M-GAS LIMITED P.O. Box 27780 - 00100, GPO, Nairobi, Kenya info@mgas.ke +254 111 010 400 M-Gas Website M-GAS PRIVACY POLICY This privacy policy explains how M-Gas Limited or its group of companies ( herein referred to as “M-Gas”, “we”, “us”, or “our”) uses and processes the personal data (“Personal Data”) that we collect from you when you use visit this website, use our mobile app, electronically respond to our online advertisements or when you send us communications via any computer, mobile or other similar electronic devices and through other means (physical forms, telephone calls or other third parties involved in our business dealings with you). Your privacy is important to us, and we are committed to keeping your Personal Data safe. It is our policy to respect your privacy regarding any Personal Data we may collect from you across our website, M-Gas Website or any other website used by our group. Sometimes this covers services offered by parts of our organisation that operate as separate companies. Your continued use of this website will be regarded as acceptance of M-Gas’s practices around privacy and Personal Data. What Personal Data do we collect? We may collect Personal Data from you, which may include:

• Your name
• Your phone number
• General identification information (such as your postal address, gender, photographs, employment history).
• Identification documents and/or identification numbers issued by government bodies or agencies
• Tax information
• Financial information and account details
• Information which enables us to provide products and services to you (such as your geographical location, business or residential address).

You are free to refuse our request for your Personal Data, with the understanding that we may be unable to attend to your request or provide you with some of your desired products and services. How do we collect your data? You directly provide us with most of the data that we collect. We collect your data by fair and lawful means, with your knowledge and consent. We collect data and process data when you:

• Register with us for our products and services.
• Voluntarily complete a customer survey or provide feedback to us.
• Use or view our website via your browser’s cookies.
• Use or view our mobile app.
• Call or otherwise contact us using SMS or USSD service.
• Make payments to use our products and services.
• Apply to us for employment or internship.
• Engage in a business relationship for us to purchase goods or services from you.

We may also receive Personal Data indirectly when:

• Our suppliers, sub-contractors or agents share contact details of their representatives and personnel who will be their contact persons or liaisons.
• Job applicants, potential employees, consultants, sub-contractors, agents and so on share details of their referees for reference checks.

How will we use your data? We only ask for personal data when we truly need so that we can:

• Provide our service to you.
• Manage your account and process any requests you may have.
• Contact you with information regarding the service and products that we may provide to you from time to time.
• Conduct pre-contractual checks as part of our Know-Your Customer (KYC) process.
• Conduct business analytics, market research and analysis, including satisfaction surveys, statistical functions.
• Conduct audits to verify that our internal processes function as required by law and contract.
• Carry out fraud and security monitoring, assess suitability of new and existing products and services and make announcements to you.

Sharing your Personal Data with Third Parties Due to the global nature of our business, for the purposes set out above we may share Personal Data with:

• Our group companies.
• Third-party service providers who provide services to us such as credit scoring, credit reference checks, background checks, data analysis, payment processing services, products and services fulfilment, information technology and related infrastructure provision, customer service, customer survey for product improvement or research and statistical purposes, audits, telecommunication service providers and other similar services
• Counterparties in the context of commercial transactions.
• Regulatory or government agencies to comply with legal or regulatory requirements or obligations in accordance with applicable law or comply with court orders

Security M-Gas will take appropriate technical, physical, legal, and organisational measures to protect your Personal Data. When we provide Personal Data to a service provider, the service provider will be selected carefully and required to use appropriate measures to protect the confidentiality and security of the Personal Data. In the event of a security breach that involves a data subject’s Personal Data we will communicate to the data subject within a reasonably practicable period and take all other action that is necessary to mitigate the breach. How and where will we store your data? You acknowledge that by submitting your Personal Data, you accept its transfer, storage or processing We will protect the data that M-Gas stores within commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use or modification. We securely store your data within a data centre, which is managed by a service provider in either the United Kingdom or the European Union. Retention of Personal Information We only retain Personal Data for as long as it is necessary to do so in line with the Data Protection Laws. This means that we retain data:

• For as long as you continue to use our products/services.
• For any period required by law.
• For purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.
• For the purposes of any legal proceedings. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation arising out of our relationship with you.

