Suluhu Sacco DT | Privacy Policy

Privacy Policy – Suluhu Sacco Society Limited

Effective Date: 2025

Suluhu Sacco Society Limited (“Suluhu Sacco”, “we”, “our”, or “us”) is committed to protecting the privacy and personal data of its members, employees, customers, suppliers, and other stakeholders in accordance with the Data Protection Act, 2019 of Kenya and the Data Protection (General) Regulations, 2021.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data.

1. Scope

This Privacy Policy applies to all personal data collected, processed, or stored by Suluhu Sacco through its offices, systems, digital platforms, and service providers.

2. Personal Data We Collect

We may collect the following categories of personal data:

• Identification information (name, ID/passport number, date of birth, nationality)
• Contact details (postal address, email address, phone number)
• Financial information (bank details, account information, loan data)
• Biometric data (e.g. fingerprints where applicable)
• Employment and payroll information
• Statutory information (NHIF, NSSF, KRA PIN)
• Images and recordings (CCTV, photographs, video recordings)
• Any other information required to provide Sacco services or comply with legal obligations

3. How We Collect Personal Data

Personal data is collected:

• Directly from you during membership, employment, loan applications, or service requests
• Indirectly from third parties such as employers, credit reference bureaus, regulators, and service providers
• Automatically through our systems, websites, and security infrastructure

4. Purpose of Processing

We process personal data for the following purposes:

• Provision and administration of Sacco products and services
• Membership and account management
• Loan processing and credit assessment
• Compliance with legal and regulatory obligations
• Employment and human resource management
• Communication, marketing (with consent), and service improvement
• Security, fraud prevention, and risk management

5. Legal Basis for Processing

We process personal data based on:

• Consent of the data subject
• Performance of a contract
• Compliance with legal obligations
• Legitimate interests of the Sacco
• Protection of vital interests of the data subject

6. Data Sharing and Disclosure

We may share personal data with:

• Regulators and government authorities (e.g., SASRA, KRA, courts)
• Credit Reference Bureaus
• Service providers and contractors under confidentiality agreements
• Law enforcement agencies where required by law

We do not sell personal data to third parties.

7. Data Security

Suluhu Sacco implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

8. Data Retention

Personal data is retained only for as long as necessary to fulfill the purpose for which it was collected or as required by law. Data that is no longer required is securely deleted or anonymized.

9. Rights of Data Subjects

You have the right to:

• Be informed about the use of your personal data
• Access your personal data
• Request correction of inaccurate data
• Object to processing of your data
• Request deletion of false or misleading data
• Withdraw consent where processing is based on consent

Requests may be made in writing to the Data Protection Officer.

10. Automated Decision-Making

Certain decisions, including loan eligibility and limits, may be automated. You have the right to request a review of automated decisions.

11. Cross-Border Data Transfers

Personal data shall not be transferred outside Kenya unless adequate safeguards are in place or explicit consent has been obtained.

12. Data Breaches

Any personal data breach will be handled in accordance with the law and, where required, reported to the Office of the Data Commissioner and affected data subjects.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updated versions will be made available through official Sacco communication channels.

14. Contact Information

Data Protection Officer
Suluhu Sacco Society Limited
Email: info@suluhusacco.co.ke