Last Updated: 27th January 2026

INTRODUCTION

The Ndege Group, Africa’s Sovereign Development Trust® (“we,” “us,” or “our”), maintains an unwavering commitment to safeguarding your privacy and protecting your personal data with the highest standards of diligence and integrity. This commitment is anchored in our strict adherence to the Data Protection Act, 2019 of Kenya, the UK General Data Protection Regulation (UK GDPR), and the Seychelles Data Protection Act, 2021.

This Privacy Policy provides comprehensive detail on how we collect, use, store, share, and protect your personal data when you visit or interact with our website at www.thendegegroup.com (the “Website”), engage with our official social media channels, or communicate with us through any digital medium. By accessing or using the Website or engaging with our institutional presence across digital platforms, you acknowledge and consent to the data practices described herein.

ARTICLE 1: DATA CONTROLLER

The data controller responsible for the processing of personal data collected through the Website and associated digital platforms is:

Brand, People & Culture Desk

The Ndege Group Nominees Limited for Africa’s Sovereign Development Trust®

Head Office:

UN Crescent, Gigiri

P.O. Box 43112-00100

Nairobi, Kenya

Trust’s Domicile:

1st Floor, Eden Plaza, Eden Island

Victoria, The Seychelles

U.K. Mailing Address:

116 Pall Mall, St. James’s

London, SW1Y 5ED, United Kingdom

Primary Contact: hello@thendegegroup.com | +254 799 504 111

Legal Enquiries: legal@ndege.co.

ARTICLE 2: CATEGORIES OF PERSONAL DATA COLLECTED

We may collect and process the following categories of personal data when you interact with our digital properties:

2.1 Identity and Contact Information

This encompasses data such as your full name, professional title, organisational affiliation, email address, telephone number, postal address, and any other identifying information you provide when completing contact forms, subscribing to communications, submitting enquiries via the Website, or engaging through direct messages on social media platforms.

2.2 Technical and Usage Data

Information concerning your interaction with and navigation of the Website, including but not limited to: Internet Protocol (IP) address, browser type and version, device identifiers, operating system, time zone settings, referring and exit pages, clickstream data, pages viewed, time spent on pages, search queries, and other diagnostic data. This category also includes aggregated, non-personally identifiable data from your interactions with our social media channels (such as engagement metrics, reach data, and interaction patterns) as provided by social media platforms in accordance with their analytics services.

This data is collected through automated technologies including cookies, web beacons, server logs, and third-party analytics tools such as Google Analytics.

2.3 Communications and Correspondence Data

Details from emails, letters, telephone conversations, chat interactions, and any other communications you send to us or exchange with us, including information shared via direct messages on social media platforms. This includes the content of your messages, metadata associated with communications, and any attachments you provide.

2.4 Voluntarily Submitted Information

Any additional information you elect to provide, including but not limited to: feedback on our initiatives, survey responses, details related to project enquiries or collaboration interests, research participation data, event registration information, curriculum vitae or professional credentials submitted for partnership opportunities, and any other data you choose to share whether via the Website, social media platforms, or direct communication channels.

2.5 Special Categories of Data

We do not routinely collect special categories of personal data (also known as sensitive personal data), which include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation. Should circumstances arise requiring the processing of such data, we will seek your explicit consent and implement enhanced safeguards as required by applicable data protection law.

2.6 Children’s Data

We do not knowingly collect, process, or solicit personal data from individuals under the age of 16 without verifiable parental or guardian consent. Our services are not directed towards children. If you believe that we may have inadvertently collected personal data from a child under 16 without appropriate consent, please contact us immediately at legal@ndege.co.ke so that we may take prompt action to investigate and, if necessary, delete such data in accordance with our legal obligations.

