Video surveillance policy

This video surveillance policy explains how Mogo Auto Limited, company No. PVT-AJUR7BX, address: PineTree Plaza, Kilimani, Nairobi, (hereinafter – “Company”) carries out video surveillance in its premises and processes personal data, which is acquired during the video surveillance.

1. Personal data processing

1.1. The Company carries out video surveillance in its office premises. The purpose of video surveillance is the prevention of criminal activities and the protection of the Company's property and assets. For the following data processing, the data controller is the Company.

1.2. During video surveillance, the Company processes personal data (video files). The processing is necessary for the protection of Company’s legitimate interests, which are to ensure the security and protection of the Company’s property, as well as the prevention and investigation of criminal activities.

1.3. Personal data obtained during video surveillance is retained for up to 90 days. After the expiration of this period, the data is deleted unless there is a reasonable need to retain it longer for other purposes, such as the investigation of criminal activities, the protection of the legal interests of the Company or third parties.

2. Information on video surveillance

2.1. When determining the position of the surveillance cameras, several considerations are considered:

• Video surveillance area – the cameras record the areas required to achieve the purpose of video surveillance. Other buildings, areas outside the Company's premises and territories are not filmed;

• Video surveillance quality – the cameras are positioned so that the captured image can be used for the intended purpose, the persons seen in the video are identifiable and the cameras are suitable for the surveillance area;

• Data subject privacy – the cameras do not capture the areas, which are designed for private use (for example, lavatories, relaxation areas, etc.).

2.2. Video surveillance is carried out 24 hours a day, 7 days a week.

2.3. Only authorized persons have the right to access the video files and only if there is a legitimate reason for such access. Video files are not monitored in real time. Video files contain a time stamp to ensure that the processing purpose is achieved.

2.4. Taking into account that:

• Company has the obligation to ensure appropriate security standards at its premises, as well as ensure the data protection of the employees and visitors,

• Video surveillance is necessary to achieve the legitimate interests of the Company, which could not be achieved without the processing of personal data or other, less privacy-intrusive means,

• The location, quality and surveillance area of video surveillance cameras are selected with due care and periodically reviewed,

the Company has set that video surveillance is necessary and that the benefits of such processing outweigh the risks or restrictions it may impose on the data subject. Given that the premises are used for business purposes and contain significant assets of the Company, video surveillance can be considered appropriate and expected.

3. Access to personal data

3.1. Video files can be accessed by certain employees of the Company who are authorized to access such information. In case specifically required by the Company the files may also be accessed by third party service providers of the Company that provide technical, legal, hosting and IT services for video surveillance.

3.2. Third-party service providers who may access personal data obtained through video surveillance shall be under strict confidentiality requirements and other obligations imposed by the applicable personal data protection legislation. If such third-party service providers are located outside Kenya, the Company shall provide security measures in accordance with applicable personal data protection laws or enters into appropriate agreements that include the provisions for the transfer of data to processors outside Kenya.

3.3. In certain situations, the Company may have a legal obligation to transfer personal data to law enforcement bodies, as well as state and local government institutions, if a relevant request has been received. Personal data may also be transferred to the said authorities to raise, enforce, or defend the Company's legal claims.

4. Data subject rights

4.1. The data subject has the right to request access to his personal data if they are in the Company's possession. So, if the video files are retained and show the data subject, the Company will provide access to them. If such access can adversely affect the privacy rights of other data subjects (for example, other data subjects also appear in the video files), the Company will take the necessary steps to make these other data subjects unidentifiable. If for various technical reasons this is not possible, the Company reserves the right not to grant access to video files.

4.2. The Company has the right not to grant access to video files if it is not possible to identify the data subject who requested access (for example, if the data subject has not indicated the time when he / she was in the video surveillance area).

4.3. The data subject has the right to object to the processing of his / her personal data by contacting the Company using the contact information below. Upon receipt of such an objection, the Company will no longer process the data subject's personal data unless there are compelling legitimate reasons for the processing that outweigh the data subject's interests, rights and freedoms or the data is necessary to enforce or defend the Company's legal rights.

4.4. The data subject has the right to submit a complaint to the supervisory authority (Data State Inspectorate) if there is a suspicion that the Company does not fulfill its personal data protection obligations or otherwise violates the data subject's rights.

5. Contact information

In case of any questions regarding the video surveillance or data subject rights, please contact the Company by writing to dataprivacy@mogo.co.ke.