Privacy Policy

1. Who We Are

Kyaddondo CBS PEWOSA SACCO (referred to in this policy as "PEWOSA", "we", "us", or "our") is a savings and credit cooperative organisation licensed and regulated by the Uganda Microfinance Regulatory Authority (UMRA). Our registered office is located in Kampala, Uganda.

We are committed to complying with applicable Ugandan data protection laws, including the Data Protection and Privacy Act, 2019, and the Data Protection and Privacy Regulations, 2021. This Privacy Policy governs the collection, use, storage, and disclosure of personal data obtained through our website, mobile application, and in-branch services.

2. Information We Collect

We collect personal information in the following ways:

2.1 Information You Provide Directly

• Full name, date of birth, and gender
• National ID number, passport, or other government-issued identification
• Residential and postal address
• Contact details including phone number and email address
• Employment details and source of income
• Next-of-kin and beneficiary information
• Financial information required for account opening, loan applications, or transactions

2.2 Information Collected Automatically

• IP address and browser type when you visit our website
• Pages visited, time spent, and referring URLs
• Device identifiers and operating system information
• Cookie data (see Section 8)

2.3 Information from Third Parties

• Credit reference bureau reports for loan assessments
• Employer verification responses
• CBS (Credit Bureau System) affiliated data as required by our regulatory obligations

3. How We Use Your Information

We use your personal data for the following purposes:

• To process membership applications and manage your SACCO account
• To evaluate and process loan applications, including credit risk assessments
• To process deposits, withdrawals, loan repayments, and other transactions
• To communicate important account notices, statements, and updates
• To comply with legal and regulatory obligations, including Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements
• To detect, investigate, and prevent fraud or other unlawful activity
• To improve our website and digital services
• To send you information about products, services, or promotions where you have given consent to receive such communications

4. Sharing of Information

We do not sell your personal information. We may share your data only in the following circumstances:

• Regulatory bodies: Uganda Microfinance Regulatory Authority (UMRA), Uganda Revenue Authority (URA), Financial Intelligence Authority (FIA), and other authorities as required by law.
• Credit bureaux: For credit assessments and reporting obligations under the Microfinance Institutions Money Lenders Act.
• CBS network: As required under our CBS affiliation for inter-cooperative services.
• Service providers: Third-party vendors who assist us in operating our website, processing transactions, or delivering services — bound by confidentiality agreements.
• Legal proceedings: Where disclosure is required by a court order or applicable law.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Secure, encrypted storage of sensitive member records
• Access controls limiting data access to authorised personnel only
• SSL/TLS encryption on our website and digital platforms
• Regular staff training on data protection and privacy obligations

Notwithstanding these measures, no data transmission over the internet is entirely secure. We encourage you to keep your account credentials confidential and contact us immediately if you suspect unauthorised access to your account.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, accounting, or reporting requirements. In general:

• Active member records are retained for the duration of membership and for a minimum of seven (7) years after account closure, as required under Ugandan financial regulation.
• Loan records are retained for a minimum of seven (7) years from the date the loan is fully settled.
• Website enquiry and contact form data is retained for up to two (2) years.

7. Your Rights

Under the Data Protection and Privacy Act, 2019 (Uganda), you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete information.
• Right to erasure: You may request deletion of your data where it is no longer necessary, subject to our legal retention obligations.
• Right to object: You may object to processing of your data for marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing done before withdrawal.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 11.

8. Cookies

Our website uses cookies — small text files stored on your device — to improve functionality and your browsing experience. We use:

• Essential cookies: Required for the website to function correctly. These cannot be disabled.
• Analytical cookies: Help us understand how visitors interact with the site so we can improve it. Used only in aggregated, anonymised form.

You can control or disable non-essential cookies through your browser settings. Note that disabling cookies may affect certain features of the site.

9. Third-Party Links

Our website may contain links to external websites — including CBS-affiliated institutions, mobile money providers, and partner organisations. We are not responsible for the privacy practices of those websites and encourage you to review their respective privacy policies before submitting any personal information.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by posting the updated policy on this page with a revised "Last updated" date. We encourage you to review this page periodically. Continued use of our services after any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact our Data Protection Officer:

You also have the right to lodge a complaint with the National Information Technology Authority – Uganda (NITA-U), which serves as the supervisory authority for data protection in Uganda.