ARTICLE 3: METHODS OF DATA COLLECTION

We gather personal data through the following methodologies:

3.1 Direct Interactions and Voluntary Provision

You provide data directly when you: complete forms on our Website (including contact forms, newsletter subscriptions, enquiry forms, and registration forms); engage with live chat features or customer service interfaces; communicate with us via email, telephone, postal mail, or direct messaging on social media platforms; participate in surveys, feedback mechanisms, or research initiatives; register for events, webinars, or institutional programmes; submit applications for partnerships, collaborations, or professional opportunities; or voluntarily share information in the course of any interaction with our organisation.

3.2 Automated Collection Technologies

As you navigate and interact with our Website, we automatically collect Technical and Usage Data through: cookies (small text files stored on your device); web beacons and pixel tags (transparent graphic images placed on web pages or in emails); server logs (records of server activity); analytics platforms such as Google Analytics, which provide aggregated usage statistics; and session replay tools that may record anonymised browsing sessions to improve user experience.

For detailed information on our use of cookies and similar technologies, please refer to our Cookie Policy.

3.3 Social Media Platform Data

We collect aggregated usage and engagement data from social media platforms regarding interactions with our official social media channels. This data is provided by the platforms in accordance with their terms of service and is subject to the privacy settings and policies of those platforms. The extent of data we receive depends on your privacy settings on each platform and the permissions you have granted.

3.4 Third-Party Sources and Public Information

We may receive personal data about you from various third-party sources and publicly available channels, including but not limited to: analytics providers (such as Google Analytics) that supply technical and usage data; advertising networks and search information providers; publicly accessible databases, registries, and directories; social media platforms where you have made information publicly available or granted permission for data sharing; professional networking platforms; business partners, affiliates, or sub-contractors who provide services on our behalf; and publicly available sources such as institutional websites, published research, media articles, and government registries.

ARTICLE 4: PURPOSES AND LEGAL BASIS FOR PROCESSING

We process your personal data for specific, explicit, and legitimate purposes, relying on appropriate legal bases under the Data Protection Act, 2019 of Kenya:

4.1 Service Provision and Communication

Purpose: To fulfil your requests, respond to enquiries, provide information about our initiatives and projects, deliver services you have requested, manage our relationship with you, and facilitate communications initiated via any channel including social media.

Legal Basis: Performance of a contract with you, or taking steps at your request prior to entering into a contract (Section 32(a) of the Data Protection Act, 2019); or our legitimate interests in communicating effectively with stakeholders and managing our institutional operations (Section 32(f) of the Data Protection Act, 2019).

4.2 Website and Digital Platform Optimisation

Purpose: To analyse usage patterns, identify and resolve technical issues, conduct user experience research, enhance functionality, improve content relevance and quality, optimise navigation and accessibility, and refine our digital engagement strategies across all platforms.

Legal Basis: Our legitimate interests in understanding how our digital properties are utilised to continuously improve our services and better serve our stakeholders (Section 32(f) of the Data Protection Act, 2019).

4.3 Marketing, Communications, and Stakeholder Engagement

Purpose: To send newsletters, institutional updates, promotional materials, event invitations, research publications, policy briefs, and other information about our activities, services, programmes, and initiatives, where you have consented to receive such communications or where we have a legitimate interest in doing so.

Legal Basis: Your explicit consent (Section 32(b) of the Data Protection Act, 2019); or our legitimate interests in promoting our activities to relevant audiences, maintaining stakeholder relationships, and advancing the mission of Africa’s Sovereign Development Trust® (Section 32(f) of the Data Protection Act, 2019). You retain the absolute right to withdraw consent or object to processing at any time.

4.4 Legal and Regulatory Compliance

Purpose: To meet our regulatory, statutory, and legal obligations under Kenyan, Seychellois, and United Kingdom law, including but not limited to tax reporting, anti-money laundering requirements, counter-terrorism financing obligations, data protection compliance, financial reporting, audit requirements, and responding to lawful requests from regulatory authorities or law enforcement.

Legal Basis: Compliance with legal obligations to which we are subject (Section 32(c) of the Data Protection Act, 2019).

