Privacy notice

ZidiPamoja Technologies Ltd. (“ZidiPamoja”, “we”) provides core banking and operations software to SACCOs, Financial Services Associations, chamas, microfinance lenders and the head offices that supervise them.

• For this website, enquiries and our own business contacts, we decide how personal data is used, so we are the data controller.
• For the member and staff records an institution keeps on the platform, the institution is the data controller and we are its data processor. We handle that data only on the institution’s instructions and under our agreement with it.

If you are a member, your SACCO, FSA or group is your first point of contact about your account data. We help it answer your requests.

Website visitors and enquiries. What you put in a demo request or email (your name, work email, phone number, institution and message), and the basic technical data our servers record when you visit (IP address, browser type, pages requested and time).

Staff of an institution. Name, username, email, phone number, role and branch, and a record of the actions you take on the platform (the audit trail).

Members of an institution, processed for that institution:

• identity and KYC details: name, national ID or passport number, date of birth, gender, phone number, KRA PIN, address, next of kin, photo and documents;
• account details: savings, shares, loans, guarantors, repayments and statements;
• transaction details: deposits, withdrawals, transfers, and M-Pesa and bank references;
• group membership and contributions made at group meetings;
• messages sent to you, such as SMS alerts, emails and one-time PINs;
• results of identity (IPRS) and credit reference bureau checks, where the institution uses them.

• to provide, operate, support and secure the platform for the institution;
• to open and run accounts, process and reconcile transactions, and keep the institution’s books;
• to verify identity, prevent fraud and help the institution meet its anti-money-laundering obligations;
• to send transaction alerts, one-time PINs and service messages;
• to answer enquiries and arrange demonstrations;
• to keep audit trails, investigate incidents and comply with the law and with lawful requests from regulators.

We do not sell personal data, and we do not use members’ data for our own marketing.

Under section 30 of the Data Protection Act, 2019 we process personal data only where it is necessary:

• to perform a contract with you, or to take steps you ask for before one;
• to comply with a legal obligation;
• for legitimate interests that your rights do not override, such as keeping the platform secure and preventing fraud;

or where you have given consent, for example to receive news from us. You can withdraw consent at any time; that does not affect processing that already took place.

• the institution you bank with and, where its arrangements provide for it, the supervisory head office that oversees it;
• service providers that help us run the platform: hosting, SMS and email delivery, the mobile money and banking partners that carry your transactions, and identity and credit reference providers when the institution uses them;
• regulators, courts and law enforcement, when the law requires it.

Our service providers may use the data only on our instructions and must protect it under their contracts with us.

Some service providers may store or process data outside Kenya. When that happens we transfer it only as the Data Protection Act allows, with appropriate safeguards such as contractual protections, and with consent where the Act requires it.

We protect personal data with technical and organisational measures, including:

• access limited by role and branch;
• a separate database for each institution;
• encryption of data in transit;
• an audit trail of user actions;
• two-person (maker-checker) approval for sensitive changes, where the institution turns it on.

No system is perfectly secure. If a breach affects personal data, we will notify the institution and the Data Commissioner, and you where the Act requires, within the time limits the Act sets.

• Enquiries: as long as we need to answer and follow up, then we delete or anonymise them.
• Institution data: for as long as the institution’s agreement with us runs and the institution instructs, which reflects its own legal duties to keep financial, tax and anti-money-laundering records. When the agreement ends we return or delete the data as the agreement provides.
• Server logs: for a short period, for security.

Under the Data Protection Act, 2019 you have the right to:

• be told how your personal data is used;
• access your personal data;
• object to its processing;
• have false or misleading data corrected;
• have false, misleading or unlawfully held data deleted;
• receive your data in a portable format;
• withdraw consent you have given.

Members: please send requests to your institution first. Anyone else: write to hello@zidipamoja.com. We may need to confirm your identity before we act on a request.

If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

This website uses no advertising or analytics cookies. It sets only:

• mui-color-mode and mui-theme-name, which remember your light or dark mode and colour choice for up to a year;
• on the staff and member portals, a session cookie that keeps you signed in until you sign out or it expires. The portals cannot work without it.

This website is not aimed at children. Where an institution offers junior accounts, it collects the consent of a parent or guardian as the law requires.

We may update this notice as the platform or the law changes. The date at the top shows when it last changed, and we will tell institutions about material changes.

Questions about this notice or your personal data go to ZidiPamoja Technologies Ltd., Embakasi, Nairobi, Kenya.

• Email: hello@zidipamoja.com
• Phone: 0182 626 921

See also our terms of use.