Privacy Policy

1. Overview and Legal Basis

ChamaCore Technologies operates as a data processor under the Kenya Data Protection Act 2019 (DPA 2019) and the attendant Data Protection (General) Regulations 2021. Your Organisation is the data controller — you determine what personal data is collected and for what purpose. ChamaCore processes that data strictly on your instructions. Our processing is lawful under Section 30 of the DPA 2019 on the basis of contractual necessity (processing is required to deliver the services your Organisation subscribed to) and legitimate interests (platform security, fraud prevention, and regulatory compliance).

2. Personal Data We Collect and Process

The following categories of personal data are processed on the Platform on behalf of your Organisation:

• Identity Data: Full legal name, National ID / Passport number, KRA PIN (where applicable for SASRA KYC requirements).
• Contact Data: Mobile phone number (primary M-Pesa-registered number), email address, physical address.
• Financial Data: Savings contributions, loan applications and repayment records, dividend and interest allocations, M-Pesa transaction IDs and timestamps, bank account details (where provided for non-M-Pesa payouts).
• KYC Verification Data: Copies of national ID front/back, passport photos — collected and stored only where your Organisation's account tier requires KYC verification.
• System and Usage Data: IP addresses, browser type and version, device identifiers, login timestamps, and session activity logs — collected automatically for security auditing and fraud detection.
• Communications Data: Support tickets, email correspondence, and in-platform chat logs with the ChamaCore support team.

3. How We Use Personal Data

Personal data processed on the Platform is used exclusively for the following purposes:

• Delivering Platform Services: Computing member balances, processing M-Pesa contributions and disbursements, generating ledgers, loan schedules, and financial statements.
• Regulatory Compliance: Generating SASRA-formatted reports, preparing statutory returns, and supporting AML/CFT monitoring obligations.
• Security and Fraud Prevention: Monitoring for unusual account activity, preventing unauthorised access, and maintaining audit trails.
• Platform Improvement: Anonymised, aggregated usage analytics to improve product features. No individual member data is used for this purpose.
• Support and Communication: Responding to Administrator and member support requests.
• ChamaCore does not sell, rent, monetise, or share any personal data for advertising or marketing purposes.

4. Third-Party Data Processors

ChamaCore engages the following categories of sub-processors to deliver its services. All sub-processors are bound by data processing agreements consistent with the DPA 2019:

• Safaricom M-Pesa (Daraja API): Processes mobile money transactions initiated through the Platform. Subject to Safaricom's own privacy policy and Central Bank of Kenya oversight.
• Cloud Infrastructure Provider (AWS / equivalent): Hosts Platform databases and application servers in data centres with ISO 27001 certification. Data is stored within regions that meet Kenyan data residency guidelines where required.
• Email Delivery Service: Used to send transaction receipts, account notifications, and platform alerts to Administrators. No marketing emails are sent to members without explicit consent.
• Error Monitoring and Logging Service: Captures anonymised application errors and performance metrics. No personal financial data is included in error logs.
• Identity Verification Provider (where KYC is enabled): Processes ID document images for verification. Operates under a separate data processing agreement and retains data only as long as required for verification completion.

5. Data Retention

ChamaCore retains personal data for the following periods:

• Active subscription: All data is retained for the life of the subscription.
• Post-cancellation: Data is retained in read-only format for 60 days to allow export. After 60 days, all data is deleted from production systems within 30 days and from encrypted backup archives within 90 days.
• System logs and audit trails: Retained for 7 years in line with the Kenya Income Tax Act requirements for financial record-keeping, in anonymised form where possible.
• Support communications: Retained for 2 years after resolution of the support request.
• Organisations may request early deletion of specific member records, subject to the Organisation's own legal obligations under financial and tax law.

6. Security Measures

ChamaCore implements the following technical and organisational security measures to protect personal data:

• Encryption at Rest: All database records are encrypted using AES-256. Encryption keys are managed via a dedicated key management service with rotation policies.
• Encryption in Transit: All data transmitted between the Platform and users is protected by TLS 1.3. Plain HTTP connections are rejected.
• Access Controls: Role-based access control (RBAC) is enforced at the application level. Database access from application servers is restricted by IP allowlisting and least-privilege service accounts.
• Multi-Factor Authentication: MFA is available and strongly recommended for all Administrator accounts.
• Penetration Testing: The Platform is subject to periodic third-party security assessments.
• Incident Response: In the event of a personal data breach affecting member data, ChamaCore will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours and notify affected Organisations without undue delay.

7. Data Subject Rights

Under the Kenya Data Protection Act 2019, individual members have the following rights regarding their personal data. Since ChamaCore acts as a processor, these requests should be directed first to your Organisation's Administrator:

• Right of Access (Section 26 DPA 2019): Members may request a copy of the personal data held about them.
• Right to Rectification (Section 27): Members may request correction of inaccurate or incomplete data.
• Right to Erasure (Section 28): Members may request deletion of their data where it is no longer necessary for the purpose collected, subject to the Organisation's statutory record-keeping obligations.
• Right to Object (Section 32): Members may object to processing on grounds relating to their particular situation.
• Right to Data Portability (Section 31): Members may request their data in a structured, machine-readable format.
• If an Administrator is unable or unwilling to action a member's request, the member may escalate directly to ChamaCore at privacy@chamacore.co.ke or to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

8. International Data Transfers

Where personal data is transferred outside Kenya (e.g. to cloud infrastructure providers or identity verification services with servers in other jurisdictions), ChamaCore ensures that such transfers are carried out in compliance with Section 48 of the DPA 2019, specifically that the recipient country provides an adequate level of data protection or that appropriate contractual safeguards (Standard Contractual Clauses) are in place.

9. Data Relating to Minors

The Platform is intended for use by organisations whose members are 18 years of age or older. If your Organisation includes junior savings accounts or youth members under 18, you as the data controller are responsible for ensuring appropriate parental or guardian consent has been obtained before entering any minor's personal data into the Platform.

10. Changes to This Privacy Policy

ChamaCore may update this Privacy Policy from time to time to reflect changes in our processing activities, legal obligations, or the Platform's features. We will notify Administrators of material changes by email and in-platform notice at least 14 days before the change takes effect. The "Last updated" date at the top of this page will always reflect the most recent revision.

11. Data Protection Contact

For any data protection enquiries, requests, or complaints, please contact:

• Data Protection Officer: privacy@chamacore.co.ke
• Phone: +254 768 161 412
• Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke