GRAIN INDUSTRIES LIMITED DATA PROCESSING POLICY

This Data Processing Policy ('Policy') applies to the processing of Personal Data (defined below) by Grain Industries Limited (the Company, also referred to as "we", "us", or "our" in this Policy) arising from any transaction or interaction between the company and our customers, vendors, service providers, employees, consultants, and other persons having dealings with the Company. This Policy sets out how the Company processes Personal Data. The Policy and our treatment of your Personal Data complies with the Data Protection Legislation (as defined below).

Please review this Policy carefully to understand our practices. For the avoidance of doubt, this Policy is incorporated by reference into the relevant agreements entered into between us unless specifically excluded. This Policy applies to all users (including visitors) of any of the Company's Platform(s) (as defined below), the Company's customers, sub-contractors, employees, agents, service providers and any other person with respect to any Product, Service or Engagement (as defined below).

We do not knowingly enter into agreements with or collect data relating to children.

1. TERMS

1.1 For ease of reference, the terms below as used in the Policy have the following meaning:

1.1.1 Consent, controller, processor, data subject, processing, personal data and Data Commissioner shall have the definitions ascribed to them in the Data Protection Legislation;

1.1.2 Data Protection Legislation means the Data Protection Act (No. 24 of 2019, laws of Kenya) and any regulations issued under it, and any all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including, without limitation, the privacy of electronic communications) and the guidance and codes of practice issued by the Data Commissioner;

1.1.3 Engagement means any employment, dealing, transaction or other engagement entered into with the Company.

1.1.4 Platform or electronic platform means our websites, mobile applications and computer network (including the software, hardware, firmware, equipment, and other electronics, computer and telecommunications devices and equipment) that provides connection and information, used by us in connection with the provision of the Products and Services or Engagement; and

1.1.5 Products or Services means such products or services made available, accessed, published or otherwise offered by or to the Company.

1.1.6 You or your refers to any person whose Personal Data is processed by the Company with respect to any Product, Service or Engagement.

1.2 Words and expressions defined in the Data Protection Legislation shall bear the same meanings ascribed to them in the Data Protection Legislation wherever used herein.

2. DATA CONTROLLER

2.1 The Company is the data controller and is responsible for your Personal Data.

2.2 We will process Personal Data only as permitted under this Policy or otherwise permitted or required by the Data Protection Legislation or any other applicable laws and we will comply with all applicable requirements of the Data Protection Legislation.

3. DATA COLLECTED

3.1 Depending on the Products or Services you are obtaining, accessing or providing or the Engagement you have with the Company, the following different types of information may be collected, stored, used and transferred by us (including through the Platform):

3.1.1 Identity Information such as your first name, last name, surname, username or similar identifier, nationality, date of birth, identification card or passport number.

3.1.2 Contact information such as your billing address, delivery address, email address and telephone numbers, the name of your business, and/or location.

3.1.3 Professional Information such as qualifications and/or other information relating to your employment and your employer.

3.1.4 Financial Information such as income, preferred mode of payment, bank account, payment card details, and/or mobile money details.

3.1.5 Transaction data such as details about payments to and from you and other details of Products and Services you have purchased or accessed from or supplied to the Company or other Engagements you have had with the Company.

3.1.6 Verification Information such as your government issued national identification or passport, Kenya Revenue Authority (KRA) Personal Identification Number (PIN) certificate, National Health Insurance Fund card, National Social Security Fund card, business permits, company incorporation certificates, driver's license, statutory licenses and/or location.

3.1.7 Account information (where applicable) relating to the Products, Services or Engagement including profile data such as your username, password, orders, interests, preferences, survey responses and/or feedback or any other communication.

3.1.8 Automatic information and information about your device including technical data such as internet protocol (IP) address, login data, time zone setting, browser type and version, location, browser plug-in types and versions, operating system and platform, and/or other technology on the devices you use to access the Platforms. Note that this automatic information and device information is used to screen for potential risks and fraud, to improve and optimize the Platform, to ease access to the Platform, and to carry out upgrades, data analysis, improve the Products, Services and Engagements.

3.1.9 Marketing and communications data such as your preferences in receiving marketing from us and our third party partners and your communication preferences.

3.2 Please note that the list in this clause is not an exhaustive list.

3.3 Where we need to collect Personal Data by law, or under the terms of a contract we have with you, and that data is not provided when requested, it may be difficult to provide certain Products or Services or have certain Engagements and the provision of the Products or Services or Engagement (as applicable) may have to be cancelled or stopped.

4. HOW DATA IS COLLECTED

4.1 We use different methods to collect data from and about you including through:

4.1.1 Direct interactions. You may provide your Identity, Contact, Financial, Professional, Transaction and Account Information by filling in forms or by corresponding with us by post, phone, email or other electronic platforms such as websites, biometrics system, online portals and applications. This includes Personal Data provided when you:

4.1.1.1 create an account on our electronic platform;

4.1.1.2 use of our electronic platform;

4.1.1.3 purchase, subscribe to or use our Products or Services;

4.1.1.4 provide or supply Products or Services to the Company;

4.1.1.5 enter into an Engagement with us;

4.1.1.6 request marketing to be sent to you;

4.1.1.7 enter a competition, promotion or survey; or

4.1.1.8 give us feedback or contact us.

4.2 Automated technologies or interactions. As you interact with our Platform, we will automatically collect technical data about the equipment, browsing actions and patterns. We collect this Personal Data by using cookies, server logs and other similar technologies.

4.3 Third parties or publicly available sources. We will receive Personal Data about you from various third parties and public sources as set out below:

4.3.1 our agents, subcontractor, distributors, vendors, suppliers and partners;

4.3.2 providers of technical, payment, delivery, analytics and search information services;

4.3.3 advertising and marketing networks;

4.3.4 parties with whom you may have entered into agreements; and

4.3.5 any publicly available sources.

Where we collect information from third parties, some of these third parties may retain your Personal Data in accordance with their agreement with you and their data privacy policies. We are not liable for any non-compliance with the Data Protection Legislation by, or any breaches with respect to Personal Data in the possession of, these third parties.

5. ACCURACY OF THE DATA

5.1 It is important that the Personal Data we hold is accurate and current to ensure that the Products, Services and/or Engagements can be delivered or undertaken (as the case may be) effectively. As such, please keep us informed if your Personal Data or any other information changes in the course of your interaction with us.

5.2 You guarantee and declare that you are the owner of the information you share with us, submit on any Platform or that you have the rights necessary rights to do so. You also guarantee and declare that it is exact, true and verified, and the use of the information is not contrary to this Policy or applicable laws and will not damage a third party's reputation. You accept full and complete liability for any information that is contrary to this Policy or any applicable laws.

6. USE OF THE COLLECTED DATA

6.1 How your Personal Data is used depends on the Products or Services you are purchasing or accessing or the Engagement you have with the Company. We will use your Personal Data:

• 6.1.1 to verify your identity;
• 6.1.2 to provide you with the Products or Services;
• 6.1.3 to enter into or perform our obligations under any Engagement with you;
• 6.1.4 to buy or receive Products or Services (from you or other vendors, suppliers and service providers);
• 6.1.5 to improve and or develop new Products or Services;
• 6.1.6 to maintain our Services;
• 6.1.7 to assess your suitability for a Product, Service or Engagement;
• 6.1.8 to conduct Product or Service performance analysis;
• 6.1.9 to resolve claims and complaints;
• 6.1.10 to pursue debt from our customers and/or other responsible parties;
• 6.1.11 to refund claims from customers;
• 6.1.12 to pay debts to vendors and service providers;
• 6.1.13 to communicate with you with respect to, including providing general information on the, Products, Services or other Engagement including fees, remuneration and charges;
• 6.1.14 perform our obligations under agreements entered into between ourselves and you;
• 6.1.15 for business development and marketing purposes, to contact you (including by email or post) with information about our services which we feel will be of interest to you or your customers (you can opt out or let us know at any time if you would no longer like to hear from us);
• 6.1.16 to establish, exercise or defend our legal rights where it is necessary for our legitimate interests or the legitimate interests of others or to comply with a legal obligation; and
• 6.1.17 to comply with any procedures, laws and regulations which apply to us, to comply with our legal obligations or, otherwise, where it is necessary for our legitimate interests or the legitimate interests of others.

6.2 Note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data.

6.3 LEGAL BASIS FOR PROCESSING DATA

6.3.1 We process your Personal Data on the basis that such processing is lawful in accordance with the Data Protection Legislation including where the data processing:

• 6.3.1.1 is necessary to perform our obligations under any contract with you (for example, to comply with our contract with respect to an Engagement or to provide Products or Services to you, or to receive Products or Services from you or your company);
• 6.3.1.2 is necessary to comply with our legal obligations;
• 6.3.1.3 is necessary for our legitimate interests or the legitimate interests of others; for example, to ensure the security of our websites; or
• 6.3.1.4 is pursuant to your consent.

6.3.2 We will also request for your consent before sending marketing communications to you via email or text message or other channels of communication. You have the right to withdraw consent to marketing at any time by contacting us.

