Privacy Notice
Important, Please Read This Notice Carefully
This Privacy Notice explains how Salaam Investment Bank Kenya Limited ("SIBK", "we", "us", or "our") collects, uses, stores, shares, and protects your personal information when you visit our website, use our services, or interact with us in any way. By using our website or engaging with SIBK, you acknowledge that you have read and understood this Privacy Notice.
SIBK is committed to protecting your privacy and processing your personal data in accordance with the Data Protection Act, No. 24 of 2019 of Kenya and all subsidiary legislation and guidelines issued by the Office of the Data Protection Commissioner (ODPC).
1. Who We Are, Data Controller
Salaam Investment Bank Kenya Limited is the Data Controller in respect of personal data collected through this website and in connection with our services. We are registered with the Office of the Data Protection Commissioner as required under the Data Protection Act, 2019.
| Company Name | Salaam Investment Bank Kenya Limited |
|---|---|
| Registered Address | Britam Tower, 19th Floor, Hospital Road, Upperhill, Nairobi, Kenya |
| Privacy Enquiries | info@salaaminvestments.com |
2. Personal Data We Collect
Depending on how you interact with SIBK, we may collect the following categories of personal data.
2.1 Data You Provide Directly
- Identity data: full name, date of birth, nationality, gender, national ID or passport number
- Contact data: email address, telephone number, postal and residential address
- Financial data: bank account details, income information, investment objectives, tax identification numbers, source of funds
- KYC and onboarding data: copies of identity documents, proof of address, beneficial ownership declarations, politically exposed person (PEP) status
- Investment mandate data: risk profile, investment preferences, portfolio instructions, and communication preferences
- Correspondence data: emails, letters, enquiry forms, and records of telephone communications with SIBK
2.2 Data Collected Automatically
- Usage data: pages visited, time spent on the website, links clicked, and browsing patterns
- Device and technical data: IP address, browser type and version, operating system, device identifiers, and screen resolution
- Cookie data: data collected through cookies and similar tracking technologies, see Section 7 (Cookies) below
2.3 Data from Third Parties
- Regulatory and compliance data: sanctions screening results, credit reference checks, and AML/KYC verification data obtained from licensed third party providers
- Publicly available data: information from public registers, company registries, regulatory filings, and published sources used for due diligence purposes
- Referral data: contact details provided by introducers or referring parties
Sensitive Personal Data
SIBK does not ordinarily seek to collect sensitive personal data (as defined under the Data Protection Act, including racial or ethnic origin, health data, religious beliefs, or biometric data). Where such data is collected incidentally, for example where it is contained in identity documents, it will be handled with additional care and processed only to the extent strictly necessary for compliance and regulatory purposes.
3. How and Why We Use Your Personal Data
We process your personal data only where we have a lawful basis to do so under the Data Protection Act, 2019. The table below sets out the key purposes for which we use your data and the corresponding lawful basis.
| Purpose | Examples | Lawful Basis |
|---|---|---|
| Client onboarding & KYC | Verifying your identity, conducting AML/CFT/CPF checks, processing account applications | Legal obligation, legitimate interests |
| Service delivery | Managing your investment portfolio, executing transactions, providing advisory services, generating reports | Contract, legitimate interests |
| Regulatory compliance | Filing regulatory reports, responding to CMA/FRC enquiries, complying with court orders | Legal obligation |
| Communications | Responding to enquiries, sending service notices, distributing investment reports and market updates | Contract, legitimate interests |
| Marketing & research | Sending information about SIBK products and services, where consent given or legitimate interest applies | Consent, legitimate interests |
| Website analytics | Analysing website usage to improve user experience and content | Legitimate interests, consent (cookies) |
| Security & fraud prevention | Detecting and preventing fraud, unauthorised access, or financial crime | Legal obligation, legitimate interests |
| Legal claims | Establishing, exercising, or defending legal claims | Legitimate interests, legal obligation |
4. Disclosure of Your Personal Data
SIBK does not sell your personal data. We may share your personal data with the following categories of recipients, strictly on a need to know basis and subject to appropriate confidentiality and data protection obligations.
4.1 Regulators and Public Authorities
- Capital Markets Authority of Kenya (CMA)
- Financial Reporting Centre (FRC), for AML/CFT/CPF reporting obligations
- Retirement Benefits Authority (RBA), where applicable
- Office of the Data Protection Commissioner (ODPC)
- Kenya Revenue Authority (KRA), for tax reporting obligations
- Courts, tribunals, and law enforcement agencies, where required by law or court order
4.2 Service Providers and Data Processors
We engage carefully selected third party service providers who process personal data on our behalf under written data processing agreements. These include:
- IT systems and cloud infrastructure providers
- KYC and AML screening technology providers
- Custodians and settlement agents
- Auditors, legal advisers, and professional consultants
- Communication and document management platforms
4.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of SIBK's business or assets, your personal data may be transferred to the relevant successor entity, subject to equivalent data protection protections being maintained.
4.4 With Your Consent
We may share your data with other third parties where you have provided your express consent to such sharing.
International Data Transfers
Where it is necessary to transfer your personal data outside Kenya, SIBK will only do so in accordance with the Data Protection Act, 2019, ensuring adequate protections are in place, including transferring to a country deemed adequate by the ODPC, using ODPC approved standard contractual clauses, or obtaining your express consent where required.
5. How Long We Keep Your Data
We retain your personal data only for as long as is necessary for the purposes for which it was collected, and in compliance with applicable legal and regulatory retention requirements.
| Category of Data | Retention Period |
|---|---|
| KYC and client onboarding records | Minimum 7 years from the end of the client relationship, or as required by AML/CFT/CPF regulations |
| Transaction and portfolio records | Minimum 7 years from the date of the transaction, in line with Capital Markets Act requirements |
| Client communications and correspondence | 5 to 7 years from the date of the communication |
| Regulatory compliance records | As required by the relevant regulator, typically 7 to 10 years |
| Website usage and cookie data | Up to 24 months, subject to cookie consent preferences |
| Marketing and consent records | Until consent is withdrawn |
| Unsuccessful client applications | 2 years from the date of the application |
On expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with SIBK's data policy.
6. Your Data Subject Rights
Under the Data Protection Act, No. 24 of 2019 of Kenya, you have the following rights in respect of your personal data. To exercise any of these rights, please contact our Data Protection Officer at info@salaaminvestments.com. We will respond within 21 days, or such other period as permitted by law, except that requests for correction or erasure will be responded to within 14 days, in line with the Data Protection Regulations.
| Your Right | What This Means |
|---|---|
| Right of Access | You have the right to request a copy of the personal data we hold about you and information about how we process it. |
| Right to Rectification | You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. We will respond within 14 days. |
| Right to Erasure | You may request that we delete your personal data where it is no longer necessary, where you withdraw consent, or where we have no other lawful basis for processing it. We will respond within 14 days. |
| Right to Restrict Processing | You may request that we restrict the processing of your personal data in certain circumstances, for example while the accuracy of the data is being contested. |
| Right to Data Portability | Where processing is based on your consent or contract, you may request your personal data in a structured, commonly used, machine readable format. |
| Right to Object | You have the right to object to the processing of your personal data where we rely on legitimate interests, including for direct marketing purposes. |
| Right to Withdraw Consent | Where we process your data on the basis of your consent, you may withdraw that consent at any time. |
| Right to Lodge a Complaint | You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you are dissatisfied with how we handle your personal data. |
Limitations on Rights
Some of your rights are not absolute and may be subject to exceptions, for example where processing is necessary for compliance with a legal obligation, for the prevention of financial crime, or for the establishment or defence of legal claims. We will notify you if any such exception applies to your request.
Exercise Your Rights
Use this form to submit a Data Subject Request: access, rectification, erasure, restriction, objection, data portability, or withdrawal of consent (including for marketing or for use of your image/video). It goes directly to our Data Protection Officer, who will respond within 21 days, or within 14 days for correction or erasure requests, in line with the Data Protection Regulations.
