Data Protection Policy

Last updated: June 2026

1. Our Commitment

Forterra Systems Limited is committed to compliance with the Kenya Data Protection Act, 2019 (DPA). We are registered as a data controller and implement appropriate technical and organizational measures to protect personal data.

2. Data Processing Principles

We process personal data in accordance with the following principles:

• Lawfulness: Data is processed on a lawful basis
• Purpose limitation: Data is collected for specified, explicit, and legitimate purposes
• Data minimization: Only necessary data is collected
• Accuracy: Data is kept accurate and up to date
• Storage limitation: Data is not kept longer than necessary
• Security: Appropriate security measures are implemented

3. Lawful Basis for Processing

We process personal data on the following lawful bases:

• Contract performance — to deliver services you have engaged us for
• Legal obligation — to comply with Kenyan law
• Legitimate interests — to operate and improve our business
• Consent — where you have given explicit consent

4. Data Subject Rights

Under the Kenya Data Protection Act, you have the right to:

• Access your personal data
• Correct inaccurate personal data
• Delete your personal data
• Object to processing
• Data portability

5. Cross-Border Transfers

Where personal data is transferred outside Kenya, we ensure adequate protection is in place through contractual safeguards.

6. Data Protection Officer

For data protection queries: info@forterra.co.ke
Forterra Systems Limited, Westlands, Nairobi, Kenya