1. Introduction

Africhama ("we", "our", or "us") is committed to protecting your personal data in accordance with the Kenya Data Protection Act, 2019 (DPA) and other applicable data protection laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our CHAMA management platform.

2. Data Controller Information

Organization: Africhama (Picidae InfoSolutions Ltd)
Data Protection Officer: Data Protection Officer
Contact Email: [email protected]
Supervisory Authority: Office of the Data Protection Commissioner (ODPC), Kenya

3. Personal Data We Collect

We collect and process the following categories of personal data:

• Identity Data: Full name, national ID number, email address
• Contact Data: Mobile phone numbers, email addresses
• Financial Data: Contribution amounts, loan records, payment information
• Transaction Data: Payment history, M-Pesa transaction details
• Technical Data: IP address, browser type, login timestamps

4. How We Collect Your Data

We collect personal data through:

• Direct interactions (registration, profile updates)
• Automated technologies (bank statement processing, M-Pesa callbacks)
• Third parties (payment processors like Safaricom M-Pesa)

5. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we process your personal data based on:

• Consent: You have given explicit consent for processing
• Contract: Processing is necessary for service delivery
• Legal Obligation: Processing is required by law
• Legitimate Interests: Processing is necessary for our legitimate business interests

6. Your Rights Under the Kenya Data Protection Act

As a data subject, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain types of processing
• Right to Withdraw Consent: Withdraw consent at any time

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption, secure connections, access controls, and regular security audits.

8. Data Retention

We retain your personal data for:

• Active accounts: Duration of service + 7 years
• Financial records: 7 years (regulatory requirements)
• Activity logs: 2 years

9. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

Office of the Data Protection Commissioner
Website: www.odpc.go.ke
Email: [email protected]

10. Contact Us

For any questions about this Privacy Policy, please contact:
Africhama
Email: [email protected]