1. Introduction

Africhama CHAMA ("we", "our", or "us") is committed to protecting your personal data in accordance with the Kenya Data Protection Act, 2019 (DPA) and other applicable data protection laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our CHAMA management services.

2. Data Controller Information

Organization: Africhama CHAMA
Data Protection Officer: Data Protection Officer
Contact Email: [email protected]
Supervisory Authority: Office of the Data Protection Commissioner (ODPC), Kenya

3. Personal Data We Collect

We collect and process the following categories of personal data:

• Identity Data: Full name, national ID number, email address
• Contact Data: Mobile phone numbers, email addresses
• Financial Data: Contribution amounts, loan records, fine records, bank statement information
• Transaction Data: Payment history, M-Pesa transaction details
• Technical Data: IP address, browser type, login timestamps
• Household Data: Next of kin information (where provided)

4. How We Collect Your Data

We collect personal data through:

• Direct interactions (membership registration, profile updates)
• Automated technologies (bank statement processing, M-Pesa callbacks)
• Third parties (payment processors like Safaricom M-Pesa)

5. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we process your personal data based on:

• Consent: You have given explicit consent for processing (e.g., SMS notifications)
• Contract: Processing is necessary for your CHAMA membership agreement
• Legal Obligation: Processing is required by law (e.g., financial regulations, tax requirements)
• Legitimate Interests: Processing is necessary for our legitimate business interests (e.g., fraud prevention)

6. How We Use Your Data

Your personal data is used to:

• Manage your CHAMA membership and account
• Process contributions, loans, and fine payments
• Match bank statement transactions to your account via mobile number
• Calculate and apply fines for missed contributions
• Send notifications about your account (SMS, email)
• Comply with legal and regulatory requirements
• Prevent fraud and maintain security

7. Automated Decision-Making

We use automated systems to:

• Match transactions to members based on mobile numbers
• Calculate fines for members who do not meet minimum weekly contributions

You have the right to request human review of any automated decision that significantly affects you. Contact our Data Protection Officer to request a review.

8. Data Sharing and Third Parties

We may share your personal data with:

• Safaricom (M-Pesa): For payment processing
• SMS Service Providers: For sending notifications
• Regulatory Authorities: When required by law
• Credit Reference Bureaus: For loan-related reporting (where applicable)

We do not sell your personal data to third parties.

9. Data Retention

We retain your personal data for:

• Active membership records: Duration of membership + 7 years
• Financial records: 7 years after last transaction (tax/regulatory requirements)
• Loan records: 7 years after loan closure
• Activity logs: 2 years

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of passwords and sensitive data
• Secure HTTPS connections
• Access controls and role-based permissions
• Regular security audits
• Activity logging and monitoring

11. Your Rights Under the Kenya Data Protection Act

As a data subject, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain types of processing
• Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, please contact our Data Protection Officer at [email protected] or visit your Data Privacy Settings.

12. Data Localization

In compliance with the Kenya Data Protection Act, we store at least one serving copy of your personal data on servers located within the Republic of Kenya.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Office of the Data Protection Commissioner within 72 hours
• Notify affected data subjects without undue delay
• Document the breach and remedial actions taken

14. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

Office of the Data Protection Commissioner
Website: www.odpc.go.ke
Email: [email protected]

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date.

16. Contact Us

For any questions about this Privacy Policy or our data protection practices, please contact:

Data Protection Officer: Data Protection Officer
Africhama CHAMA
Email: [email protected]