4.5 Protection of Rights, Security, and Fraud Prevention

Purpose: To prevent, detect, and investigate fraud, unauthorised access, security breaches, and other unlawful activities; enforce our Terms of Use and other legal agreements; protect and defend our intellectual property rights; maintain the security and integrity of our systems; prevent misuse of our services; and defend against legal claims or proceedings.

Legal Basis: Our legitimate interests in protecting our business, institutional reputation, rights, assets, and the security of our users and stakeholders (Section 32(f) of the Data Protection Act, 2019); compliance with legal obligations (Section 32(c) of the Data Protection Act, 2019).

4.6 Research, Development, and Institutional Advancement

Purpose: To conduct research into developmental frameworks, policy effectiveness, and institutional impact; develop new methodologies and services; advance the objectives of Africa’s Sovereign Development Trust®; and contribute to the body of knowledge in sovereign-scale development coordination.

Legal Basis: Our legitimate interests in advancing our institutional mission, contributing to academic and policy discourse, and developing innovative approaches to continental development challenges (Section 32(f) of the Data Protection Act, 2019).

4.7 Business Operations and Strategic Planning

Purpose: To administer and improve our internal operations, conduct data analysis and testing, maintain records, perform financial and accounting functions, engage in strategic planning, assess institutional performance, and ensure business continuity.

Legal Basis: Our legitimate interests in operating efficiently and effectively as an organisation (Section 32(f) of the Data Protection Act, 2019).

ARTICLE 5: DATA SHARING, DISCLOSURE, AND INTERNATIONAL TRANSFERS

5.1 Categories of Recipients

We may share your personal data with the following categories of recipients, subject to appropriate safeguards and contractual obligations:

5.1.1 Service Providers and Processors

Trusted third-party service providers who perform functions on our behalf, including but not limited to: website hosting and infrastructure providers; cloud storage and computing services; data analytics and business intelligence platforms; email delivery and marketing automation services; customer relationship management (CRM) systems; social media management and monitoring tools; IT support, maintenance, and security services; professional advisors including legal counsel, auditors, and consultants; payment processors and financial service providers; and research partners and academic institutions.

These service providers are contractually obligated to process your data only as instructed by us, maintain confidentiality, implement appropriate security measures, and comply with applicable data protection laws.

5.1.2 Legal and Regulatory Authorities

When required by law, court order, legal process, or governmental request, we may disclose your personal data to: law enforcement agencies; regulatory bodies and supervisory authorities; tax authorities; courts and tribunals; and other public authorities or government entities.

We will only disclose the minimum amount of information necessary to comply with the legal requirement and will, where legally permissible, notify you of such disclosure.

5.1.3 Business Transfer Recipients

In the event of a merger, acquisition, sale of assets, reorganisation, restructuring, dissolution, or other corporate transaction or proceeding, your personal data may be transferred to the acquiring or successor entity. We will ensure that any such transfer is subject to equivalent or stronger data protection standards and will, where required by law, notify you of the transfer and provide you with choices regarding your data.

5.1.4 Professional Advisors and Partners

We may share data with professional advisors such as lawyers, accountants, auditors, and consultants who provide professional services to us, as well as strategic partners and collaborators involved in joint initiatives, subject to appropriate confidentiality obligations.

5.2 International Data Transfers

Given that Africa’s Sovereign Development Trust® maintains operational presence across multiple jurisdictions (Kenya, The Seychelles, and the United Kingdom), and utilises global service providers, some data processing activities may occur outside Kenya and may involve transfers to countries that have not received an adequacy determination from the Office of the Data Protection Commissioner (ODPC) in Kenya.

When transferring your personal data internationally, we ensure full compliance with the Data Protection Act, 2019 of Kenya by implementing appropriate safeguards, which may include:

• 5.2.1 Adequacy Decisions: Transferring data to countries or territories that have been determined by the ODPC to provide an adequate level of data protection.

• 5.2.2 Standard Contractual Clauses: Implementing Standard Contractual Clauses (also known as Model Clauses) approved by the ODPC or recognised international data protection authorities, which impose strict contractual obligations on the recipient to protect your data.

• 5.2.3 Binding Corporate Rules: Where applicable, relying on Binding Corporate Rules approved by competent data protection authorities.

• 5.2.4 Specific Consent: In certain circumstances, obtaining your explicit, informed consent for the specific transfer.

• 5.2.5 Jurisdictional Compliance: Ensuring that transfers to entities in the United Kingdom comply with the UK GDPR and that transfers to The Seychelles comply with the Seychelles Data Protection Act, 2021.

We take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy and the requirements of applicable data protection law, regardless of where it is processed.

5.3 No Sale of Personal Data

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. Any sharing of data is conducted solely for the purposes outlined in this Privacy Policy and under strict contractual and legal safeguards.

ARTICLE 6: DATA SECURITY AND PROTECTION MEASURES

6.1 Security Framework

We have implemented comprehensive technical and organisational measures designed to protect your personal data from accidental loss, unauthorised or unlawful access, use, alteration, disclosure, or destruction. Our security framework adheres strictly to the principles of security by design and by default as required by the Data Protection Act, 2019 of Kenya.

6.2 Technical Security Measures

Our technical security measures include, but are not limited to: encryption of data in transit using industry-standard protocols (such as TLS/SSL); encryption of sensitive data at rest; pseudonymisation and anonymisation techniques where appropriate; secure authentication mechanisms including multi-factor authentication; regular security patching and system updates; intrusion detection and prevention systems; firewalls and network segmentation; secure backup and disaster recovery systems; and regular vulnerability assessments and penetration testing.

6.3 Organisational Security Measures

Our organisational security measures include: strict access controls based on the principle of least privilege; role-based access management; confidentiality obligations and training for all personnel with access to personal data; background checks for personnel in sensitive roles; data protection impact assessments for high-risk processing activities; incident response and breach notification procedures; regular security awareness training; documented security policies and procedures; and third-party security audits and compliance assessments.

6.4 Limitations on Security

Whilst we implement rigorous security measures, it is important to acknowledge that no method of transmission over the internet or method of electronic storage is entirely secure. The transmission of information via the internet carries inherent risks. Whilst we strive to protect your personal data using industry-standard security practices, we cannot guarantee absolute security of data transmitted to our Website or through third-party platforms such as social media.

You are responsible for maintaining the confidentiality of any passwords or authentication credentials you use to access our services. We recommend using strong, unique passwords and enabling two-factor authentication where available.

ARTICLE 7: DATA RETENTION AND DELETION

7.1 Retention Principles

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, satisfy legal, accounting, or reporting requirements, establish or defend legal claims, or pursue legitimate business interests. Our retention practices are guided by the principles of data minimisation and storage limitation.

7.2 Specific Retention Periods

The retention periods for different categories of data are as follows:

• 7.2.1 Contact and Enquiry Data: Retained for the duration necessary to resolve your enquiry or fulfil your request, plus a reasonable administrative period (typically 12 to 24 months), or until you opt out of communications. Communications related to ongoing projects or partnerships may be retained for the duration of the relationship plus a period required for record-keeping purposes.

• 7.2.2 Usage and Analytics Data: Typically retained for a maximum of 24 months for analytical and Website optimisation purposes, unless a longer period is required for specific investigations, security monitoring, or legal obligations. Aggregated, anonymised analytics data may be retained indefinitely.

• 7.2.3 Marketing Communications Data: Retained until you unsubscribe or withdraw consent, plus a reasonable period to process your opt-out request and maintain suppression records to prevent future contact.

• 7.2.4 Legal and Compliance Data: Retained for periods mandated by applicable laws and regulations in Kenya, The Seychelles, and the United Kingdom. This may include retention for tax purposes (typically 6 to 7 years), audit requirements, litigation hold periods, or other statutory obligations.

• 7.2.5 Security and Fraud Prevention Data: Retained for as long as necessary to protect against security threats, investigate incidents, prevent fraud, and maintain the integrity of our systems, subject to legal retention requirements.