We may hold anonymized information that is no longer associated with you indefinitely. How can you exercise your rights as a Data subject? In order to exercise any of the rights of the data subject M-Gas has in place procedures to enable you to do the following:

• Access Personal Data held by M-Gas
• Object to processing of Personal Data by M-Gas
• Correct or delete false or misleading data held by M-Gas
• Restrict processing of Personal Data
• Request that M-Gas transfers the data it holds about you to you, or another organisation
• Share complaints

Marketing We would like to send you information about products and services that we offer or may offer from time to time that it thinks you might like as well as those of our partner companies. If you have agreed to receive marketing, you may always opt out at a later date. You have the right at any time to stop us from contacting you for marketing purposes or giving your data to other members of our corporate group. If you no longer wish to be contacted for marketing purposes, please click this link and send an email to unsubscribe. What are your data protection rights? We would like to make sure you are fully aware of all of your data protection rights. Every data subject is entitled to the following:

• The right to access – You have the right to request copies of your Personal Data from us.
• The right to rectification – You have the right to request that we correct any data you believe is inaccurate. You also have the right to request that we complete data you believe is incomplete.
• The right to erasure – You have the right to request that we erase your Personal Data, under certain conditions.
• The right to restrict processing – You have the right to request that we restrict the processing of your Personal Data, under certain conditions
• The right to object to processing – You have the right to object to our processing of your Personal Data, under certain conditions.
• The right to data portability – you have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
• The right not to be subjected to a decision-making process solely based on automated processing - You have the right to request for human intervention, where applicable, in the event of any automated processing activity.

If you make a request in accordance with the above or question or concerns about how you data is processed, we have within a month to respond to you. If you would like to exercise any of these rights, feel free to contact us by email: info@mgas.ke , or by phone at: +254 111 010 400, or by writing to: P.O. Box 27780 - 00100, GPO, Nairobi. What are cookies? Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. When you visit our website and use our mobile app, we may collect information from you automatically through cookies or similar technology. For more information, visit All About Cookies How do we use cookies? We use cookies in a range of ways to improve your experience on our website, including:

• Keeping you signed in.
• Understanding how you use the M-Gas website and mobile app.
• Delivering personalised content.

What types of cookies do we use? There are a number of different types of cookies, however, our website uses:

• Functionality – we use these cookies so that it recognizes you on our website and our mobile app and remember your previously selected preferences. These could include what language you prefer and location you are in. A mix of first-party and third-party cookies are used.
• Audience analysis – we use these cookies to collect information about your visit to its website, its mobile app, the content you viewed, the links you followed and information about your browser, device, and your IP address in order to better understand our audience by sharing that activity with third party providers of web analytics.

How can you manage cookies? You can set your browser not to accept cookies, and the website All About Cookies tells you how to remove cookies from your browser. Restricting the use of cookies will not stop you from continuing to use our website. However please note that if you disable cookies, some of the features of our service may not function correctly or at all. Other websites Our website may link to external sites that are not operated by us. We have no control over the content and practices of these sites, and we do not accept responsibility or liability for the content of external sites or for their respective privacy policies: you open these links at your own risk. Changes to our Privacy Policy M-Gas reserves the right to modify this privacy policy at any time, so please check this website regularly to ensure that you are familiar with the most recent version. Changes and clarifications will take effect immediately upon their posting on the website. This privacy policy was last updated in October 2022. How can you contact us? If you have any questions about how M-Gas handles user data and personal information, or you would like to exercise one of your data protection rights, feel free to contact M-Gas by email: info@mgas.ke, or by phone at: +254 792 55 66 77, or by writing: P.O. Box 27780 - 00100, GPO, Nairobi.