HFM Investments Ltd

Privacy Policy

___ ___ ___

The Oval Building, Corner of Jalaram Road/Ring Westlands T. +254-203894292 [email protected]

5th Floor, Office 2-7, P.O. Box 30333-00100, Nairobi, Kenya www.hfm.com/ke
 HFM Investments Ltd
Privacy Policy

Table of Contents

Introduction................................................................................................................... 3

Collection of Personal Data ............................................................................................ 4

No Children's Data Collection ......................................................................................... 5

Use of Personal Data ...................................................................................................... 5

Cookies .......................................................................................................................... 7

Links to other websites .................................................................................................. 8

Client Records Retention Periods ................................................................................... 8

Sharing and Disclosure of Personal Data ......................................................................... 8

Business Transfers Legal Requirements .......................................................................... 9

Personal Data Transfers outside Kenya ......................................................................... 10

Marketing Communications – Services Subscriptions Preferences ................................. 10

Personal Data Rights .................................................................................................... 10

Automated decision-making and profiling .................................................................... 12

Confidentiality and Security of Personal Data ............................................................... 13

Amendments to this Policy ........................................................................................... 13

Enquiries and Contact Details ....................................................................................... 14

2
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

Introduction

HFM Investments LTD is a member of HF Markets Group, incorporated under the laws of
the Republic of Kenya with Registration Number PVT-BEUJQBA (hereinafter the
“Company”). The Company is authorised and regulated by the Capital Markets Authority
(“CMA”) to act as a non-dealing foreign exchange broker under the Capital Markets (Online
Foreign Exchange Trading) Regulations, 2017 with License No 155.
This privacy statement covers the website www.hfm.com/ke and all its related sub-
domains and mobile applications that are registered and operated by HFM Investments
Ltd.
The Company acting in its capacity as non-dealing foreign exchange broker and in
accordance with the Data Protection Act No. 24 of 2019 (the “Law”) outlines in the Privacy
Policy (herein the “Policy”) how the Company collects, maintains, handles, protects and
discloses (if applicable) personal information of the Client.
This Policy applies to the Company’s employees and/or associated persons and/or any
other companies within HF Markets Group and all the Companies follow the principles as
outlined herein.

This Policy applies to existing clients, prospective clients, clients who have terminated their
contractual relationship with the Company and website visitors (hereinafter jointly referred
to as the “Clients” or “you”) who are accessing or using the Company’s website(s) and
mobile applications (hereinafter referred to as the “Platforms”).

The Company is committed to protecting the privacy of all Clients’ Personal Data which it
processes in accordance with the provisions of the Law, the Data Protection (General)
Regulations 2021, this Policy and the Company’s Terms of Business.

For the purposes of this Policy, references to “Personal Data” shall mean data which
identifies or may identify Clients and which may include, for example, a Client’s name,
address, identification number, telephone number and date of birth.

3
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

Collection of Personal Data

The Company collects different types of Personal Data through the Company’s Platforms
from Clients who visit such Platforms or access, use or request products and services
offered by the Company.

The provision of certain Personal Data is required for establishing a contractual relationship
with the Company. Clients not wishing to provide such Personal Data will not be able to
open an account with the Company or be provided with other products and/or services of
the Company.

Clients have a responsibility to ensure that the Personal Data they provide to the Company
and recorded in their personal account (myHF Area) remain accurate and up to date
throughout the period of their contractual relationship with the Company.

In addition to the information provided by Clients, the Company also lawfully collects and
processes Personal Data from publicly available sources (including, inter alia, the press,
social media and the internet) and third-party risk management software solutions in order
to meet its regulatory obligations and for confirming the validity of the provided
information.

