top of page

DATA PROTECTION POLICY

1. POLICY STATEMENT

Gamezon Space Corporation (“Gamezon”, “Company”, or “Corporation”), a multinational e-commerce, fintech, logistics, shareholder services, and technology enterprise headquartered in Nairobi, is committed to protecting the privacy, confidentiality, integrity, and security of all personal, investor, shareholder, customer, employee, and corporate data processed across its systems, platforms, applications, and global operations.

​

This Data Protection Policy establishes the Company’s framework for lawful, secure, transparent, and responsible data collection, processing, storage, transfer, access, retention, and disposal.

​

The Company recognizes data protection as a critical component of corporate governance, regulatory compliance, cybersecurity, investor confidence, and operational integrity.

​

2. PURPOSE OF THE POLICY

The purpose of this Policy is to:

  • Protect personal and confidential information;

  • Establish secure data handling standards;

  • Define lawful data processing procedures;

  • Prevent unauthorized access, misuse, loss, or disclosure of information;

  • Ensure compliance with applicable data protection laws;

  • Protect investor and shareholder information;

  • Establish breach response and reporting procedures.

​

3. SCOPE OF APPLICATION

This Policy applies to:

  • Employees

  • Directors

  • Shareholders

  • Investors

  • Customers

  • Contractors

  • Consultants

  • Vendors

  • Technology partners

  • Third-party service providers

The Policy applies to all:

  • Digital systems

  • Websites

  • Applications

  • Databases

  • Payment platforms

  • Internal networks

  • Cloud environments

  • Physical records

managed or controlled by the Company globally.

​

4. DATA PROTECTION PRINCIPLES

The Company shall process data according to the following principles:

  • Lawfulness

  • Fairness

  • Transparency

  • Purpose limitation

  • Data minimization

  • Accuracy

  • Storage limitation

  • Integrity and confidentiality

  • Accountability

​

5. TYPES OF DATA COVERED

The Company may process the following categories of information:

5.1 Personal Data

  • Full names

  • Identification numbers

  • Passport information

  • Contact information

  • Residential addresses

  • Date of birth

  • Employment information

5.2 Financial & Investor Data

  • Banking information

  • Investment records

  • Shareholding information

  • Transaction histories

  • Payment records

  • Tax information

5.3 Technical & Digital Data

  • IP addresses

  • Login credentials

  • Device identifiers

  • System logs

  • Geolocation data

  • Security access records

5.4 Sensitive & Confidential Data

  • Compliance records

  • Verification documents

  • Legal documentation

  • Corporate information

  • Internal operational data

​

6. LAWFUL BASIS FOR DATA PROCESSING

The Company shall process data only where lawful grounds exist, including:

  • Consent;

  • Contractual necessity;

  • Legal obligations;

  • Legitimate business interests;

  • Regulatory compliance;

  • Fraud prevention;

  • Security protection.

​

7. CONSENT-BASED PROCESSING

Where consent is required, the Company shall ensure consent is:

  • Freely given;

  • Specific;

  • Informed;

  • Unambiguous;

  • Documented.

Individuals shall have the right to:

  • Withdraw consent;

  • Request access to their data;

  • Request correction of inaccurate data;

  • Request deletion where legally permissible.

​

8. DATA ACCESS CONTROLS

The Company shall implement strict access management procedures to protect sensitive information.

​

8.1 Access Restrictions

Access to confidential data shall be limited to authorized personnel only based on:

  • Job responsibilities;

  • Business necessity;

  • Security clearance levels.

​

8.2 Role-Based Access Control (RBAC)

The Company may implement:

  • Role-based permissions;

  • Least-privilege access principles;

  • Segregation of duties;

  • Access approval workflows.

​

8.3 Authentication Controls

Systems may require:

  • Multi-factor authentication (MFA);

  • Password protection;

  • Biometric verification;

  • Session management controls.

​

9. SECURE INFORMATION HANDLING

The Company shall establish procedures for secure data collection, transmission, storage, use, and disposal.

​

9.1 Data Collection Standards

The Company shall collect only data necessary for legitimate business purposes.

9.2 Secure Storage

Data shall be protected using:

  • Encryption;

  • Secure cloud infrastructure;

  • Backup systems;

  • Access logging;

  • Physical security safeguards.

