RockWin Investment Ltd ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over it.
01 Data we collect
We collect the following categories of personal data when you open or use a RockWin account:
| Category | Data collected |
|---|---|
| Identity | Full legal name, National ID or Passport number, date of birth, and any supporting documents required for KYC verification. |
| Contact | Phone number, email address, and postal or physical address. |
| Financial | M-PESA number, bank account details, transaction history, portfolio value, and units held. |
| Next of kin | Name, phone number, and relationship — required by the CMA. |
| Tax | KRA PIN and withholding tax consent status. |
| Technical | IP address, device type, browser, and login timestamps. |
02 How we use your data
We process your personal data for the following purposes, each tied to operating your account or complying with the law:
- KYC verification — to comply with CMA and anti-money laundering laws
- Account management — to operate your account, process deposits, and execute redemptions
- Interest accrual — to calculate and credit daily interest to your portfolio
- Tax compliance — to deduct and remit 15% withholding tax to KRA
- Communications — to send statements, alerts, and regulatory notices
- Fraud prevention — to detect and prevent fraudulent activity
- Service improvement — to analyse usage patterns and improve the platform
03 Legal basis for processing
Under the Data Protection Act (2019), we rely on the following legal bases:
- Contractual necessity — to deliver the investment services you signed up for
- Legal obligation — to comply with CMA, KRA, and AML regulations
- Consent — for marketing communications and optional features
- Legitimate interest — for fraud prevention and account security
04 Data sharing
We share personal data only with organisations that are necessary to operate the fund or meet our legal obligations:
- I&M Bank — as trustee and custodian of fund assets
- Deloitte — as independent auditor
- Capital Markets Authority — for regulatory reporting
- Kenya Revenue Authority — for tax remittance
- Payment and messaging providers — to process deposits and deliver notifications
- KYC verification partners — for identity verification
We do not sell your data to third parties.
05 Data retention
We retain your personal data for as long as your account is active, plus 7 years after account closure, as required by CMA regulations. After this period, data is anonymised or securely deleted.
06 Your rights
Under the Data Protection Act (2019), you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion, subject to regulatory retention requirements
- Object to certain processing
- Request data portability
- Withdraw consent for optional processing
To exercise any of these rights, contact privacy@rockwin.co.ke. We respond to verified requests within 30 days.
07 Data security
We apply the following safeguards to protect your data:
- Encryption in transit — all traffic uses TLS
- Encryption at rest — sensitive data is encrypted in the database
- Role-based access control — internal staff only see the data their role requires
- Regular security reviews — periodic reviews of access and dependencies
- Encrypted backups — daily backups stored in encrypted form
08 Cookies
Our platform uses cookies and similar technologies to maintain your session and remember your preferences. You can disable cookies in your browser, but some features may not function correctly.
09 Children
Our services are not intended for anyone under 18. We do not knowingly collect data from minors.
10 Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email at least 14 days before they take effect.
11 Contact
For privacy questions or to exercise your rights:
- Email: privacy@rockwin.co.ke
- Phone: +254 700 123 456
- Data Protection Officer: dpo@rockwin.co.ke