The Personal Data received from the Client, collected and processed by the Company are
required for the communication, identification, verification and assessment for the
business relationship establishment with the Client, contract performance and legal
compliance. The following Personal Data may be collected from Clients depending on the
product and/or service the Company provides to him:

(a) Contact details such as the Client’s name, e-mail address and phone number.
(b) Identification details such as the Client’s identification or passport number.
(c) Biographical and demographic data such as gender, age, ethnicity, education,
occupation, the Client’s financial trading experience and whether he has a prominent
public function status (PEP).
(d) Financial information such as the Client’s income status, bank account number and
account details, tax information and other financial information.
4
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

(e) Information relevant to the services that the Company provides to the Client such as
the Client’s transactions and communication records with the Company.
(f) Details of visitors’ and Clients’ visits to the Company’s website and information
collected through cookies and other tracking technologies including IP address and
domain name, browser version, operating system and geolocation.
(g) Information in relation to criminal convictions and offences to the extent required
and/or permitted by applicable law.
(h) Information in relation to the client's mobile device Call log with the permission of the
client.
(i) Your marketing preferences.

No Children's Data Collection

The Company understands the importance of protecting children’s privacy. The Company's
services are not intended for children under eighteen (18) years of age nor is the Company’s
website designed for use by children. Therefore, the Company does not knowingly or
specifically collect children's personal data. If the Company collects such data mistakenly
or unintentionally, the Company shall delete the information at the earliest possible once
it obtains knowledge thereof. If the Client becomes aware of such data collection he/she
shall notify the Company at [email protected].

Use of Personal Data

The Company collects and processes Personal Data which are required for the evaluation,
establishment and maintenance of the contractual relationship between the Company and
the Client and in order to comply with this Policy and applicable laws and regulations
governing the provision of financial services. In some cases, the Company may also process
the Client’s Personal Data to pursue its legitimate interests or those of third parties,
provided that the Clients’ interests and fundamental rights are not overridden by those of
the Company or the third party.

5
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

Specifically, the Client’s Personal Data will most commonly be used in the following
circumstances:

(a) Where the Company needs to perform the contract it has entered with the Client or in
order to take certain steps prior to entering into a contract with the Client
Processing is necessary for the Company in order to provide the Client with its products
and services, and more specifically in order:
• To verify the Client’s identity and carry out any required credit checks;
• To ensure that the Client meets the suitability requirements to use the Company’s
products and services;
• To manage the account the Client holds with the Company;
• To process the Client’s transactions; and
• To send to the Client any information about transactions/post-transactions
services.

If the Client does not provide the requested Personal Data, the Company may be
unable to offer the Client with its products and/or services.

(b) Where the Company needs to comply with a legal obligation

As an investment firm, the Company is required to comply with certain legal and
regulatory obligations which may involve the processing of Personal Data. Such
obligations and requirements impose on the Company necessary data processing
activities for identify verifications, compliance with court orders, tax law or other
reporting obligations and anti-money laundering controls.

(c) Where the Company has legitimate interests to use the Client’s Personal Data

More specifically, the Company may process the Personal Data for the following
purposes:

• To develop or enhance its products and services;

• To enhance the security of the Company’s network and information systems;

6
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

• To identify, prevent and investigate fraud and other unlawful activities,

unauthorised transactions and other liabilities and manage risk exposure;
• To maintain its accounts and records;
• To manage its business operations and comply with internal policies and
procedures;
• To defend, investigate or prosecute legal claims;
• To receive professional advice (such as legal advice), and
• For the analysis of statistical data which helps the Company in providing its Clients
with better products and services in the future. It should be noted that the
Company anonymises and aggregate such data so that they do not directly or
indirectly reveal the Clients’ identities. The Company may provide this statistical
data to third parties (as described in more detail in Section 8) solely for statistical
purposes and in an effort to improve the Company’s marketing campaign.
(d) Where the Client has given his consent
• The Company will ask for the Client’s consent when the Company wishes to
provide marketing information to its Clients in relation to its products or services
which may be of interest to the Client.
• The Company will ask for Clients’ permission to access their mobile device call log
for the sole purpose of completing the phone number verification process.
• The Company will ask for Clients’ permission to electronically verify their identity
by providing their personal information to identity verification providers.
The Client may withdraw such consent at any time. This right doesn’t affect the lawfulness
of processing that was based on that consent before its withdrawal.

Cookies

A cookie is a small text file that is stored on a user's computer for record-keeping purposes.
The Company uses cookies on its website(s) to ensure and provide the Client with a good
experience when he browses our website and allows us to improve our website.

7
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

To understand more about the kind of cookies we use and how you can control and delete
cookies, please see our Cookie Policy.

Links to other websites

The Company’s website contains or may contain links to other websites or social media
platforms of interest. However, once you have used these links to leave the Company’s
website, you should note that the Company does not have any control over those other
websites. Therefore, the Company cannot be responsible for the protection and privacy of
any information which you provide whilst visiting such sites and such sites are not governed
by this Policy. You should exercise caution and look at the privacy statement applicable to
the website in question.

The Company will not be liable for the unlawful or unauthorized use of the Client’s Personal
Data due to misuse and/or malicious use and/or negligence and/or misplacement of the
Client’s passwords either by him/her or any third party.

Client Records Retention Periods

Under the applicable laws and regulations, the Company is required to keep records
containing Client Personal Data, trading information, account opening documents,
communications and anything else which relates to the Client after the execution of each
transaction and/or for 7 (seven) years of the termination of the business relationship.

Sharing and Disclosure of Personal Data

In the course of the performance of the Company’s contractual and statutory obligations,
the Client’s Personal Data may be disclosed to third parties. Most of such third parties enter
into contractual arrangements with the Company by which they observe data protection
and confidentiality according to applicable law and regulations.

Under the circumstances referred to above, recipients of Personal Data may be, for
example:

8
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

(a) third party payment service providers who help the Company provide its Clients the
services of securely deposit and withdrawal to and from a Client’s account;

(b) other service providers that the Company has chosen to support it in the effective
provision of its products and services by offering technological expertise, solutions and
support;
(c) governmental and regulatory bodies, including law enforcement authorities and FSCA,
in connection with enquiries, proceedings or investigations by such parties or in order
to enable the Company to comply with its legal and regulatory requirements;
(d) credit reference and fraud prevention agencies, third party authentication service
providers and other financial institutions for the purposes of credit checking, fraud
prevention and anti-money laundering controls;
(e) third party service providers for the provision of the required customer support
services through live chat and the Company’s website visits and traffic monitoring
through cookies;
(f) external consultants including legal and tax consultants;
(g) data reporting service providers;
(h) market research companies and call centers; and
(i) affiliates of the Company.

In accordance with the recommendations of Payment Card Industry Security Standards

Council, customer card details are protected using Transport Layer encryption — TLS 1.2
and application layer with algorithm AES and key length 256 bit.
The Company does not collect, store or process any personal credit or debit card
information. All payment transactions are processed through payment gateway providers.

Business Transfers Legal Requirements

If the Company is involved in a merger, acquisition, financing due diligence, reorganization,

bankruptcy, receivership, sale of company assets, or transition of service to another

9
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

provider, Client’s Personal Data and other information may be transferred to a successor
or affiliate as part of that transaction along with other assets.

Personal Data Transfers outside Kenya

The Company is committed to protecting Personal Data especially when these are to be
transferred outside Kenya. The Law allows personal data to be transferred outside of Kenya
if the conditions on the appropriate safeguards with respect to the security and protection
of personal data are in place. Where adequate safeguards are established, the rights of
Clients continue to be protected even after their data has been transferred outside Kenya
for processing.

The Company may transfer or disclose the Personal Data of Clients inside or outside Kenya
to any company within the HF Group as well as third party service providers (i.e. Processors)
who are engaged on our behalf and are processing such data based on our instructions and
in compliance with this policy and other appropriate confidentially and security measures
or arrangements.

Marketing Communications – Services Subscriptions Preferences

The Company may process Personal Data to tell its Clients about products, services and
offers that may be of interest to the Client. The Company may only process such Personal
Data if it has obtained the Client’s explicit consent to do so.

If the Client no longer wishes to receive any promotional communications, he may opt-out
of receiving them by following the instructions included in each communication or by
updating his email subscription preferences within the Client account area.

Personal Data Rights

Clients have the following rights in relation to their Personal Data:

10
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

• Right of access: The Client has the right to be informed whether the Company is
processing his/her Personal Data, and if so, to provide the Client with a copy of that
Personal Data.

• Right to rectification: The Client is entitled to request that the Company corrects or
completes his/her Personal Data if it is inaccurate or incomplete.

• Right to erasure: This enables the Client to ask the Company to erase or remove the
Client’s Personal Data under certain circumstances, such as when the Client withdraws
his consent.

