Data Protection Policy

Introduction

Concorde Regulated NWDT Sacco (referred to as ‘Concorde Sacco’, ‘we’, ‘us’, or ‘our’) is a financial cooperative regulated by the Sacco Societies Regulatory Authority (SASRA). We provide financial services to our members through our M-Banking mobile app, Members Portal, and www.concordesacco.com website.

As a regulated financial institution, Concorde Sacco is committed to ensuring compliance with the Data Protection Act, 2019 of Kenya and other applicable laws and regulations governing data privacy. We recognize the importance of safeguarding the personal data of our members and have developed this Data Protection Policy to outline how we collect, process, and protect your personal information.

Scope of the Policy

This policy applies to all personal data collected and processed by Concorde Sacco across its digital platforms, including the website, mobile app, and member portal. It covers the personal data of members, employees, contractors, and third parties.

We are guided by the Data Protection Act, 2019 in the collection, use, storage, and protection of personal data. This policy works in conjunction with other policies, including the Data Privacy Policy and Terms & Conditions, to ensure full legal compliance.

Legal Basis for Processing Personal Data

We process personal data based on the following legal grounds as defined in the Data Protection Act, 2019:

• Consent: We obtain your explicit consent for specific purposes, such as marketing communications.
• Legal Obligations: We process personal data to comply with our obligations under laws and regulations, such as SASRA requirements.
• Legitimate Interest: We may process data where it is necessary for the legitimate interests of Concorde Sacco, provided this does not infringe on your rights or freedoms.

Collection of Personal Data

In line with the Data Protection Act, 2019, we collect personally identifiable information (‘Personal Data’) for the purpose of improving our services and fulfilling legal and contractual obligations. Examples of the personal data we collect include:

• Full names
• ID/Passport Number
• Date of Birth
• Contact Information (Phone Number, Email, Postal Address)
• Gender, Marital Status
• Next of Kin Information
• Financial Details (Account Numbers, Transaction History)
• Property and Employment Information

Purpose of Collecting Data

We collect and process your personal data for the following purposes, in accordance with the Data Protection Act, 2019:

• To provide and maintain our financial services.
• To notify you about changes to our services.
• To enable you to participate in interactive features of our platforms.
• To provide customer support and respond to inquiries.
• To ensure compliance with legal and regulatory obligations, such as those required by SASRA.
• To improve the security and functionality of our services.
• To communicate with you regarding promotions, offers, and services similar to those you have previously engaged with, unless you opt out.

Data Retention

Concorde Sacco will retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law, particularly the Data Protection Act, 2019. Once the retention period expires, your data will be securely deleted or anonymized.

Data Sharing and Disclosure

Your personal data may be disclosed in accordance with the Data Protection Act, 2019:

• To comply with legal obligations.
• To protect the rights and property of Concorde Sacco.
• To prevent or investigate wrongdoing related to our services.
• With your consent, to third-party service providers who help us operate our services.

We will not share your data with third parties for purposes not permitted by law, and we ensure that third-party processors comply with the Data Protection Act, 2019.

Security of Data

In compliance with Section 41 of the Data Protection Act, 2019, Concorde Sacco takes appropriate technical and organizational measures to protect your personal data from unauthorized access, accidental loss, destruction, or alteration. Our systems are regularly reviewed and updated to ensure that they meet the highest security standards.

Your Rights as a Data Subject

Under the Data Protection Act, 2019, you have the following rights regarding your personal data:

• The right to be informed about how your personal data is being processed.
• The right to access your personal data.
• The right to request correction or deletion of inaccurate data.
• The right to object to the processing of your data.
• The right to withdraw consent at any time for specific processing activities.

To exercise any of these rights, please contact us via the email provided below.

Consent and Opt-Out Mechanism

You may withdraw your consent for receiving marketing communications or restrict the use of your personal data at any time by contacting us at dataofficer@concordesacco.com  or using the available opt-out mechanisms in our digital platforms.

Data Breach Notification

In the event of a personal data breach, Concorde Sacco will comply with Section 43 of the Data Protection Act, 2019, which requires us to promptly notify the affected individuals and report the breach to the Office of the Data Protection Commissioner.

Contact Information

If you have any questions, concerns, or complaints regarding this Data Protection Policy or our data processing practices, please contact our Data Protection Officer:

• Email: dataofficer@concordesacco.com
• Phone: +254 700 552588 or +254 725 800 328
• Address: 3rd Floor, Centenary House, Off Ring Road, Westlands, Nairobi, Kenya

Updates to the Policy

This policy may be updated periodically to reflect changes in legal or regulatory requirements, such as the Data Protection Act, 2019, or our internal practices. We will inform you of any significant updates by updating the policy on our digital platforms and may notify you through email or other communication channels.

For more details, please refer to our Data Privacy Policy and Terms & Conditions, which govern the use of our services and provide additional context for the collection and use of your data.

Acknowledgement

By using our services, you acknowledge that you have read and understood this Data Protection Policy and agree to the collection and use of your personal data as described herein.