Data Protection Framework

1. Introduction

This document describes the Data Protection Framework that ChamaCore Technologies has implemented to govern how personal data is handled across the Platform, from collection to deletion. It is intended to be read by Organisation Administrators who want to understand ChamaCore's internal data governance practices — beyond what is covered in the Privacy Policy — and to help Organisations build their own data protection compliance programmes. ChamaCore operates as a data processor under the Kenya Data Protection Act 2019. Your Organisation is the data controller.

2. Applicable Legal Framework

ChamaCore's data protection practices are governed by the following Kenyan legislation and regulations:

• Kenya Data Protection Act 2019 (Act No. 24 of 2019): The primary legislation governing collection, processing, storage, use, and protection of personal data in Kenya.
• Data Protection (General) Regulations 2021: Operational regulations implementing the DPA 2019, including data controller/processor registration requirements, data breach notification procedures, and data protection impact assessment (DPIA) guidelines.
• Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021: ChamaCore is registered as a data processor with the Office of the Data Protection Commissioner (ODPC).
• Computer Misuse and Cybercrimes Act 2018: Governs unauthorised access to computer systems and data interception offences.
• SACCO Societies Act and SASRA Guidelines: Impose additional record-keeping and member data obligations on SACCOs specifically.

3. Data Governance Structure

ChamaCore has established the following governance roles to ensure accountability for data protection:

• Data Protection Officer (DPO): ChamaCore has designated a DPO responsible for monitoring compliance with the DPA 2019, advising on DPIAs, and acting as the point of contact for the ODPC. Contact: privacy@chamacore.co.ke.
• Platform Engineering Lead: Responsible for implementing technical controls including encryption, access controls, and vulnerability management.
• Organisation Administrator (Your Role): As the data controller, your Organisation's Administrator is responsible for lawful collection of member data, obtaining proper consent, and actioning member data subject rights requests.

4. Data Minimisation and Purpose Limitation

ChamaCore adheres to the data minimisation principle under Section 25(b) of the DPA 2019: we process only the minimum personal data necessary to deliver the Platform's functions. Specifically:

• Member identity data (name, ID number, phone) is required to uniquely identify members and process M-Pesa transactions. It cannot be removed without disabling core ledger functionality.
• KYC document images (ID copies) are only collected by Organisations that have enabled the KYC tier. They are stored in an isolated, encrypted document store separate from the main database and are not used for any purpose other than SASRA/AML compliance.
• Usage logs (IP addresses, login timestamps) are retained for 12 months for security purposes only and are automatically purged thereafter.
• ChamaCore does not collect biometric data, social media profiles, or any personal data not listed in the Privacy Policy.

5. Consent and Lawful Basis

ChamaCore processes personal data on the following lawful bases under Section 30 of the DPA 2019:

• Contractual Necessity: Processing is necessary to deliver the services your Organisation subscribed to (e.g. computing balances, processing M-Pesa transactions).
• Legal Obligation: Processing is required to comply with applicable Kenyan law (e.g. AML/CFT record-keeping, SASRA prudential reporting).
• Legitimate Interests: Processing system logs and audit trails to maintain Platform security and prevent fraud.
• Your Organisation's Responsibility: Where your Organisation collects member personal data for entry into the Platform, you are responsible for ensuring you have a valid lawful basis for that collection. For most SACCOs and Chamas, this is the member's contractual membership with the group. A membership application form that discloses how member data will be processed (including through ChamaCore) constitutes valid notice under the DPA 2019.

6. Data Protection Impact Assessments (DPIAs)

ChamaCore conducts Data Protection Impact Assessments for any new Platform feature or integration that involves processing personal data at scale or that introduces new privacy risks. Recent DPIAs include:

• M-Pesa Daraja API Integration: Assessed for risks of transaction data exposure. Mitigated by API token rotation, TLS enforcement, and webhook signature verification.
• KYC Document Storage Module: Assessed for risks of sensitive document exposure. Mitigated by isolated encrypted storage, restricted access roles, and 90-day document retention after verification.
• SASRA Report Generation: Assessed to confirm that report exports contain only data the Administrator is authorised to access. Enforced by role-based access controls.
• ChamaCore will conduct a new DPIA before deploying any feature that involves new categories of sensitive personal data, automated decision-making, or large-scale profiling of members.

7. Data Breach Response Procedure

In the event of a personal data breach, ChamaCore will follow this procedure:

• Detection and Containment (0–4 hours): The incident is identified, logged, and contained. Affected systems are isolated as necessary.
• Assessment (4–24 hours): The scope, nature, and likely impact of the breach are assessed. The number of affected individuals and categories of data involved are determined.
• ODPC Notification (within 72 hours): If the breach is likely to result in risk to individuals' rights and freedoms, ChamaCore notifies the Office of the Data Protection Commissioner as required by Regulation 25 of the Data Protection (General) Regulations 2021.
• Organisation Notification (without undue delay): Affected Organisations are notified by email with a summary of the breach, the data involved, the likely impact, and the remedial steps taken.
• Post-Incident Review: Root cause analysis is conducted and remediation measures are implemented within 30 days of the incident.

8. Data Processor Agreements

ChamaCore has data processing agreements (DPAs) in place with all sub-processors that handle personal data on its behalf. These agreements require sub-processors to:

• Process personal data only on documented instructions from ChamaCore.
• Implement appropriate technical and organisational security measures.
• Not engage further sub-processors without ChamaCore's prior written consent.
• Delete or return all personal data upon termination of the sub-processing relationship.
• Assist ChamaCore in responding to data subject rights requests and regulatory enquiries.

9. Your Organisation's Data Protection Obligations

As the data controller, your Organisation should take the following steps to ensure your own DPA 2019 compliance when using ChamaCore:

• Register with the ODPC: All data controllers processing personal data in Kenya are required to register with the Office of the Data Protection Commissioner. Registration can be completed at www.odpc.go.ke.
• Update Your Membership Agreement: Ensure your membership application form or constitution includes a data processing notice informing members that their data is processed on the ChamaCore platform.
• Appoint a Data Contact Person: Designate an Administrator responsible for handling member data access requests, correction requests, and erasure requests.
• Conduct an Internal DPIA: If your SACCO or Chama uses additional data collection methods beyond ChamaCore (e.g. WhatsApp groups, physical registers, third-party apps), assess and document those data flows separately.
• Train Your Administrators: Ensure that all persons with Administrator access to the Platform understand their data protection obligations and the consequences of mishandling member data.

10. Contact and Further Guidance

For questions about this Framework or to discuss your Organisation's data protection obligations, contact:

• ChamaCore DPO: privacy@chamacore.co.ke
• Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke · info@odpc.go.ke
• Kenya ICT Authority (data governance resources): www.ict.go.ke