Media Consent
If SIBK has asked to use your image, video, or likeness in our marketing or communications, use this form to record your consent.
Salaam Investment Bank Kenya Limited ("SIBK", "Bank", or "we") uses images (still or moving) of people using our services or taking part in Bank-related activities, in print and electronic publications, video, audio, adverts, press releases, photo galleries, news media, social media, and other channels, to promote and market the Bank. By submitting this form, you agree that:
- You give SIBK consent, without expectation of compensation, to use your name and image as described above, including distribution to third parties such as media outlets or Bank partners; SIBK will not pass your details to any other organisation without your explicit consent unless legally obligated.
- This may include use on the Internet and social media, and so may be accessible to overseas recipients; you consent to that disclosure. SIBK will take reasonable measures to prevent unauthorised access and will notify you promptly of any data breach affecting your information.
- Intellectual property in any data/media covered by this consent is assigned to SIBK. Embarrassing, distressing, or otherwise inappropriate content will not be used.
- You waive any right to approve the finished materials, and any right to compensation or royalties, in connection with this use.
- You agree to indemnify SIBK against claims arising from this use, including claims for invasion of privacy, defamation, or copyright infringement, to the extent permitted by law.
You can withdraw this consent at any time using the Data Subject Request form above (select "Withdrawal of consent"), or by visiting any SIBK branch.
7. Cookies and Tracking Technologies
Cookies are small text files placed on your device when you visit a website. They help the website function properly, remember your preferences, and provide us with information about how the website is used.
| Cookie Type | Purpose | Basis |
|---|---|---|
| Strictly Necessary | Essential for the website to function, for example session management, security, and load balancing | No consent required |
| Analytics & Performance | Help us understand how visitors use the website | Consent required |
| Functionality | Remember your preferences and settings | Consent required |
| Marketing & Targeting | Track browsing activity to deliver relevant advertising | Consent required |
You can manage or withdraw your consent to non essential cookies at any time through our cookie management tool, or by adjusting your browser settings. Disabling certain cookies may affect the functionality of the website.
How We Protect Your Personal Data
- Encryption of personal data in transit and at rest using industry standard protocols
- Access controls and multi factor authentication on all systems holding personal data
- Role based access restrictions ensuring staff access only the data necessary for their role
- Data breach response procedures, including mandatory notification to the ODPC on discovery of a qualifying breach
Children's Privacy
Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take prompt steps to delete such data.
Marketing Communications
Where you have consented, or where we have a legitimate interest, we may contact you with information about SIBK's products, services, and market insights. You may opt out at any time by clicking the unsubscribe link in any marketing email.
8. How to Contact Us
If you have questions about this Privacy Notice, wish to exercise your data subject rights, or have a complaint about how we have handled your personal data, please contact our Data Protection Officer in the first instance at info@salaaminvestments.com.
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner.
Office of the Data Protection Commissioner
Website: www.odpc.go.ke
Email: info@odpc.go.ke
Address: Nairobi, Kenya
Regulatory and Compliance Note
Salaam Investment Bank Kenya Limited is licensed and regulated by the Capital Markets Authority of Kenya (CMA Licence No. 115) and is registered with the Office of the Data Protection Commissioner as a data controller.
Image Credits
Photography of Britam Tower used across this website is not the property of Salaam Investment Bank Kenya Limited. It is used here under the terms of the open licences listed below, and remains the property of the original photographer.
- Britam Tower, Nairobi — Eddiemm, Wikimedia Commons, licensed under CC BY-SA 4.0.
- Britam Tower, Nairobi — Antony Trivet, Wikimedia Commons, licensed under CC BY-SA 4.0.
- Britam Tower, Nairobi — Daniel Case, Wikimedia Commons, licensed under CC BY-SA 4.0.
- Britam Tower, Nairobi — Daniel Case, Wikimedia Commons, licensed under CC BY-SA 4.0.