Privacy Policy

Scope of this Privacy Policy

This Privacy Policy applies to interactions with the EPZA SACCO public website, including browsing public pages, sending enquiries, submitting information through available website forms and accessing website features.

Where you are a member, prospective member, guarantor, applicant, supplier or another person interacting with the SACCO, additional information-handling requirements may apply under the relevant service documents, contractual arrangements and applicable law.

This policy does not replace a specific notice provided for a membership application, loan application, account service, employment process or other activity requiring separate information-handling arrangements.

Information we may collect

Depending on your interaction with the website or a related service, the following categories of information may be collected where relevant and appropriate.

Information you provide

• Contact information: such as your name, email address, telephone number and the details you include in an enquiry.
• Enquiry and correspondence data: the subject and content of messages, requests, feedback and communications sent to the SACCO.
• Application information: details you choose or are required to submit through a membership, loan, recruitment or other service process.
• Documents and supporting details: information submitted where a specific application or service legitimately requires supporting documentation.

Technical and usage information

When supported by the website's configuration, the website or its service providers may process technical information such as your internet protocol address, browser type, device characteristics, pages visited, timestamps, referring page and security logs.

Information obtained from other sources

In appropriate circumstances, information may be received from an authorised representative, a service provider, a verification source or another party involved in a service you have requested, subject to applicable legal requirements and the relevant purpose.

We do not intend to collect information that is irrelevant to the purpose for which it is requested. The precise categories collected depend on the form, service and processing activity involved.

How information is collected

Information may be obtained through:

• Website contact and enquiry forms.
• Membership and service application forms.
• Communications sent by email, telephone or other available channels.
• Website security, server and operational logs.
• Cookies or similar technologies where these are enabled.
• Authorised third-party services involved in a requested transaction or service.

Where information is requested through a form, the form and its accompanying instructions should indicate which fields are required. Providing information that is necessary for a particular request may be essential for the SACCO to respond to or process that request.

How information may be used

Personal information may be processed for purposes that are relevant to the interaction or service concerned, including:

• Responding to enquiries, requests and feedback.
• Communicating information about requested services.
• Receiving and processing membership or service applications.
• Assessing requests in accordance with applicable procedures and requirements.
• Maintaining records and administering services where appropriate.
• Verifying information where lawfully required or justified.
• Protecting the website, detecting suspicious activity and investigating security incidents.
• Maintaining website performance, reliability and accessibility.
• Meeting applicable legal, regulatory, audit or record-keeping obligations.
• Improving public information and service delivery where the relevant processing is justified.

Information should not be used for a materially different purpose without an appropriate lawful basis and any additional notice or permission required by applicable law.

Lawful and fair processing

Personal information should be processed lawfully, fairly, transparently and for specified, explicit and legitimate purposes. The information processed should be relevant and limited to what is necessary for those purposes.

Depending on the particular activity and applicable law, processing may rely on consent, steps requested before entering into a contract, performance of a contract, a legal obligation, a legitimate interest where permitted, or another recognised lawful basis.

Where processing relies on consent, you may withdraw that consent where the law permits. Withdrawal does not automatically invalidate processing that lawfully occurred before withdrawal, and another lawful basis may apply to information that must be retained.

Where consent is not the applicable lawful basis, a request to withdraw consent does not necessarily stop all processing. The response depends on the purpose, applicable law and any continuing legal obligations.

When information may be shared

Personal information is not intended to be disclosed indiscriminately. Where necessary and legally permitted, information may be shared with appropriate recipients, including:

• Authorised personnel: individuals who need access to perform their assigned duties.
• Service providers: providers supporting website hosting, communications, security, maintenance or other authorised operations.
• Professional advisers and auditors: where relevant to an authorised purpose and subject to applicable confidentiality and legal requirements.
• Public authorities and regulators: where disclosure is required or otherwise permitted by law.
• Other relevant parties: where disclosure is necessary to provide a requested service, protect rights or address a legitimate and lawful matter.

Where appropriate, service providers should be subject to contractual, confidentiality and security requirements suited to the information they handle.

We do not describe any particular third party as a recipient unless that arrangement is actually in place and has been verified.

