DRAFT: this notice is pending review by a qualified data protection adviser and must not be relied on until it is approved.
1. Who we are
Chen Wealth SACCO (“we”, “us”) is a savings and credit co-operative. We hold and use personal information about our members, applicants, guarantors, next of kin and visitors to our website.
Data controller: Chen Wealth SACCO, God’s Light Christian Church, Moi Drive, Umoja, Nairobi. P.O. Box 46158-00100, Nairobi. Contact for privacy matters: info@chenwealthsacco.co.ke, or 0769 412743. Data Protection Officer: [name and contact to be appointed or confirmed].
2. What information we collect
When you apply to join: full name, date of birth, gender, national ID or passport number, KRA PIN, phone number, email address, postal address, occupation, next of kin and their contact details, and copies of your ID or passport, KRA PIN certificate and passport photographs.
When you use our services: savings and share transactions, loan applications, loan schedules, repayments, guarantor details, statements and receipts.
When you use the member portal or the staff system: sign-in details, the time you sign in, and records of the actions you take, such as changes to records.
When you visit our website: the website itself does not use advertising or tracking cookies. Our website loads fonts from Google and shows a map from Google Maps. Google may receive your IP address and browser details when these load.
We do not collect biometric data such as fingerprints for identification.
3. Why we use your information
We use your information to:
- open and manage your membership and accounts, as your agreement with us requires;
- process savings, shares, loans and repayments;
- meet our legal and regulatory duties, including record keeping, tax and anti-money-laundering checks;
- send you statements, receipts, reminders and service messages;
- keep our records accurate and our systems secure, and prevent fraud;
- improve our services and answer your questions.
We will ask for your separate consent before sending marketing messages. You can withdraw that consent at any time.
4. Who we share information with
We do not sell your information. We share it only where needed:
- Our staff and board members, but only the information their role requires;
- Service providers who host our system, provide our website, and (once introduced) process M-Pesa payments and send SMS or email messages. Each must protect your information under a written agreement with us;
- Regulators and authorities where the law requires, for example the Sacco Societies Regulatory Authority, the Kenya Revenue Authority, or courts;
- Your nominated next of kin or guarantors, only where the loan or membership terms make this necessary.
Where a service provider is outside Kenya, we will ensure the transfer meets the requirements of the Data Protection Act, 2019. [To confirm with our adviser.]
5. How long we keep information
We keep membership and financial records for as long as you are a member and for [period to be confirmed] afterwards, so we can meet our legal and audit obligations. Copies of identity documents are kept only while needed for membership and loans, and are deleted or archived when no longer required. [Retention periods to be confirmed by the SACCO board.]
6. How we protect your information
We protect information with measures that include:
- ID numbers stored in encrypted form;
- access limited by role, so each person sees only what their job requires;
- an audit log of important actions;
- protected forms and limits on repeated sign-in attempts;
- system files, settings and login sessions kept away from the public website.
No system is completely free of risk. We will tell you and the Office of the Data Protection Commissioner if a breach affects your information, as the law requires.
7. Your rights
Under the Data Protection Act, 2019, you have the right to:
- be informed about how we use your information (this notice);
- access the information we hold about you;
- correct information that is wrong or incomplete;
- object to certain uses, including direct marketing;
- request deletion of information we no longer need, subject to our legal duty to keep certain records;
- withdraw consent where we rely on it;
- complain to the Office of the Data Protection Commissioner.
To use any of these rights, contact us at the details in section 1. We will respond within the time the law allows.
8. Members’ portal and staff access
Members sign in to see only their own records. Staff see only what their role allows. Sign-in details must be kept private. Please tell us at once if you think someone else has accessed your account.
9. Children
Membership is for people who can enter a contract under Kenyan law. Minors may be named as beneficiaries or next of kin, but their details are collected only through an adult member.
10. Changes to this notice
We may update this notice when our services change. The latest version will always be on our website, with the date of the last update.
11. Complaints
If you are unhappy with how we handle your information, please contact us first. You can also complain to the Office of the Data Protection Commissioner, Kenya.
Last updated: [date to be inserted when approved].