Data Privacy Policy

Introduction

At Concorde Regulated NWDT Sacco (‘Concorde Sacco’, ‘we’, ‘us’, or ‘our’), we are committed to protecting the privacy of our members’ personal data. This Data Privacy Policy explains how we collect, use, store, and safeguard your personal information when you interact with our services through the M-Banking mobile app, Members Portal, and www.concordesacco.com website.

This policy operates alongside our Data Protection Policy, which governs our broader data management practices, and our Terms & Conditions, which outline your rights and responsibilities when using our services.

What Information We Collect

We collect various types of personal data to provide and improve our services. This includes:

• Personal Identification Information: Full name, ID/Passport number, date of birth, gender, marital status, and next of kin data.
• Contact Information: Email address, phone number, and postal address.
• Financial Information: Bank account details, transaction history, loan information, and wallet balances.
• Usage Information: Data regarding your interactions with our digital platforms, including login details, IP addresses, and device information.

This information is collected directly from you when you register as a member, apply for services, or interact with our mobile app, website, or Members Portal.

How We Use Your Data

Your personal data is used for the following purposes:

• Service Delivery: To provide and maintain access to our digital banking services, including account management, loan applications, and transaction processing.
• Communication: To notify you about changes to our services, updates, and promotional offers.
• Compliance: To meet our legal obligations under the Data Protection Act, 2019, SASRA regulations, and other applicable laws.
• Security: To protect against unauthorized access and ensure the integrity of our systems and your personal data.

Legal Basis for Data Processing

We process your personal data based on the following grounds:

1. Consent: You provide consent for specific data processing activities, such as receiving marketing materials.
2. Contractual Obligations: We process your data to fulfill the terms of the agreement when you use our services.
3. Legal Requirements: We are required by law to process certain types of personal data, such as to comply with regulatory demands from SASRA or tax authorities.
4. Legitimate Interests: We process your data for legitimate business purposes, such as improving service quality and user experience, as long as these interests do not infringe on your rights.

Data Sharing and Third-Party Access

We do not sell or trade your personal information to third parties. However, we may share your data with:

• Regulatory Authorities: To comply with legal obligations, we may share your data with SASRA, the Kenya Revenue Authority (KRA), or other governmental entities.
• Service Providers: Third-party vendors who assist with our operations, such as IT support and payment processors, may have access to your data, but only to the extent required to provide their services.
• With Your Consent: In cases where you provide explicit consent, such as sharing data for third-party marketing.

Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal, regulatory, or contractual obligations. Once the retention period has lapsed, your data will be securely deleted or anonymized.

Data Security

We take the security of your personal information seriously and have implemented appropriate technical and organizational measures to prevent unauthorized access, misuse, or disclosure. These include encryption, firewalls, and secure access controls. You are responsible for safeguarding your credentials (e.g., M-Banking app PIN) and must notify us immediately if you suspect any unauthorized activity on your account.

Your Rights

Under the Data Protection Act, 2019, you have the following rights concerning your personal data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Correction: You can ask us to correct any inaccuracies or incomplete data.
• Right to Deletion: You may request the deletion of your personal data, subject to legal or regulatory restrictions.
• Right to Object: You can object to how your data is being processed, particularly if it is used for direct marketing.
• Right to Withdraw Consent: Where data processing is based on your consent, you have the right to withdraw it at any time.

To exercise any of these rights, please contact us using the information provided below.

Data Breach Notification

In the unlikely event of a data breach, Concorde Sacco will notify affected members as soon as possible and report the breach to the Office of the Data Protection Commissioner, as required by the Data Protection Act, 2019.

Links to Other Policies

For detailed information on how we handle your data, please refer to our Data Protection Policy, which outlines our obligations under the Data Protection Act, 2019, and our Terms & Conditions governing your use of our services.

Contact Information

If you have any questions, concerns, or complaints regarding this Data Privacy Policy or how we process your personal data, please contact us at:

• Email: dataofficer@concordesacco.com
• Phone: +254 700 552588 or +254 725 800 328
• Address: 3rd Floor, Centenary House, Off Ring Road, Westlands, Nairobi, Kenya

Updates to This Policy

We may update this Data Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes through our website and digital platforms. By continuing to use our services, you acknowledge and agree to these changes.