The Cannon Group comprises of Cannon Asset Managers (K) Limited, Cannon General Insurance (K) Limited and Cannon Life Assurance (K) Limited.
This Privacy Policy describes how the Cannon Group (“we,” “us,” or “our”) collects, uses, stores, shares, and protects your personal data when you visit our website, use our online portals, request an insurance quote, or interact with our digital insurance services.
We operate as a Data Controller and/or Data Processor under the Data Protection Act, 2019 (DPA) (Cap 411C of the Laws of Kenya) and are fully registered with the Office of the Data Protection Commissioner (ODPC).
When you use our online platforms, we collect the following categories of personal data:
Full name, date of birth, gender, marital status, national ID number/passport number, KRA PIN, email address, postal address, and mobile phone number.
Vehicle registration details, logbook copies, property details, employment details, income brackets, and claims histories.
Bank account numbers, mobile money numbers & transaction details, and payment histories.
IP address, device type, browser settings, operating system, cookie IDs, and analytics regarding how you interact with our website.
In line with Section 30 of the DPA, we process your personal data under the following lawful grounds:
You have given clear, explicit consent for us to process your data for specific online actions (e.g., marketing or optional portal features).
Such as to process your insurance proposal, calculate premiums, issue a policy, or manage a claim.
Where processing is necessary to comply with regulatory requirements, including those of the Insurance Regulatory Authority (IRA), Capital Markets Authority (CMA), the Financial Reporting Centre (FRC) and Kenya Revenue Authority (KRA), for Know Your Customer (KYC) and Anti-Money Laundering (AML) due diligence checks.
Necessary for our operational capabilities, network security, and website optimization, provided your fundamental rights do not override those interests.
3.1. We may share your data as required by law or pursuant to any statutory instrument or regulatory requirement or court order.
3.2. To deliver our online insurance services, we may share your data with selected third parties and we enforce strict data protection agreements to ensure they secure your information. These select third parties may include:
3.2.1. Underwriting Partners and Reinsurers to evaluate and distribute the insurance risks.
3.2.2. Service Providers including Claims investigators, loss adjusters, medical assessors, legal advisors, and technology providers managing our servers.
3.2.3. Industry Bodies such as the Association of Kenya Insurers (AKI) for fraud mitigation and shared claim registries.
We have put in place procedures and technologies, including without limitation access control, SSL encryption, firewalls etc, to maintain the security of all personal data from the point of collection to the point of destruction and manage any data breaches.
We keep your data only as long as required to service your policy, manage legal or statutory obligations (typically 7 years following policy termination), or resolve active claims.
Under the DPA, you hold specific enforceable rights over your personal data:
6.1. Right to access & information: To receive a copy of the information we hold and to information on how your data will be used.
6.2. Right to rectification: To ask that your data held be corrected where it is incorrect or incomplete.
6.3. Right to erasure of data that is no longer necessary, consent has been withdrawn or processing is unlawful.
6.4. Right to data portability: To request your data in a format that allows transfer to another entity if technically feasible.
6.5. Right to object to processing: To object to use of data under certain criteria e.g. violation of lawful basis, data protection principle(s) etc or direct marketing.
6.6. Right to withdraw consent: where consent was relied upon to process, right to withdraw that consent.
6.7. Rights related to automated decision making and profiling: to object to profiling or automated underwriting decisions that produce legal or significant effects.
Our website uses cookies to enhance user experience, track site traffic, and support marketing initiatives. You can adjust your browser settings to reject cookies, though doing so might restrict certain functionalities of our online insurance portals.
Your personal data is primary processed and stored within secure servers located in Kenya. In the event that we transfer data outside Kenya, we ensure compliance with Section 48 of the DPA by applying appropriate safeguards approved by the Office of the Data Commissioner.
9.1. If you have any questions about this Privacy Policy, wish to exercise your rights, or want to reach our Data Protection Officer (DPO), please contact us:
Email: compliance@cannon.co.ke
Address: Cannon Group
Gateway Business Park, Block D
Mombasa Road
P O Box 30216 00100 Nairobi
Phone: +254 (020) 3966000
9.2. You may lodge a formal complaint directly with the Office of the Data Protection Commissioner (ODPC) via their portal at https://www.odpc.go.ke.