7.3 Secure Deletion and Anonymisation

Once personal data is no longer required for any lawful purpose and all retention obligations have expired, it is securely and permanently deleted or anonymised in a manner that prevents its reconstruction or re-identification. Deletion methods include secure erasure protocols, data shredding, and cryptographic deletion of encryption keys.

7.4 Archival and Historical Data

In limited circumstances, we may retain certain data for archival purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to implementation of appropriate safeguards for your rights and freedoms.

ARTICLE 8: YOUR DATA PROTECTION RIGHTS

Under the Data Protection Act, 2019 of Kenya, you possess comprehensive rights concerning your personal data. We are committed to facilitating the exercise of these rights:

8.1 Right to be Informed

You have the right to receive clear, transparent, and easily understandable information about how we collect, use, share, and protect your personal data, and about your rights. This Privacy Policy serves to fulfil this obligation.

8.2 Right of Access (Subject Access Right)

You have the right to obtain confirmation as to whether or not your personal data is being processed by us, and where that is the case, to access the personal data along with specific information about the processing, including: the purposes of processing; the categories of personal data concerned; the recipients or categories of recipients to whom the data has been or will be disclosed; the envisaged retention period; the source of the data if not collected directly from you; and the existence of automated decision-making, including profiling.

You may request a copy of your personal data undergoing processing. The first copy will be provided free of charge; additional copies may be subject to a reasonable administrative fee.

8.3 Right to Rectification

You have the right to request the correction of inaccurate personal data concerning you without undue delay. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

8.4 Right to Erasure (Right to be Forgotten)

You have the right to request the deletion or removal of your personal data where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent on which processing is based and there is no other legal ground for processing; you object to processing and there are no overriding legitimate grounds for processing; the data has been unlawfully processed; the data must be erased for compliance with a legal obligation; or the data was collected in relation to the offer of information society services to a child.

This right is not absolute and may be limited where processing is necessary for: compliance with legal obligations; establishment, exercise, or defence of legal claims; archiving purposes in the public interest; or other lawful purposes specified in the Data Protection Act, 2019.

8.5 Right to Restriction of Processing

You have the right to request that we limit the way we use your personal data in the following circumstances: you contest the accuracy of the personal data (restriction applies during the period necessary to verify accuracy); the processing is unlawful but you oppose erasure and request restriction instead; we no longer need the personal data for processing purposes but you require it for the establishment, exercise, or defence of legal claims; or you have objected to processing pending verification of whether our legitimate grounds override your interests.

Where processing is restricted, we may store the data but not further process it without your consent, except for establishment, exercise, or defence of legal claims, protection of rights of another person, or reasons of important public interest.

8.6 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance, where: the processing is based on your consent or on the performance of a contract; and the processing is carried out by automated means.

You also have the right to have your personal data transmitted directly from us to another controller where technically feasible.

8.7 Right to Object

You have the right to object, on grounds relating to your particular situation, to processing of your personal data which is based on legitimate interests (including profiling). We will cease processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defence of legal claims.

You have the absolute right to object to processing of your personal data for direct marketing purposes at any time, including profiling related to such marketing. Upon such objection, we will cease processing your data for these purposes.

8.8 Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

You may withdraw consent by contacting us at legal@ndege.co.ke or by using the unsubscribe mechanism provided in marketing communications.

8.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data violates applicable data protection law.

The relevant supervisory authorities are:

• In Kenya: Office of the Data Protection Commissioner (ODPC) - www.odpc.go.ke

• In The Seychelles: Data Protection Commissioner

• In the United Kingdom: Information Commissioner’s Office (ICO) - www.ico.org.uk

8.10 Exercise of Rights

To exercise any of these rights, please contact our Legal Desk at legal@ndege.co.ke with sufficient detail to enable us to identify you and process your request. We may require additional information to verify your identity before processing your request to ensure that personal data is not disclosed to unauthorised persons.

We will respond to your request without undue delay and in any event within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case we will inform you of such extension and the reasons for delay.

We will not charge a fee for processing your request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or refuse to act on the request.

