Data Privacy Statement

UASA Sacco ("UASA", "the Sacco", "we", "us" or "our") respects your privacy and is committed to protecting your personal data. This Data Privacy Statement sets out the rules and principles governing the processing of your personal data by UASA Sacco. Its purpose is to ensure that UASA Sacco processes personal data in accordance with the Data Protection Act, 2019 (Kenya) and any regulations issued under it, as well as the guidelines of the Sacco Societies Regulatory Authority (SASRA).

This statement should be read together with the Terms and Conditions of use for UASA Sacco products and services and any consent form you sign or accept. It applies to all members, guarantors, shareholders, directors and delegates, employees, suppliers, contractors, visitors and third-party entities engaging with UASA Sacco under a contractual or business relationship.

• Members (including salaried members, SME members, chamas and groups)
• Employees
• Directors, Delegates and elected officials
• Shareholders / Stakeholders
• Suppliers / Contractors
• Third parties (guarantors, nominees, beneficiaries, agents)
• Visitors, interns, attachees and job seekers

Personal Data We Collect

• Identity card, contact details, gender, name, relationship/next of kin
• Employment details, background information, date of birth
• National ID or passport, KRA PIN, nominee and beneficiary details
• Financial obligations, bank and M-Pesa account details, medical information
• Birth/death certificates, passport photograph, signature
• Collateral details, log book, title deed, LPO/contract documents (for SME and LPO financing)
• Data from calls, social media, WhatsApp, USSD (*886#), mobile app, chatbot and email interactions
• CCTV surveillance and visitor records at UASA House and Sacco premises

Purpose of Collection

Member on-boarding and registration, loan processing (including Emergency, Development, School Fees and SME/LPO loans), beneficiary and claims processing, payment and dividend processing, Know Your Customer (KYC), pre-qualification, tax compliance, recruitment and staff on-boarding, placement of interns and attachees, know-your-applicant checks, provision of a safe and secure environment within our premises, quality management, and our legitimate interest in securing our premises for the benefit of our employees, members and visitors.

• Application forms (physical, electronic, or via the Join Now portal)
• Phone calls, email, WhatsApp and social media interactions
• The UASA Sacco website, mobile app, USSD *886# and digital banking channels
• Premises visits and CCTV footage at UASA House and branch offices
• Employer data submitted for check-off deductions and loan recovery
• Third parties, with your consent (e.g. guarantors, referees)
• Government entities and regulatory bodies

We process your personal information on the basis of one or more of the following lawful grounds provided for under the Data Protection Act, 2019:

• Consent
• Contractual agreement (membership and loan agreements)
• Legitimate interests
• Legal or regulatory obligation (including SASRA reporting requirements)
• Public interest
• Vital interests
• Historical, statistical or scientific research

In determining the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data, the need to comply with our internal policies, and applicable legal, regulatory, accounting or SASRA requirements. For the purpose of loan processing, we shall retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy our legal and regulatory obligations.

Your data may be shared with third parties under the following conditions:

• Loan default persisting beyond three (3) months
• After issuance of two demand notices
• Listing with Credit Reference Bureaus (CRBs)

Such third parties include, among others:

• Credit reference agencies
• Debt recovery firms
• Law enforcement agencies, regulators (including SASRA) and courts

We may send you information via SMS, WhatsApp and social media to create awareness, provide reminders about your account or loan obligations, and share updates on new products, promotions and Sacco news.

By using our website, mobile app, USSD service or any other UASA Sacco digital channel, you agree to our Terms and Conditions. Please read them carefully.

We are committed to ensuring the confidentiality, integrity and availability of your personal data. We apply appropriate physical, technical and administrative safeguards, including access controls, secure systems and staff confidentiality obligations, to protect your information from unauthorised access, loss, misuse or alteration.

We do not intend to transfer your personal data outside Kenya unless it is necessary for the fulfilment of a legal obligation, or is otherwise in the public interest, and always subject to the safeguards required under the Data Protection Act, 2019.

As a data subject, you have the right to:

• Be informed of the use to which your personal data is to be put
• Access your personal data in our custody
• Object to the processing of all or part of your personal data
• Correction of false or misleading data
• Deletion of false or misleading data about you
• Restrict processing of your personal data, subject to applicable legal exceptions

If you have any questions, concerns or requests regarding this Data Privacy Statement or the processing of your personal data, please contact us using the details below. We will verify your identity, assess your request and respond appropriately within the timelines prescribed by law.

Data Protection Officer: dpo@uasasacco.com
Note: the Data Protection Officer contact address should be confirmed and formally designated by UASA Sacco's board/management before this statement is published, if not already in place.

We may amend the terms of your consent from time to time. Your express consent will be sought and required for any future applications or new uses of your personal data not already covered by this statement.

This Data Privacy Statement may be updated from time to time to reflect changes in our practices or legal requirements. The current version will always be available at www.uasasacco.com.