Privacy Policy

First Assurance Company Limited ("First Assurance", "we", "our", or "us") is committed to protecting the privacy, confidentiality, and security of the information entrusted to us.

This Privacy Policy explains how we collect, use, process, store, disclose, and protect personal information obtained through the First Assurance Online Portal ("Portal"), including information submitted when obtaining quotations, applying for insurance products and surety bonds, making payments, uploading supporting documentation, managing policies, or otherwise interacting with our services.

We are committed to complying with the Data Protection Act, 2019 of Kenya and applicable data protection regulations.

By accessing or using the Portal, you acknowledge that you have read and understood this Privacy Policy.

First Assurance Company Limited is a licensed insurance company offering insurance, bond and related financial protection products.

For purposes of the Kenya Data Protection Act, 2019, First Assurance acts as the Data Controller in respect of personal data collected through the Portal.

Where services are facilitated through brokers, intermediaries, technology providers, reinsurers, payment service providers, or other authorized third parties, such parties may act as Data Processors or independent Data Controllers as provided by law.

We may collect and process the following categories of information:

Personal Identification Information

• Full names;
• National Identification Number;
• Passport Number;
• KRA PIN;
• Date of birth;
• Gender;
• Signature;
• Photographs where required;
• Contact information including telephone numbers and email addresses.

Corporate and Business Information

Where applications are submitted on behalf of a business or organization, we may collect:

• Company name;
• Certificate of Incorporation;
• CR12 documentation;
• Business permits;
• Regulatory licences;
• Tax compliance certificates;
• Shareholding and directorship information;
• Authorized signatory details.

Financial Information

• Bank account information;
• Payment details;
• Proof of payment documentation;
• Audited accounts;
• Financial statements;
• Credit and financial references.

Insurance and Surety Bond Information

• Proposal and application forms;
• Risk information;
• Quotation requests;
• Policy information;
• Surety bond applications;
• Supporting underwriting documentation;
• Claims-related information where applicable.

Technical Information

When users access the Portal, we may automatically collect:

• IP addresses;
• Device information;
• Browser type and version;
• Operating system information;
• Login records;
• Access logs;
• Security monitoring records;
• Portal usage analytics.

We process personal data for legitimate business, contractual, legal, and regulatory purposes, including:

• Processing quotations and applications;
• Issuing policies and surety bonds;
• Conducting underwriting assessments;
• Verifying identity and eligibility;
• Complying with Know Your Customer (KYC) requirements;
• Assessing creditworthiness and risk;
• Processing payments and accounting transactions;
• Administering customer accounts;
• Managing customer relationships;
• Preventing fraud and financial crime;
• Complying with legal and regulatory requirements;
• Responding to enquiries and service requests;
• Improving Portal functionality and user experience;
• Exercising and defending legal rights and claims.

We process personal information only where there is a lawful basis to do so, including:

• Your consent;
• Performance of a contract;
• Compliance with legal obligations;
• Legitimate business interests that do not override your rights and freedoms;
• Establishment, exercise, or defence of legal claims;
• Protection of public interest and regulatory obligations.

We may disclose personal information where necessary to:

• Employees and authorized representatives of First Assurance;
• Licensed insurance brokers and intermediaries;
• Reinsurers;
• Banks and financial institutions;
• Payment service providers;
• Credit reference bureaus;
• Professional advisers, auditors, and consultants;
• Technology and cloud service providers;
• Government agencies, law enforcement authorities, regulators, and courts;
• Any person authorized by law or by you.

We shall take reasonable steps to ensure that any third party receiving personal information provides appropriate safeguards for its protection.

We implement reasonable technical, organizational, and administrative measures designed to protect personal information against unauthorized access, loss, misuse, disclosure, alteration, and destruction.

Such measures may include:

• Role-based access controls;
• User authentication procedures;
• Password protection;
• Secure hosting environments;
• Data encryption where appropriate;
• Audit logs and monitoring systems;
• Secure backup and recovery processes;
• Staff confidentiality obligations.

While we strive to safeguard personal information, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

We retain personal information only for as long as necessary to:

• Fulfil the purposes described in this Policy;
• Meet contractual obligations;
• Comply with legal and regulatory requirements;
• Resolve disputes;
• Enforce our legal rights.

Upon expiry of the applicable retention period, information shall be securely deleted, anonymized, or archived in accordance with applicable laws and internal retention procedures.

Subject to applicable law, you may have the right to:

• Be informed about how your personal data is used;
• Access personal data held about you;
• Request correction of inaccurate data;
• Request deletion of personal data where legally permissible;
• Object to certain processing activities;
• Restrict processing under certain circumstances;
• Withdraw consent where processing is based on consent;
• Request portability of personal information;
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

Requests may be submitted using the contact details provided in this Policy.

The Portal uses cookies and similar technologies to ensure its proper operation, maintain security, improve performance, and enhance user experience.

Cookies are small text files stored on a user's device when visiting the Portal.

Strictly Necessary Cookies

These cookies are essential to the operation and security of the Portal and may be used for:

• User authentication;
• Session management;
• Account security;
• Fraud prevention;
• Application processing;
• Platform functionality.

These cookies cannot be disabled because the Portal may not function properly without them.

Analytics Cookies

Where implemented, analytics cookies help us understand how users interact with the Portal by collecting information relating to:

• Pages visited;
• Navigation patterns;
• User engagement;
• System performance;
• Website usage statistics.

Analytics cookies will only be used where appropriate consent has been obtained.

Functional Cookies

These cookies assist in remembering user preferences and improving the user experience.

Users may manage cookie settings through browser controls or through any cookie preference tools made available on the Portal.

For further information regarding cookies and tracking technologies, users may contact us using the details provided below.

Upon first accessing the Portal, users may be presented with a Cookie Notice allowing them to:

• Accept all cookies;
• Reject optional cookies where available; or
• Manage cookie preferences.

By selecting applicable consent options, users consent to the use of cookies as described in this Policy.

Users may withdraw or modify cookie preferences at any time through available cookie management tools.

Where necessary for operational, security, disaster recovery, cloud hosting, or service delivery purposes, personal information may be processed or stored outside Kenya.

Where cross-border transfers occur, First Assurance shall take reasonable steps to ensure that appropriate safeguards are in place and that such transfers comply with applicable legal requirements.

The Portal may provide links to third-party websites for convenience.

First Assurance is not responsible for the privacy practices, security measures, or content of third-party websites.

Users are encouraged to review the privacy policies applicable to such websites.

We may update this Privacy Policy periodically to reflect legal, regulatory, operational, or technological changes.

The latest version will be published on the Portal and will become effective upon publication.

Users are encouraged to review this Policy periodically.

Questions, requests, or complaints regarding this Privacy Policy or the processing of personal information may be directed to First Assurance Company Limited.