Data Protection Privacy Notice

Local Authorities Provident Fund (LAPFUND) respects your concern about privacy. This Data Privacy Notice applies to the personal data that we collect and handle for the purposes of managing retirement benefits.
This notice applies to our stakeholders including but not limited to, employees, members, suppliers, service providers, sponsors, government agents and all visitors to LAPFUND.
Data Controller and Contact Information
Local Authorities Provident Fund (LAPFUND)
P.O.Box 79592-00200, Nairobi
2nd Ngong Avenue, 316 Upperhill Chambers, 10th floor
Tel: 0709 805 000/100
Toll Free: 0800 720 065
 
What is personal data?
Personal data refers to any information relating to an identified or identifiable natural person, also referred to as “data subject”.
 
Categories of Personal Data Collected 
Types of Data: This may include: 
  • Personal Identification Information (i.e.. name, address, date of birth, ID/Passport Number, photos) 
  • Financial Information (i.e.. salary, contributions, bank details) 
  • Employment Details (i.e., employer, job title, length of employment, KRA pin number) 
  • Beneficiary Information (i.e., spouse, dependents, relationship) 
  • Communication Preferences (i.e., email, mail addresses, consent records, phone number) 
  • Demographic information (i.e. Age, gender, marital status
Sensitive Personal Data: i.e., race, health status, ethnic social origin, belief, biometric data, property details, marital status, family details including names of the person's children, parents, spouse or spouses, sex or the sexual orientation
 
 Legal Basis for Processing Personal Data
  • Legitimate Grounds for Processing: LAPFUND shall ensure that the personal data collected within the required legal basis. This could include:
    • Performance of a contract (e.g., administering the retirement benefits, employment)
    • Legal obligations (i.e., acts and regulations)
    • Consent
    • Legitimate interests (e.g., fraud prevention, security)
    • Vital interests
    • Public Interest
  • Explicit Consent: LAPFUND shall seek explicit consent through the various data collection tools.
 
Purposes of Data Processing 
LAPFUND collects personal data for the following purposes:
  • Administration of Retirement Benefits: Your personal data will be used for the purpose of administering your retirement benefits i.e. admission into the scheme, updating contributions and payment of benefits.
  • Legal and regulatory Compliance: The collected data is used to meet legal and regulatory compliance such as the tax obligations and contractual obligations.
  • Notification and Communication: The Data collected will be used to communicate with members (e.g., updates, notices, statements). 
  • Customer Service and Support: The data will be used for customer service, support, inquiries and complaints thus improving the customer experience
  • Fraud Prevention and Security: The personal data collected will be used to ensure that only the authorized individuals can access information thus enhancing security and protecting the integrity of your personal data. 
  • Research, Survey and Feedback: The personal data can be used to improve service delivery and develop new products for continuous improvement within the organization. LAPFUND puts in place measures to protect personal data.
  • Automated Decision Making: In line with the emerging technologies, LAPFUND may apply technology and other AI tools for automated Decision-making process
 
Data Sharing and Transfers 
Your personal data may be shared with third parties as below:
  • Third-Party Recipients: Third parties to whom personal data may be shared to fulfill legal, contractual and operational requirements. They include service providers, auditors, actuaries, legal advisors, regulatory authorities, researchers and government bodies, if the need arises. 
  • International Transfers: Your data is primarily stored in our data centers located within Kenya and some data may reside abroad using cloud technologies. We ensure an appropriate level of protection by the recipient of the data when we transmit your data outside Kenya, in addition, those jurisdictions must have in place Data Protection Laws.  
Data Retention and Disposal Period 
  • Retention and Disposal of Data: Your personal data will be retained or disposed off in accordance with the existing laws and regulations and LAPFUND Records and Information Policy. 
Data Subject Rights 
As a data subject you’re entitled to the following rights:
  • Right to be informed: You have a right to be informed on how your personal data is collected, used, stored and maintained.
  • Right to Access: You have the right to request access to your personal data. 
  • Right to Correction: You can request correction of inaccurate or incomplete data. 
  • Right to Erasure: You can request deletion of your personal data subject to the Data Protection Act 2019.
  • Right to Object: you can object to the processing of your personal data in accordance with the Data Protection Act 2019. 
 
Consent Management
You can withdraw consent; however, it should not conflict with the purposes of processing one’s personal data.
 
Security Measures 
  • Data Protection and Security: LAPFUND has put security measures in place to protect personal data including encryption, physical and logical access controls, audit logs, data backup, firewall and employee cyber security awareness programs. 
  • Incident Response: All data breaches will be reported to the DPO within 72 hours and individuals notified, in line with legal obligations. 
 
Changes to the Privacy Notice 
LAPFUND reserves the right to amend or modify this statement at any time to reflect changes in laws, regulations, technology and operational practices.
  • Notice of Changes: Individuals will be informed if there are significant changes to the privacy notice. 
Cookies and Tracking Technologies (if applicable) 
Individuals will be informed on use of cookies and other tracking technologies to enhance user experience and provide personalized content. You can accept or reject non-essential cookies.
 
If you wish to exercise any of the rights above or lodge a complaint if you believe your data protection rights have been violated, kindly contact us at dpo@lapfund.or.ke.