PRIVACY POLICY

1. Introduction

Century City Property Limited ("Century City Property", "the Company", "we", "us" or "our") is committed to protecting the privacy, confidentiality and security of personal information entrusted to it in the course of its business activities.

The Company recognises the importance of safeguarding personal data and is committed to processing such information responsibly, transparently and in accordance with applicable Kenyan legislation, including the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021 and other applicable data protection requirements.

This Privacy Policy explains how Century City Property collects, receives, accesses, uses, stores, maintains, discloses and protects personal information in connection with its property development, real estate, property management, estate administration, facilities management and related business activities.

The Policy applies to property owners, residents, tenants, prospective purchasers, visitors, employees, contractors, suppliers, clients, website users and other individuals whose personal information may be processed by Century City Property.

It also addresses the Company's responsibilities when handling personal information on behalf of third-party organisations that have appointed Century City Property to manage properties, administer operations, maintain records or provide other contracted services.

2. Scope and Application

This Privacy Policy applies to personal information processed by Century City Property in the course of its own business operations and to personal information entrusted to the Company by clients under property management, estate administration, facilities management or other service agreements.

For the purposes of this Policy, "Clients" includes property owners, developers, management companies, homeowners' associations, residents' associations, commercial property owners and other legal entities that engage Century City Property to provide services.

The Policy applies regardless of whether personal information is maintained electronically, in physical records, through third-party software platforms or within information systems administered by Century City Property.

Where the Company processes information on behalf of a Client, the respective rights and responsibilities of the parties shall be determined by applicable law, the nature of the processing activities and the relevant contractual arrangements.

This Policy does not supersede any applicable legal obligation or contractual data processing agreement. Where a Client acts as the Data Controller, its own privacy notices and policies may also apply to the relevant processing activities.

3. Collection of Personal Information

In the ordinary course of its operations, Century City Property may collect, receive, access and process personal information necessary for the effective delivery of its services and the fulfilment of contractual, operational and legal responsibilities.

Such information may include names, telephone numbers, email addresses, physical addresses, identification details, property ownership records, tenancy and occupancy information, emergency contact details and other information relevant to an individual's relationship with the Company or a property under its management.

The Company may also process financial and transactional information, including service charge accounts, utility consumption records, invoices, statements, payment histories, outstanding balances, banking information and other records necessary for financial administration.

In connection with property security and access management, Century City Property may process vehicle registration information, visitor records, access control information, CCTV footage, security incident reports and other information reasonably necessary for maintaining the safety and security of managed properties.

The Company may also maintain correspondence, complaints, service requests, maintenance records, contractor information and other operational records generated through the administration of properties and facilities.

Where individuals interact with the Company's websites, applications or digital platforms, certain technical information may be collected, including IP addresses, device information, login records and usage information, where necessary for the operation, security and improvement of such systems.

Century City Property seeks to ensure that personal information processed is adequate, relevant and limited to what is reasonably necessary for its intended purposes.

4. Methods of Collection

Personal information may be collected directly from individuals through property transactions, purchase agreements, tenancy arrangements, management agreements, registration forms, correspondence, service requests and other interactions with Century City Property.

Information may also be obtained through property management systems, resident portals, visitor registration procedures, access control systems, CCTV surveillance and other operational infrastructure.

In certain circumstances, information may be provided to Century City Property by Clients, property owners, landlords, residents' associations, management companies, professional advisers, contractors, service providers or other authorised third parties.

Where information is provided by a Client for processing on its behalf, Century City Property shall process such information in accordance with the Client's lawful instructions, the relevant contractual arrangements and applicable data protection legislation.

5. Purposes of Processing

Century City Property processes personal information for purposes reasonably connected with its business activities and the performance of its contractual and statutory obligations.

These purposes may include administering property ownership and tenancy records, managing service charge accounts, issuing invoices and statements, processing payments, administering utility billing, coordinating maintenance and repairs, managing common facilities and communicating operational notices to property owners, residents and other stakeholders.

Personal information may also be processed to administer security arrangements, verify access authorisations, register visitors, monitor security infrastructure, investigate incidents and respond to emergencies.

The Company may further process information to respond to enquiries and complaints, provide customer support, administer contracts, manage suppliers and contractors, maintain accounting records, undertake financial reporting and audits, and comply with legal or regulatory requirements.

Where permitted by law, personal information may also be used to communicate information about the Company's developments, properties and services. Direct marketing activities will be undertaken in accordance with applicable legal requirements, including the provision of appropriate mechanisms for opting out.

Where Century City Property processes personal information on behalf of a Client, the purposes of processing shall be limited to those authorised by the relevant Data Controller, except where additional processing is required or permitted by law.

6. Data Controller and Data Processor Responsibilities

Century City Property recognises that its responsibilities under applicable data protection legislation may vary depending on the nature of the processing activity and the relationship under which personal information is obtained.

Where the Company independently determines the purposes and essential means of processing personal information in connection with its own business operations, it shall act as a Data Controller and assume the responsibilities applicable to that role.

Where Century City Property processes personal information on behalf of a Client that determines the purposes and essential means of such processing, the Client shall ordinarily act as the Data Controller and Century City Property shall act as the Data Processor.

The designation of either party as a Data Controller or Data Processor shall be determined by the actual nature of the processing activities and applicable law, rather than solely by contractual description.

Century City Property acknowledges that its appointment as a managing agent, administrator, facilities manager or other service provider does not, by itself, confer ownership of, or unrestricted rights over, information entrusted to it by a Client.

Personal information processed on behalf of Clients shall be used only for authorised purposes connected with the performance of the Company's contractual obligations, in accordance with lawful instructions and applicable data protection legislation.

The Company shall not independently disclose, commercialise or use Client-controlled personal information for purposes unrelated to its authorised responsibilities, except where required or permitted by law.

Each party shall remain responsible for fulfilling the obligations imposed upon it under applicable data protection legislation and the contractual arrangements governing the processing of personal information.

7. Processing of Information Entrusted by Clients

Century City Property may be appointed by third-party organisations to manage, administer, maintain or otherwise process information relating to properties, residents, owners, tenants, employees, contractors, suppliers and other individuals associated with the Client's operations.

Such appointments may involve responsibility for maintaining databases, financial records, ownership and occupancy registers, utility consumption records, correspondence, service charge accounts, security information, maintenance records and other operational information.

Where Century City Property acts as a Data Processor, it shall process personal information only in accordance with the lawful and documented instructions of the relevant Data Controller, subject to applicable legal obligations.

The Company shall implement appropriate technical and organisational measures designed to protect information entrusted to its care against unauthorised access, disclosure, alteration, misuse, loss or destruction.

Access to Client-controlled personal information shall be limited, where practicable, to authorised employees, representatives and service providers whose responsibilities reasonably require such access.

Century City Property shall maintain appropriate confidentiality arrangements and shall take reasonable steps to ensure that personnel and service providers with access to such information understand their obligations concerning its use and protection.

Where third-party software providers, technology platforms, security companies or other subcontractors are engaged to process Client-controlled personal information, the Company shall ensure that the necessary authorisations and data protection safeguards are established in accordance with applicable law and contractual requirements.

The relevant Data Controller shall remain responsible for determining the lawful purposes and legal basis of processing and for issuing lawful instructions governing information processed on its behalf, to the extent required by law.

Century City Property shall remain responsible for its own statutory and contractual obligations as a Data Processor, including compliance with lawful instructions, confidentiality requirements, appropriate security measures and applicable breach notification and cooperation obligations.

Nothing in this Policy shall be interpreted as transferring to Century City Property the statutory responsibilities of a Client acting as Data Controller, nor shall it relieve Century City Property of obligations imposed upon it by applicable law.

8. Legal Basis for Processing

Century City Property processes personal information only where an appropriate lawful basis exists under applicable data protection legislation.

Depending on the circumstances, processing may be necessary for the performance of a contract, compliance with a legal obligation, the pursuit of legitimate interests that do not override the rights and freedoms of the individual, or the protection of vital interests.

Where consent is required, the Company shall seek appropriate consent before undertaking the relevant processing activity.

Where processing is undertaken on behalf of a Client acting as Data Controller, the Client shall ordinarily be responsible for establishing the lawful basis for processing, while Century City Property shall be responsible for processing information in accordance with lawful instructions and its own applicable legal obligations.

Where processing is based on consent, individuals may withdraw that consent in accordance with applicable law. Withdrawal of consent shall not affect the lawfulness of processing undertaken before such withdrawal or processing that may lawfully continue on another legal basis.

9. Disclosure and Sharing of Personal Information

Century City Property does not sell personal information to third parties.

In the course of its business operations, the Company may disclose personal information to authorised parties where such disclosure is lawful, necessary and proportionate to the relevant purpose.

Such parties may include property owners, landlords, management companies, homeowners' associations, residents' associations, security providers, facilities management contractors, utility providers, financial institutions, payment processors, professional advisers, technology providers and other service providers involved in the administration or management of properties.

Information may also be disclosed to government agencies, regulators, courts, law enforcement authorities or other competent bodies where required or permitted by law.

Where personal information is processed on behalf of a Client, disclosure to third parties shall be undertaken in accordance with the Client's lawful instructions, applicable contractual arrangements and relevant data protection requirements.

Century City Property shall seek to ensure that third parties receiving personal information are subject to appropriate confidentiality, security and data protection obligations.

10. CCTV Surveillance and Access Control

Properties under the management of Century City Property may be equipped with CCTV surveillance, electronic access control systems, visitor registration procedures and other security infrastructure.

These systems are intended to support the safety and security of residents, visitors, employees, contractors and property, as well as the prevention, detection and investigation of security incidents.

Information obtained through these systems may include images, vehicle registration details, identification information, entry and exit records and other security-related information.

Access to CCTV recordings and security records shall be restricted to authorised personnel and service providers with a legitimate operational requirement.

Where Century City Property administers security systems on behalf of a Client, the respective responsibilities concerning surveillance, access, retention and disclosure shall be determined by applicable law and the relevant contractual arrangements.

CCTV footage and security records shall be retained for periods proportionate to their intended purposes, subject to applicable legal requirements and any lawful need to preserve information for investigations, disputes or legal proceedings.

Appropriate notices shall be displayed in areas subject to CCTV surveillance.

11. Data Security and Confidentiality

Century City Property is committed to implementing reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, accidental loss, misuse, alteration, disclosure or destruction.

These safeguards may include secure information systems, user authentication, access restrictions, role-based permissions, secure storage and backup arrangements, confidentiality obligations and internal procedures governing the handling of personal information.

Access to information shall be limited, where practicable, to personnel and authorised service providers who require such information to perform their responsibilities.

Where the Company processes information on behalf of Clients, it shall implement safeguards appropriate to the nature of the information, the risks associated with processing and the scope of its contractual responsibilities. The Company shall take reasonable steps to identify, investigate, contain and address personal data breaches and shall cooperate with the relevant Data Controller and competent authorities where required by law.

Where Century City Property acts as a Data Processor, it shall notify the relevant Data Controller of a personal data breach without undue delay and within any applicable statutory or contractual timeframe.

Although reasonable precautions are taken, no electronic transmission or storage system can be guaranteed to be completely secure.

12. Data Retention and Disposal

Century City Property retains personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected or processed, or as otherwise required or permitted by law.

Retention periods may depend on the nature of the information, the duration of the relevant property or contractual relationship, statutory record-keeping requirements, operational needs and the establishment, exercise or defence of legal claims.

Where personal information is processed on behalf of a Client, the applicable retention arrangements shall be determined by the relevant Data Controller's lawful instructions, the contractual arrangements and applicable law.

Upon the expiry or termination of a management or service agreement, Century City Property shall, subject to applicable legal requirements, return, transfer or securely delete personal information processed on behalf of the Client in accordance with the relevant contractual provisions and lawful instructions.

Any information retained to comply with an independent legal obligation shall remain subject to appropriate confidentiality, security and retention requirements and shall not be used for unrelated purposes. Where personal information is no longer required, the Company shall take reasonable steps to securely delete, destroy or anonymise it.

13. International Transfers of Personal Information

Century City Property may engage technology providers, cloud hosting platforms, software vendors and other service providers whose systems or operations are located outside Kenya.

Where personal information is transferred, stored or processed outside Kenya, the Company shall take appropriate steps to ensure compliance with applicable Kenyan data protection legislation. Such transfers shall be undertaken only where a lawful transfer condition is satisfied and appropriate safeguards are in place.Where Century City Property processes personal information on behalf of a Client, international transfers shall also be subject to the relevant Data Controller's lawful instructions and applicable contractual requirements.

