Privacy Policy & Data Protection Charter

1. Statutory Framework & Data Controller Identity

Makeway Group Holdings Limited (“Makeway Group”, “we”, “our”, or “us”), having its principal global headquarters at 12th Floor, Mirage Towers, Waiyaki Way, Nairobi, Kenya, functions as a registered Data Controller and Data Processor under the Kenya Data Protection Act (Act No. 24 of 2019) administered by the Office of the Data Protection Commissioner (ODPC).

This Policy details our standards for collecting, processing, securing, and transferring personal, commercial, and executive information gathered through our web properties, advisory telepresence, client onboarding, and corporate transactions across our 8 core operating divisions.

2. Categories of Information Collected

We process corporate and personal data categorized under the following operational scopes:

• Executive Mandate & RFQ Records: Full name, institutional email, phone number, ministry or corporate entity name, sector advisory mandate overview, and transaction parameters submitted via our secure ingress desk.
• Institutional Due Diligence: Identity documentation, corporate registration certificates, beneficial ownership structures, and regulatory clearances required for anti-money laundering (AML/CFT) verification.
• Technical & Telemetry Data: Public IPv4/IPv6 addresses, browser signatures, request timestamps, and anonymized access logs essential for infrastructure security, DDoS deterrence, and performance optimization.

3. Purpose & Lawful Basis for Processing

In compliance with Section 30 of the Kenya Data Protection Act and international GDPR principles, Makeway Group processes data strictly under the following lawful bases:

• Performance of a Contract / Pre-contractual Mandate: Convening executive advisory sessions, underwriting transaction viability, and drafting mutual non-circumvention non-disclosure agreements (NCNDA).
• Legal & Regulatory Compliance: Conforming with statutory directives issued by the Central Bank of Kenya (CBK), Capital Markets Authority (CMA), and Financial Reporting Centre (FRC).
• Legitimate Commercial Interest: Enhancing digital portal resilience, fraud deterrence, and ensuring sovereign infrastructure integrity.

4. Cross-Border Data Transfers & Global Corridors

Given Makeway Group’s transnational syndication corridors connecting East Africa, Europe, the Middle East, and Asia, data may be accessed across regional subsidiaries. Cross-border transfers adhere strictly to Section 48 of the Act, requiring:

• Execution of Standard Contractual Clauses (SCC) and bilateral enterprise data transfer covenants.
• Verification that recipient sovereign jurisdictions maintain comparable data protection guarantees.
• Full encryption of transmission channels via TLS 1.3 and hardware-level encryption at rest.

5. Information Security & Retention Protocols

All database assets, inquiry tables, and executive communications are safeguarded within Tier-3 sovereign cloud infrastructure featuring AES-256 encryption at rest, role-based access controls (RBAC), and continuous multi-vector intrusion monitoring.

6. Data Subject Rights

Under the Kenya Data Protection Act 2019, you maintain enforceable statutory rights regarding your personal data:

• Right of Access: Request confirmation and certified extracts of personal data held in our systems.
• Right to Rectification: Request prompt correction of inaccurate, misleading, or incomplete corporate records.
• Right to Erasure (“Right to be Forgotten”): Demand deletion of data no longer required for statutory or contractual purposes.
• Right to Object & Restrict Processing: Restrict or object to direct communications or automated processing profiling.

7. Data Protection Office & Regulatory Inquiries

For formal requests, statutory notices, or compliance verifications, contact our designated Data Protection Officer: