Privacy Policy

1. Introduction and Scope

Metropol Credit Reference Bureau Limited (“Metropol,” “we,” “us,” “our”) is a credit bureau and information services provider. As an information services company, we collect, protect, and provide quality consumer and business information, which means we look after significant volumes of personal data. We are committed to using personal data responsibly.

This Privacy Policy applies specifically to events.metropol.co.ke (the “Site”) and explains how we collect, use, and process personal data of delegates, sponsors, and other individuals (“you,” “Data Subject”) who interact with the Site in connection with our conventions, conferences, and trainings (“Events”). It applies where Metropol determines the manner and purpose for which such information is processed — i.e. where we act as the Data Controller.

This Policy does not cover Metropol’s processing of Consumer Credit Information as a registered credit bureau, which is governed by our main corporate Privacy Notice available at metropol.co.ke and by the Credit Reference Bureau (“CRB”) Regulations.

We may update this Policy from time to time. Where we do, we will post the amended version on the Site with a revised “Last updated” date.

2. Who Is Responsible for Processing Your Personal Data?

The Data Controller for personal data collected through this Site is:

Metropol Credit Reference Bureau Limited
Registered Office: KCB Towers, 15th Floor, Nairobi, Kenya
Email: data@metropol.co.ke
Website: metropol.co.ke
Tel: +254 709 834 000

For any enquiries on this Privacy Policy, please contact our Data Privacy Office at data@metropol.co.ke.

3. Our Privacy Principles

Metropol strives to comply with all applicable data privacy legislation, including the Kenya Data Protection Act, 2019. Personal data that we hold about you will be:

• used in a lawful, fair, and transparent manner;
• collected for lawful purposes and only used in ways compatible with those purposes;
• limited to what is necessary for achieving those purposes;
• accurate and kept up to date;
• retained only for as long as necessary to achieve our purposes for collection and to meet any applicable legal obligations; and
• protected from unauthorised access, use, or disclosure.

4. Key Terms

• “Data Controller” means the organisation that determines the purposes and manner of processing Personal Data — i.e. Metropol, in respect of data collected via this Site.
• “Data Subject” means any individual from whom, or in respect of whom, Personal Data has been requested, collected, or processed — including delegates, sponsor contacts, and Site users.
• “Personal Data” means information about an identifiable person that identifies or relates directly to you.
• “Processing” means the collection, receipt, recording, organisation, storage, updating, retrieval, use, and/or sharing of your Personal Data in the ways set out in this Policy.
• “Special Personal Data” means particularly sensitive categories of Personal Data (e.g. health information, such as dietary or accessibility requirements you disclose for an Event), which we process only to the extent strictly necessary and with appropriate safeguards.

5. Personal Data We Collect and Why

We will only use your Personal Data for the purposes for which it was collected, or a purpose reasonably compatible with those purposes.

6. Legal Basis for Processing

We only process your Personal Data where at least one of the following applies:

• Performance of a contract — to process your Event registration or sponsorship arrangement, or take steps at your request before entering into one;
• Consent — for example, when you opt in to marketing updates, or agree to be photographed or recorded at an Event;
• Legitimate interests — for example, Event administration, safety, and improving the Site, balanced against your rights and interests; or
• Legal obligation — where processing is required by applicable law or regulation.

7. Am I Obliged to Provide This Personal Data?

Provision of Personal Data through this Site is generally voluntary. However:

• If you do not provide the information required to register for an Event (e.g. name, contact details), we will not be able to process your registration.
• If you do not provide sponsorship enquiry details, we will not be able to assess or respond to your enquiry.
• Non-essential cookies are used only with your consent; declining them will not prevent you from using the Site but may affect certain features.

8. Security of Your Personal Data

We take appropriate technical and organisational measures to protect your Personal Data from unauthorised access, misuse, loss, alteration, or destruction. Access to your Personal Data is limited to employees, agents, contractors, and third parties who have a genuine business need for it, and who are subject to confidentiality obligations. We review our data handling practices periodically to keep pace with good industry practice, and we have procedures to detect and respond to any suspected data breach, including notifying the applicable regulator and affected individuals where legally required.

9. Retention of Your Personal Data

We retain your Personal Data only for as long as necessary to achieve the purposes described in this Policy, including:

• Registration and attendance data — for the Event cycle and a reasonable period afterward for reporting and record-keeping;
• Sponsorship enquiry data — for the duration of the sponsorship relationship and a reasonable period afterward;
• Marketing consent data — until you withdraw your consent; and
• Any data we are legally required to retain — for the applicable statutory period.

Our need to retain your Personal Data is reassessed periodically, and data no longer required for any purpose is securely disposed of.

10. Sharing Your Personal Data

We share your Personal Data only with those who need it to achieve the purpose for which it was collected, or to comply with a legal obligation, including:

• Event venues, accommodation providers, and logistics partners, to the extent necessary to deliver an Event;
• Third-party payment processors, to process registration fees or sponsorship invoices;
• Sponsors, in limited circumstances (e.g. shared delegate lists for networking), only where disclosed at registration or where you have consented;
• Speakers or facilitators, where necessary for session delivery;
• Service providers who support our Site, email, or event management systems, acting under our instruction and subject to confidentiality obligations; and
• Regulators or authorities, where required by law.

We do not sell your Personal Data.

11. Transborder Flow of Information

We store Personal Data collected through this Site in Kenya. Where we engage service providers based outside Kenya (for example, cloud infrastructure providers), any cross-border transfer of your Personal Data is carried out in line with the requirements of, and with a similar level of protection as described in, this Policy and the Kenya Data Protection Act, 2019.

12. Your Rights

Subject to applicable law, you have the right to:

• Confirmation — request confirmation of the categories of Personal Data we hold about you;
• Access — request a copy of the Personal Data we hold about you (a “data subject access request”);
• Correction — request correction of any incomplete or inaccurate Personal Data;
• Erasure — request deletion of your Personal Data where there is no lawful basis for us to continue processing it; and
• Withdraw consent — at any time, where we rely on consent to process your Personal Data (this does not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to provide certain services to you).

To exercise any of these rights, please contact our Data Privacy Office at data@metropol.co.ke. We may need to verify your identity before actioning a request, to ensure your Personal Data is not disclosed to anyone without the right to receive it.

13. Queries and Complaints

If you have questions about this Privacy Policy, please contact our Data Privacy Office at data@metropol.co.ke. If your query is not resolved to your satisfaction, you may also contact us at info@metropol.co.ke.

Where these channels have not resolved your query or complaint appropriately, you have the right to lodge a complaint at any time with the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke).

14. Children’s Data

The Site and Events are intended for professional/business audiences and are not directed at children. We do not knowingly collect Personal Data from individuals under 18.

15. Contact Us

Metropol Credit Reference Bureau Limited
KCB Towers, 15th Floor, Nairobi, Kenya
Data Privacy Office: data@metropol.co.ke
General Enquiries: events@metropol.co.ke
Phone: +254 709 834 000