​

9.3 Secure Transmission

Sensitive information transmitted electronically shall use:

  • Encrypted communication channels;

  • Secure APIs;

  • SSL/TLS protocols;

  • Secure file transfer mechanisms.

​

9.4 Data Retention & Disposal

The Company shall:

  • Retain data only as long as necessary;

  • Dispose of information securely;

  • Permanently delete obsolete records where legally permissible.

​

10. CYBERSECURITY PROCEDURES

The Company shall implement cybersecurity controls to protect information assets against unauthorized access, disruption, or compromise.

Security measures may include:

  • Firewalls;

  • Intrusion detection systems;

  • Antivirus protection;

  • Endpoint security;

  • Security monitoring systems;

  • Vulnerability management;

  • Security patching procedures.

​

11. THIRD-PARTY DATA PROCESSING

Third-party vendors or service providers handling Company data must:

  • Maintain equivalent security standards;

  • Comply with applicable data protection laws;

  • Sign confidentiality agreements;

  • Implement adequate cybersecurity controls.

The Company reserves the right to audit vendor compliance.

​

12. CROSS-BORDER DATA TRANSFERS

Where data is transferred internationally, the Company shall ensure:

  • Adequate protection measures;

  • Contractual safeguards;

  • Regulatory compliance;

  • Secure transfer mechanisms.

​

13. DATA BREACH RESPONSE PROTOCOLS

The Company shall maintain procedures for responding to actual or suspected data breaches.

​

13.1 Breach Identification

Employees must immediately report:

  • Unauthorized access;

  • Data leaks;

  • Cybersecurity incidents;

  • Lost devices containing Company data;

  • System compromises.

​

13.2 Incident Response Procedures

The Company may:

  • Isolate affected systems;

  • Conduct investigations;

  • Assess scope and impact;

  • Preserve evidence;

  • Mitigate damages;

  • Notify regulators where required.

​

13.3 Notification Obligations

Where legally required, affected individuals and regulators shall be notified within applicable legal timelines.

​

14. EMPLOYEE RESPONSIBILITIES

Employees and authorized personnel must:

  • Protect confidential information;

  • Follow security procedures;

  • Avoid unauthorized disclosures;

  • Report security incidents immediately;

  • Participate in compliance training.

Failure to comply may result in disciplinary action.

​

15. DATA SUBJECT RIGHTS

Subject to applicable laws, individuals may have rights to:

  • Access personal data;

  • Correct inaccurate information;

  • Request deletion;

  • Restrict processing;

  • Object to processing;

  • Request data portability.

The Company shall respond to lawful requests within reasonable timeframes.

​

16. RECORDKEEPING & DOCUMENTATION

The Company shall maintain records relating to:

  • Data processing activities;

  • Consent records;

  • Security incidents;

  • Regulatory reports;

  • Data sharing arrangements.

​

17. AUDITS & COMPLIANCE REVIEWS

The Company may conduct periodic:

  • Data protection audits;

  • Cybersecurity assessments;

  • Compliance reviews;

  • Vulnerability tests;

  • Privacy impact assessments.

​

18. POLICY VIOLATIONS

Violations of this Policy may result in:

  • Disciplinary action;

  • Suspension of access;

  • Contract termination;

  • Civil liability;

  • Regulatory penalties;

  • Criminal prosecution where applicable.

​

19. GOVERNING LAW

This Policy shall be governed by the laws of:

The Republic of Kenya and applicable international data protection regulations.

 

20. POLICY APPROVAL

Approved by:

Gamezon Space Corporation

Authorized By: Wycliffe Wejuli
Title: The Company President
Date: 1st May, 2026

Signature: ________________

​

OPTIONAL ADVANCED DATA PROTECTION CONTROLS

The Company may additionally implement:

  • AI-driven threat monitoring

  • Blockchain data integrity verification

  • Zero-trust security architecture

  • Data loss prevention (DLP) systems

  • Privacy-by-design frameworks

  • Secure investor portal encryption

  • Biometric access systems

  • Real-time security intelligence monitoring

  • Cloud security posture management

  • Automated compliance monitoring

  • Secure shareholder data vaults

bottom of page