1. Legal Framework

As a data controller established in Kenya, Ethos Sales Drive primarily operates under the following laws and frameworks:

• Kenya Data Protection Act, 2019 (DPA)
• Data Protection (General) Regulations, 2021
• Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021
• Guidance and directives issued by the Office of the Data Protection Commissioner (ODPC)
• General Data Protection Regulation (EU) 2016/679 (GDPR) — where applicable to EEA data subjects

2. Lawful Basis for Processing

Under the Kenya DPA and, where applicable, the GDPR, we process personal data on one or more of the following lawful bases:

• Performance of a contract or steps prior to entering into a contract
• Compliance with a legal obligation
• Legitimate interests pursued by Ethos Sales Drive or a third party
• Protection of vital interests of the data subject
• Performance of a task carried out in the public interest
• Explicit consent of the data subject (where required)

3. Data Subject Rights

Subject to applicable law, data subjects have the following rights:

• Right to be informed about how personal data is used
• Right of access to personal data we hold
• Right to rectification of inaccurate or incomplete data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing, including direct marketing
• Right not to be subject to automated decision-making, including profiling
• Right to withdraw consent at any time, where processing is based on consent
• Right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya

To exercise any of these rights, please contact us using the details in Section 7.

4. Cross-Border Data Transfers

Where personal data is transferred outside Kenya, we ensure that the transfer is carried out in accordance with Section 48 of the Kenya Data Protection Act, 2019, which requires one of the following:

• Proof that the receiving country has adequate data protection laws
• Appropriate safeguards, such as standard contractual clauses
• The explicit consent of the data subject
• Necessity for the performance of a contract or other legal grounds

For transfers of EEA personal data outside the EEA, we rely on the European Commission's adequacy decisions or Standard Contractual Clauses, together with supplementary technical and organisational measures where required.

5. Data Protection Measures

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, role-based access control, monitoring systems, audit logging, staff confidentiality obligations, and periodic security reviews. These measures are designed to ensure a level of security appropriate to the risk, in line with the Kenya DPA and the GDPR.

6. Data Breach Notification

In the event of a personal data breach, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of the breach, where required by the Kenya Data Protection Act, 2019, and will notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Where EEA personal data is affected, we will also comply with the breach notification obligations under the GDPR.

7. Contact & Complaints

For any questions, requests, or complaints regarding this page or the processing of your personal data, please contact:

Email: info@ethostechhub.com

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, and, where applicable, with a supervisory authority in the EEA.