Information security

Protecting personal information requires appropriate technical and organisational safeguards. Measures should be selected according to the type of information, potential risks and nature of the processing.

Depending on the systems involved, safeguards may include:

• Access controls and appropriate user permissions.
• Secure communication and data transmission practices.
• Software updates, monitoring and vulnerability management.
• Appropriate backup and recovery procedures.
• Staff awareness, confidentiality measures and operational controls.
• Incident assessment and response procedures.

No website, electronic transmission or storage system can be guaranteed to be completely secure. You should avoid sending passwords, PINs, one-time verification codes or unnecessary sensitive documents through public forms or ordinary email.

If you suspect that information relating to you has been compromised, contact the SACCO through an official communication channel so that the concern can be assessed.

How long information is retained

Personal information should be retained only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, regulatory, contractual, audit and dispute-related requirements.

Retention periods may differ between routine enquiries, application records, membership information, financial records, security logs and other categories of information.

When information is no longer required, it should be securely deleted, anonymised or otherwise disposed of in accordance with the applicable retention and disposal procedures, unless continued retention is lawfully required.

Your privacy rights

Subject to applicable law, verification requirements and any lawful exceptions, you may have rights relating to your personal information, including the right to:

• Be informed about the collection and use of your personal information.
• Request access to personal information held about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of information where the law provides for it.
• Object to certain forms of processing where applicable.
• Request restriction of processing in circumstances recognised by law.
• Withdraw consent where consent is the relevant lawful basis.
• Exercise any applicable right to data portability or other statutory protection.
• Raise a concern with the relevant data-protection authority where appropriate.

To make a request, contact EPZA SACCO through its official contact channels and describe the information or processing activity concerned. We may need to verify your identity or authority before responding.

Requests will be assessed in accordance with applicable law. Some information may need to be retained, or a request may be limited, where a lawful exception or continuing obligation applies. Where permitted, an explanation will be provided.

Cookies and similar technologies

Cookies are small files that a website may store on your device. Similar technologies may be used to support functionality, remember preferences, improve performance or understand website usage.

Essential technologies

Certain technologies may be necessary for website security, session management, navigation or other essential functions.

Optional technologies

Where analytics, personalisation or other non-essential technologies are enabled, their use should be explained through an appropriate notice or consent mechanism where required by law.

You can review the cookie settings available on the website and may also be able to manage cookies through your browser. Disabling certain cookies may affect some website features.

This section describes possible uses of cookies; it does not assert that every category of cookie or analytics tool is currently deployed on this website.

External websites and third-party services

The website may contain links to external websites, payment facilities, portals or services operated by other organisations. Following an external link may take you to a service governed by a separate privacy policy and terms of use.

We encourage you to review the applicable notices before providing personal information to an external service. The privacy practices of external websites are governed by their respective operators and applicable law.

The presence of a link should not be treated as a guarantee of the external service's availability, security or privacy practices.

Children's and other protected information

Where a service involves information relating to a child or another person who may require additional protection, the collection and processing of that information must follow the applicable legal requirements and the safeguards appropriate to the service.

A person submitting information on behalf of another individual should have the necessary authority to do so and should provide only information that is legitimately required for the relevant purpose.

If you believe personal information has been submitted improperly through this website, please contact the SACCO through an official channel.

Storage and international transfers

Information may be handled by systems or service providers whose infrastructure is located in different places. Where personal information is transferred outside Kenya, the transfer must meet the applicable legal requirements, including any required safeguards or authorisations.

The actual locations, service providers and transfer arrangements depend on the systems and services in use. No particular international transfer is implied by this general statement.

Changes to this Privacy Policy

This policy may be updated when website features, services, legal requirements or information-handling practices change. The latest version will be published on this page when updates are made.

Where required by law, material changes will be communicated through an appropriate method. You should periodically review this page to remain informed.

Contact us about privacy

If you have a question, access request, correction request or concern about personal information handled through the website, please contact EPZA SACCO through its official communication channels.

If your concern is not resolved, you may consider seeking guidance from the relevant Kenyan data-protection authority, subject to the applicable procedures.