
(c) restricted from attending future Finsmart Hub events; and
(d) subject to civil proceedings or referral to the relevant authority where the circumstances warrant.
44.2 The remedies in clause 44.1 are cumulative and not alternative.
SCHEDULE: CONTACT PARTICULARS
Data Controller Finsmart Hub Limited (trading as Finsmart Hub Africa) Nairobi, Kenya
Data Protection Officer Attention: The Data Protection Officer Email: info@finsmarthub.africa Telephone: +254 717 734914
General Enquiries Email: info@finsmarthub.africa Telephone: +254 717 734914 Website: www.finsmarthub.africa
Supervisory Authority Office of the Data Protection Commissioner Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi P.O. Box 30920 to 00100, Nairobi Email: info@odpc.go.ke Website: www.odpc.go.ke
This Policy has been adopted by Finsmart Hub Limited and remains in force until amended or withdrawn.