14. Rights of Individuals

Century City Property respects the rights of individuals concerning their personal information and is committed to facilitating the exercise of those rights in accordance with applicable law. Individuals have the right to be informed about the collection and use of their personal information and may request access to information held about them. They may also request correction of inaccurate, incomplete or misleading information and, in circumstances provided by law, request deletion or erasure of personal information.

Individuals may object to certain processing activities and exercise applicable rights concerning data portability and withdrawal of consent. These rights are subject to applicable legal conditions and limitations, including statutory retention requirements and the rights and freedoms of other individuals.

Where Century City Property acts as the Data Controller, it shall respond to requests in accordance with applicable legal requirements. Where the Company processes personal information on behalf of a Client acting as Data Controller, requests may be referred to the relevant Client, and Century City Property shall provide reasonable assistance in accordance with applicable law and contractual arrangements.

The Company may require reasonable verification of identity before responding to a request.

15. Protection of Children's Personal Information

In the course of managing residential properties and associated facilities, Century City Property may process limited personal information relating to children, particularly where necessary for security, emergency response, access administration or the provision of residential services.

The Company recognises the importance of protecting children's privacy and shall process such information only where an appropriate lawful basis exists and suitable safeguards are in place.

Where required by law, consent shall be obtained from a parent or legal guardian before processing a child's personal information.

Century City Property shall seek to limit the collection and use of such information to what is reasonably necessary and shall take appropriate measures to prevent unauthorised access or disclosure.

16. Websites, Applications and Cookies

Century City Property may operate websites, digital applications, resident portals and other electronic platforms to facilitate communication, property management, billing, service requests and access to information.

These platforms may use cookies and similar technologies to enable essential functionality, maintain system security, improve user experience and understand how digital services are used.

Where non-essential cookies or tracking technologies are employed, the Company shall provide appropriate information and obtain consent where required by law.

Where digital platforms are operated on behalf of Clients, the respective data protection responsibilities shall be determined by the nature of the processing activities and the relevant contractual arrangements.

Third-party platforms may be subject to additional privacy policies or terms governing their services.

17. Provision of Personal Information

Certain personal information may be necessary for Century City Property to fulfil contractual obligations, administer properties, process financial transactions, provide services, manage security or comply with legal requirements.

Where the provision of information is mandatory, the Company shall seek to explain the nature and purpose of the requirement where practicable.

Failure to provide information reasonably necessary for a particular service or obligation may affect the Company's ability to complete a transaction, administer an account, provide access to facilities or fulfil an applicable contractual or statutory requirement.

18. Complaints and Regulatory Rights

Century City Property is committed to addressing privacy-related concerns fairly, transparently and within applicable legal timeframes.Individuals who believe their personal information has been collected, used, disclosed or otherwise processed inappropriately may contact the Company using the details provided below.

Where a complaint relates to personal information processed on behalf of a Client acting as Data Controller, Century City Property may refer the matter to the relevant Client and provide reasonable assistance in its resolution. Individuals also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the regulatory authority responsible for overseeing compliance with data protection legislation in Kenya.

Further information is available at www.odpc.go.ke.

19. Contact Information

Questions, requests or complaints concerning this Privacy Policy or the processing of personal information may be directed to Century City Property Limited through its designated privacy and data protection contact. Where a request relates to information processed on behalf of a Client, the Company may coordinate with the relevant Data Controller to ensure that the request is addressed appropriately.

20. Amendments to This Privacy Policy

Century City Property reserves the right to amend or update this Privacy Policy periodically to reflect changes in its business operations, service offerings, technology, contractual arrangements or applicable legal and regulatory requirements. Any revised version shall be published through the Company's official website or other appropriate communication channels, together with an updated effective date. Where changes materially affect the processing of personal information, the Company shall take appropriate steps to inform affected individuals where required by law.

21. Governing Law

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the Republic of Kenya, including the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021 and other applicable legislation concerning privacy and personal data protection.

Nothing in this Policy shall be construed as excluding, restricting or transferring any statutory responsibility or liability in a manner prohibited by applicable law.

CENTURY CITY PROPERTY LIMITED

Committed to responsible property management, transparency, confidentiality and the protection of personal information.