TAI SACCO DATA PRIVACY POLICY

1.INTRODUCTION AND COMMITMENT

Tai DT Sacco Society Limited (hereinafter referred to as "the Sacco", "we", "us") is a deposit-taking SACCO licensed and regulated by SASRA under the Sacco Societies Act, 2008. We hold the savings, loans and personal information of our members and take our duty to protect that information seriously.

This Notice explains what personal data we collect, why we collect it, how we use, share, store and protect it, and the rights you have. It is issued in compliance with:

1. The Constitution of Kenya, 2010 (Article 31 – right to privacy)
2. The Data Protection Act, 2019 ("the Act")
3. The Data Protection (General) Regulations, 2021; the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021; and the Data Protection (Compliance and Enforcement) Regulations, 2021 ("the Regulations")
4. The Sacco Societies Act, 2008, its Regulations, and applicable SASRA guidelines, circulars and prudential requirements on member confidentiality, record keeping, ICT and information security
5. Related laws, including the Proceeds of Crime and Anti-Money Laundering Act, 2009, the Computer Misuse and Cybercrimes Act, 2018, and the Credit Reference Bureau Regulations, 2020
6. The Tai Sacco Data Protection Policy

By joining Tai DT Sacco, using our products, services, website, mobile app or USSD channels, you acknowledge this Data Privacy Notice.

2.DEFINITIONS

1. Personal data: any information relating to an identified or identifiable person, such as name, ID number, phone number, member number, account details or photograph.
2. Sensitive personal data: data revealing race, health status, ethnic or social origin, conscience, belief, genetic or biometric data, property details, marital status, family details (including names of children, parents, spouse), or sex or sexual orientation of the data subject.
3. Data subject: the individual to whom personal data relates (members, prospective members, guarantors, nominees/next of kin, borrowers, website visitors, employees and job applicants).
4. Data Controller: the Sacco, which decides why and how personal data is processed.
5. Data Processor: any person or entity that processes data on our behalf (for example, Safaricom, our core banking vendor or SMS service provider).
6. ODPC: The Office of the Data Protection Commissioner.

3.WHO WE ARE AND HOW TO CONTACT US

CONTACTS:

TAI DT SACCO SOCIETY LIMITED

Githunguri Town – Kiambu County, Kenya

P.O. Box 718 – 00216 , Githunguri

Telephone: 0709 522 800

Whatsapp: 0709 111 111

Email: info@taisacco.coop

DPO email: dpo@taisacco.coop

DPO telephone: 0709 522 800

4.PRINCIPLES WE FOLLOW

In line with section 25 of the DPA Act (2019), we process personal data:

1. 1.Lawfully, fairly and transparently;
2. 2.For specified, explicit and legitimate purposes only;
3. 3.In a way that is adequate, relevant and limited to what is necessary (data minimization);
4. 4.Accurately and kept up to date;
5. 5.For no longer than necessary for the purpose it was collected;
6. 6.In line with your rights as a data subject;
7. 7.With appropriate safeguards, and not transferred outside Kenya unless the Act's conditions are met.

5.PERSONAL DATA WE COLLECT

We collect only the data we need. Depending on the service, this may include:

How we collect it: directly from you (membership and loan forms, branch visits, app or website, calls); from your employer (payroll deductions); from third parties such as credit reference bureaus (CRBs), IPRS, KRA, mobile network operators and guarantors; and automatically through our systems.

Sensitive personal data and children: we process sensitive data only as permitted by the Act, for example with your explicit consent or where necessary to comply with law. Data of minors (for junior accounts) is processed only with the consent of a parent or legal guardian and in the child's best interests.

6.WHY WE PROCESS YOUR DATA AND OUR LAWFUL BASIS

Where we rely on consent, it is freely given, specific, informed and unambiguous. You may withdraw it at any time, without affecting processing done before withdrawal. We do not make consent a condition for services where the data is not necessary for that service.

7.AUTOMATED DECISIONS

We may use automated tools, such as credit scoring or loan-eligibility checks, to support decisions. You may request human review of any such decision by contacting the DPO.

8.SHARING AND DISCLOSURE OF YOUR DATA

We do not sell your personal data. We share it only where necessary and with appropriate safeguards, with:

1. Regulators and authorities: SASRA, ODPC, Financial Reporting Centre, KRA, the Commissioner of Cooperatives, law enforcement, courts, and other bodies where required by law;
2. Licensed credit reference bureaus, in line with the Credit Reference Bureau Regulations;
3. Service providers (data processors): core banking and mobile/internet banking vendors, payment and mobile money providers, SMS and communication providers, cloud/hosting and IT support providers, auditors, insurers, debt collectors and legal advisers – each bound by a written contract requiring them to process data only on our instructions and to protect it;
4. Your employer or payroll office for check-off deductions;
5. Guarantors and nominees, to the extent necessary for the loan or benefit concerned;
6. Other parties with your consent, or where a lawful basis otherwise exists.