7. SECURITY

7.1 The security and integrity of your Personal Data is important to us and we have in place appropriate security measures and take all due care to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Unfortunately, we cannot guarantee its absolute security since there is no method of transmission over the internet or method of electronic storage that is fully secure. We disclaim all liability to you to the greatest extent possible under the law should such a breach of security occur.

7.2 If you are a registered user of a Platform, you are entirely responsible for maintaining the confidentiality of your password and login name. Furthermore, you are entirely responsible for any and all activities that occur under your account. You must immediately notify us of any unauthorized use of your login name or any other breach of security known to you.

8. SHARING YOUR PERSONAL DATA

8.1 Except as specified in this Policy, we will not disclose your Personal Data to third parties without your consent. Depending on the Product and Services or Engagement (as applicable), we may share your Personal Data with:

• 8.1.1 Internal third parties such as companies which are affiliated with us;
• 8.1.2 External third parties such as service providers (for example we use service providers for processing of Personal Data), Kenya Revenue Authority, and other governmental bodies should we be required to do so; or
• 8.1.3 Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this Policy.

8.2 Where we share your Personal Data with third parties as discussed above, we require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

8.3 We will also disclose information, including Personal Data, to third parties:

• 8.3.1 when we are required to do so by a court order or by any regulatory authority;
• 8.3.2 where we are required to do so in order to comply with our legal and regulatory obligations in terms of any legislation or regulation applicable to us and our business (including fraud prevention and anti-money laundering);
• 8.3.3 in order to exercise, protect and defend our rights and property (including our intellectual property); or
• 8.3.4 where such disclosure is in the public interest.

8.4 We may also disclose and use anonymised, aggregated reporting and statistics about users of our Products or Services or other persons with whom we have Engagements for the purpose of internal reporting or reporting to our group or other third parties, and for our marketing and promotion purposes, None of these anonymised, aggregated reports or statistics will enable the data subject to be personally identified.

9. CROSS- BORDER TRANSFER OF DATA

Your personal information may be transferred outside Kenya either for ease of delivery of Products or Services or other Engagements, other necessary form of processing or any other lawful purpose. When we transfer your Personal Data outside Kenya, we ensure an appropriate and similar degree of protection is afforded to it by requiring implementation of relevant safeguards by the recipient of the Personal Data as required by the law in Kenya.

10. RETENTION OF DATA

We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

11. MARKETING

We strive to provide you with choices regarding certain Personal Data uses, particularly around marketing and advertising. You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing.

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time.

Where you opt out of receiving these marketing messages, this will not apply to Personal Data provided to us as a result of a product/service purchase, product/service experience or other transactions or engagement.

12. YOUR LEGAL RIGHTS

In accordance with the Data Protection Legislation, you may have the right to:

• 12.1.1 Be informed of the use to which your Personal Data is being put;
• 12.1.2 Access your Personal Data;
• 12.1.3 Object to the processing of your Personal Data;
• 12.1.4 Request restriction of the processing of your Personal Data;
• 12.1.5 Request for correction of false or misleading Personal Data;
• 12.1.6 Request the transfer of your Personal Data;
• 12.1.7 Request erasure of false or misleading Personal Data. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request; and
• 12.1.8 Withdraw consent at any time where we are relying on consent to process your Personal Data. Note that this does not affect the lawfulness of any of processing based on prior consent before your withdrawal.

13. THIRD PARTY WEBSITES

Our websites may, from time to time, contain links to websites operated by third parties including partner networks and other affiliated companies. Please note that this Policy only applies to the Personal Data that we collect through our websites and we cannot be responsible for personal information collected and stored by third parties. Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such third party websites or third party terms and conditions or policies.

14. COOKIES

Some of our websites use cookies. We use cookies in order to offer you a more tailored experience in the future, by understanding and remembering your particular browsing preferences.

Where we use cookies on websites, we will obtain your consent (which you may withdraw at any time after giving it). You can set your browser to refuse all or some browser cookies, but this will make some parts of the websites inaccessible or not function properly.

15. CHANGES TO THE POLICY

We regularly review and update this Policy in order to reflect changes to our practices, for operational, legal or regulatory reasons, and for any other purpose. Any revisions to this Policy will be uploaded on our website and such upload will be deemed to be sufficient communication to you. Where you are a registered user, we may elect, in our own discretion, to notify you of any revision through a notice on your account.

16. CONTACT INFORMATION

If you require any additional information or have any questions with respect to this Policy and our processing of your Personal Data, or if you wish to exercise any of your rights in relation to your Personal Data, please Company's Human Resource Manager on [ 0722850860] or send an email to bakari.bwetta@grainindustries.com