• Right to restrict processing: This enables the Client to ask the Company to restrict the
processing of the Client’s Personal Data if:

o it is not accurate;

o it has been used unlawfully but the Client doesn’t want it to be deleted;

o it is not relevant any more, but the Client wants the Company to keep it for use in
possible legal claims;

o the Client has already asked the Company to stop using his Personal Data but he is
waiting for the Company to confirm if it has legitimate grounds to use such Personal
Data.

• Right to data portability: The Client has the right to obtain his/her Personal Data
provided to the Company in a structured, commonly used and machine-readable
format.

• Right to object: The Client may ask the Company at any time to stop processing his/her
Personal Data, and the Company will do so:

o If the Company is relying on a legitimate interest to process the Client’s Personal

Data and the Company cannot demonstrate compelling legitimate grounds for the
processing, or

o If the Company is processing Client’s Personal Data for direct marketing.

11
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

• Rights in relation to automated decision-making and profiling: The Client has the
right to be free from decisions based solely on automated processing of his/her
Personal Data, including profiling, that affect him/her, unless such profiling is
necessary for entering into, or the performance of, a contract between Client and the
Company or the Client provides explicit consent.

• Right to withdraw consent: If the Company relies on the Client’s consent to process
his/her Personal Data, the Client has the right to withdraw that consent at any time.
This will not affect the lawfulness of the processing that took place on the basis of the
Client’s prior consent.

• Right to lodge a complaint with the data protection authority: If the Client has a
concern about the Company’s privacy practices, including the way in which the
Company handled his/her Personal Data, the Client can report it to the relevant data
protection authority.

To exercise any of the above rights, the Client may contact the Company at
[email protected].

Automated decision-making and profiling

When you make an application for account opening we will use systems to make an
automated assessment of your knowledge and experience through the evaluation of an
appropriateness test. In such cases, you have the right to contact us to:

(a) give you information about the processing of your personal data (please also see
Section 12 of this Policy in relation to your rights); and/or
(b) request that one of our employees examines your application and obtain an
explanation for the automated decision reached. You also have the right to challenge
such a decision. Following such a request, we will reassess your application, taking into
consideration both the reasons that a particular automated decision was reached as
well as your own point of view.

12
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

Confidentiality and Security of Personal Data

Personal Data which the Company holds is to be treated by the Company as confidential
and will not be used for any purpose other than those specified in this Policy.

Any Personal Data that the Client provides to the Company will be treated as confidential
and shared only with the parties set out in Section 8 of this Policy.

Such Personal Data will not be disclosed to any other third party except if such disclosure
is required under any regulatory or legal proceedings.

The Personal Data that the Client provides in connection with registering as a user of the
website(s) or for the Services is classified as Registration Information. The Company offers
high protection of the Registration Information provided by the Client. The Client can
access his Registration Information through a password selected by him which is encrypted
and known only to the Client. The Client must be careful and protect his password from any
third parties. Registration Information is safely stored on secure servers that only
authorized personnel have access to via password. The Company encrypts all Personal Data
as it is transferred to the Company and thus makes all necessary effort to prevent
unauthorized parties from viewing any such information.

Personal Data provided to the Company that is not Registration Information also resides on
secure servers and is again accessible only to authorized personnel via password. This
information is not accessible by the Client; therefore, no password is provided to view or
modify this information.

Amendments to this Policy

The Company reserves the right to review and amend this Policy from time to time for any
reason and notify the Clients of any such amendments accordingly by posting an updated
version of this Policy on the Company’s website(s). The Company will notify you about any
material changes to this Policy by placing a notice on its website or by communicating with
you directly.

13
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA
 HFM Investments Ltd
Privacy Policy

The Client is responsible for regularly reviewing the Policy and any amendments thereof.

Enquiries and Contact Details

For any general enquiries regarding this Policy please contact the Company by emailing the
Customer Support Department at [email protected].

For any requests in regard to personal data rights, as set out in Section 12 of this Policy, or
questions about how the Company processes Client’s Personal Data, please contact us at
[email protected] .

Version: 2023/01

14
Regulated by the Capital Markets Authority (CMA)
License Number 155 Registration Number PVT-BEUJQBA