Member information is treated as confidential. It is disclosed only as stated above, with your consent or as required by law.

9.TRANSFER OF DATA OUTSIDE KENYA

We store and process member data in Kenya only. If we use cloud services, vendors or systems hosted outside Kenya, we will transfer personal data only where:

1. the destination country has adequate data protection safeguards, or the recipient is bound by appropriate contractual and security safeguards; and
2. you have consented where the Act requires it (including for sensitive personal data), and the other conditions in sections 48 to 50 of the Act and the Regulations are met.

10.HOW LONG WE KEEP YOUR DATA

We keep personal data only as long as necessary for the purpose for which it was collected, and to meet legal, regulatory, accounting and audit requirements.

11.YOUR RIGHTS

Under section 26 of the Act and the Regulations, you have the right to:

1. 1.Be informed of how your personal data is used;
2. 2.Access your personal data held by us;
3. 3.Object to the processing of all or part of your personal data, including for direct marketing;
4. 4.Correction of false or misleading data;
5. 5.Deletion of false or misleading data about you, and of data we are no longer entitled to keep;
6. 6.Data portability – to receive your data in a structured, commonly used format, and have it transmitted to another controller where technically feasible;
7. 7.Withdraw consent at any time;
8. 8.Not be subject to automated decisions that significantly affect you without human review;
9. 9.Lodge a complaint with the Data Commissioner.

12.DATA SECURITY

We implement appropriate technical and organizational measures, in line with section 41 of the Act (Data protection by design and by default), the Regulations and SASRA's ICT and risk management expectations, including:

1. Access controls based on role and need-to-know, and strong authentication;
2. Encryption of data in transit and, where appropriate, at rest;
3. Firewalls, anti-malware, intrusion monitoring, logging and regular backups;
4. Regular vulnerability assessments, penetration testing and system audits;
5. Physical security for offices, records rooms and server rooms;
6. Confidentiality undertakings and regular data protection training for staff, board and committee members;
7. Vendor due diligence and data processing agreements;
8. Data Protection Impact Assessments (DPIAs) for high-risk processing
9. Business continuity and disaster recovery plans.

Please help us protect you: never share your PIN, OTP or password with anyone, including people claiming to be Sacco staff, and report suspicious messages or lost phones immediately.

13.PERSONAL DATA BREACHES

If a breach affects personal data, we will:

1. Contain it and assess the risk to affected persons;
2. Notify the Data Commissioner within 72 hours of becoming aware of it, where required (section 43 of the Act);
3. Notify affected data subjects without unreasonable delay where the breach is likely to cause a real risk of harm, describing what happened, the likely consequences and the steps taken and advised;
4. Inform SASRA as required by its reporting requirements; and
5. Record the breach, its effects and remedial action taken.

14.CCTV, CALL RECORDING AND BIOMETRICS

We use CCTV at our premises for security, crime prevention and member safety, and notices are displayed at entry points. Calls to our customer care lines may be recorded for quality, training and dispute resolution. Where we use biometric data (for example fingerprints for identification), it is treated as sensitive personal data and is collected only with your explicit consent or another lawful basis.

15.DIRECT MARKETING AND COMMERCIAL USE

We send marketing messages about our products to our members. Every message includes a simple way to opt out, for example dialing *456*9*5# or contacting our support line on 254 709 522 800. Service messages such as transaction alerts, loan reminders and Member Education notices) are not marketing and may continue regardless.

16.MEMBERS' RESPONSIBILITIES

Please give us accurate and complete information, tell us promptly of any change including phone, address, nominee, employer et al and inform any guarantor, nominee or third party whose details you provide that you have shared their data with us and directed them to this Data Privacy Notice.

17.REGISTRATION, GOVERNANCE AND ACCOUNTABILITY

1. The Sacco is registered with the ODPC as a data controller and data processor, as required by the Act and the Registration Regulations, and renews its registration annually.
2. The Board oversees data protection compliance and receives regular compliance reports
3. We maintain a record of processing activities, conduct periodic privacy audits and train staff on data protection.
4. All service providers who handle member data are bound by written agreements covering confidentiality, security, breach notification and return or deletion of data.

18.COMPLAINTS

If you have a concern about how we handle your data, please contact our DPO first. We will acknowledge your complaint and aim to resolve it within [14] days.

19.CHANGES TO THIS PRIVACY NOTICE

Tai DT Sacco Data Protection Policy may be reviewed in spans of at least three (3) years. The updated version will be used to review this privacy notice and be published on our website and copies may be made available at our branches. Where changes are significant, we will notify members through SMS, email or notices. This privacy notice should be read together with the Terms and Conditions. Where in conflict, the privacy notice shall prevail.