ARTICLE 9: AUTOMATED DECISION-MAKING AND PROFILING

We do not currently engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Should our practices change, we will update this Privacy Policy accordingly and, where required by law, obtain your explicit consent or provide you with the right to object.

Any analytics or profiling we conduct is for aggregate analysis purposes only and does not result in automated decisions that affect your legal rights or have similarly significant effects.

ARTICLE 10: THIRD-PARTY WEBSITES AND SERVICES

10.1 External Links

Our Website and social media channels may contain links to third-party websites, applications, plug-ins, or services not owned, controlled, or operated by The Ndege Group®. These links are provided solely for your convenience and information.

10.2 Third-Party Privacy Practices

We do not control and are not responsible for the privacy statements, content, or data practices of these third-party websites and services. When you click on such links or enable such connections, those third parties may collect or share data about you according to their own privacy policies.

We strongly encourage you to read the privacy policy and terms of use of every third-party website or service you visit or use.

10.3 Social Media Platforms

Your interactions on social media platforms are governed by the terms of service, privacy policies, and data practices of those specific platforms. We receive only the data that the platforms provide to us in accordance with your privacy settings and permissions on those platforms.

ARTICLE 11: UPDATES AND AMENDMENTS TO THIS PRIVACY POLICY

11.1 Right to Modify

We reserve the right to update, modify, or replace this Privacy Policy periodically to reflect changes in our data processing practices, organisational structure, legal obligations, regulatory requirements, technological developments, or best practices in data protection.

11.2 Notification of Changes

Any revisions will be effective immediately upon posting the updated Privacy Policy on the Website. The “Last Updated” date at the beginning of this policy will be revised to reflect the date of the most recent changes.

For material changes that significantly affect your rights or our processing practices, we will provide more prominent notice, which may include email notification to the address you have provided, a notice on our Website homepage, or other appropriate communication methods.

11.3 Continued Use Constitutes Acceptance

Your continued use of the Website or engagement with our digital platforms following the posting of any changes indicates your acknowledgement and acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy regularly to remain informed about how we are protecting your information and your rights.

ARTICLE 12: CHILDREN’S PRIVACY

12.1 Age Limitation

Our services are not intended for, marketed to, or designed to attract individuals under the age of 18. We do not knowingly collect, process, or solicit personal data from children under 18 years of age without verifiable parental or legal guardian consent.

12.2 Parental Responsibility

If you are a parent or legal guardian and become aware that your child has provided us with personal data without your consent, please contact us immediately at legal@ndege.co.ke. We will take prompt action to investigate and, if confirmed, delete such data from our systems unless we have a legal obligation to retain it.

12.3 Age Verification

If we learn that we have collected personal data from a child under 18 without appropriate parental consent, we will take immediate steps to delete that information and terminate the child’s account or access, if applicable.

ARTICLE 13: CONTACT INFORMATION AND DATA PROTECTION ENQUIRIES

13.1 Primary Contact

For any questions, comments, concerns, or requests regarding this Privacy Policy, our data processing practices, or to exercise your data protection rights, please contact:

Legal Desk

The Ndege Group Nominees Limited for Africa’s Sovereign Development Trust®

Head Office:

UN Crescent, Gigiri

P.O. Box 43112-00100

Nairobi, Kenya

Trust’s Domicile:

1st Floor, Eden Plaza, Eden Island

Victoria, The Seychelles

U.K. Mailing Address:

116 Pall Mall, St. James’s

London, SW1Y 5ED, United Kingdom

Email: legal@ndege.co.ke

Telephone: +254 799 504 111

General Enquiries: hello@thendegegroup.com

13.2 Response Commitment

We are committed to addressing your enquiries and requests promptly and thoroughly. We will acknowledge receipt of your communication and provide a substantive response within the timeframes required by applicable data protection law.

© 2026 David Okiki Amayo Jr. and The Ndege Group®. All rights reserved.

Africa’s Sovereign Development Trust® (ASDT) anchors the future.

www.thendegegroup.com