Privacy Policy
Privacy Policy
Qona Sacco Limited ("Qona Sacco", "we", "us", or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, store, and share your information when you use our mobile applications — the Qona Sacco Banking App and the Qona Sacco Onboarding App — as well as any related services we provide.
By downloading, installing, or using our mobile applications, you agree to the collection and use of your information in accordance with this policy.
Information We Collect
Personal Details
We collect personal information that you provide during registration, onboarding, or while using our services. This may include:
- Full name
- National ID number or passport number
- Date of birth
- Phone number
- Email address
- Physical address and postal address
- Employment details and employer information
- Next of kin and beneficiary information
- Photographs and ID document scans (for KYC verification)
Location Data
Our apps may request access to your device's GPS or network-based location services. We collect map location data to:
- Verify your geographical location during onboarding and account opening
- Enhance security and fraud prevention for banking transactions
- Help you locate the nearest Qona Sacco branches and ATMs
Device & Usage Information
We may automatically collect certain information about your device, including:
- Device type, model, and operating system
- Unique device identifiers
- App version and usage statistics
- IP address and network information
Financial Information
Through the Qona Sacco Banking App, we may collect and process:
- Account balances and transaction history
- Loan application details and repayment records
- M-Pesa and other mobile money transaction details
How We Use Your Information
We use the information we collect for the following purposes:
- To process membership registration and onboarding via the Qona Sacco Onboarding App
- To provide banking services including account management, loans, deposits, and withdrawals via the Qona Sacco Banking App
- To verify your identity and comply with Know Your Customer (KYC) requirements
- To detect and prevent fraud, unauthorized access, and other security threats
- To communicate with you about your account, transactions, and Sacco announcements
- To improve our apps, services, and customer experience
- To comply with legal and regulatory obligations, including SASRA requirements
Data Sharing & Disclosure
We do not sell your personal information. We may share your data only in the following circumstances:
- Service Providers: Trusted third-party vendors who assist us in operating our apps and providing services (e.g., payment processors, SMS gateways)
- Regulatory Authorities: Government agencies, SASRA, or law enforcement when required by law or regulation
- Credit Reference Bureaus: For credit assessment and reporting as required by applicable regulations
- With Your Consent: When you have given explicit permission for specific data sharing
Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit and at rest
- Secure authentication mechanisms including PIN and biometric access
- Regular security assessments and monitoring
- Access controls limiting data access to authorized personnel only
Data Retention
We retain your personal data for as long as your account remains active and as required to fulfil the purposes outlined in this policy. We may also retain data for a reasonable period after account closure to comply with legal, regulatory, and audit obligations.
Your Rights
In accordance with the Kenya Data Protection Act, 2019, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of your personal data, subject to legal and regulatory requirements
- Object to the processing of your data in certain circumstances
- Withdraw consent where processing is based on consent
To exercise any of these rights, please contact us using the details provided below.
App Permissions
Our mobile applications may request the following device permissions:
- Location: To capture your map location for verification and security purposes
- Camera: To capture photographs and scan identification documents during onboarding
- Storage: To save and upload required documents
- Phone: For automated verification and security features
- Biometrics: For secure app authentication
You may manage these permissions through your device settings at any time. Disabling certain permissions may limit the functionality of the apps.
Face Data and Biometric Information
To enhance identity verification, fraud prevention, and security, our application may collect and process facial images or face-related data when you choose to use features that require identity authentication.
What Face Data We Collect
We may collect:
- Facial photographs or selfies submitted by users during registration or verification processes
- Face-matching results generated during identity verification
- Metadata necessary to support the verification process
How We Use Face Data
Face data is used solely for:
- Identity verification and Know Your Customer (KYC) requirements
- Fraud detection and prevention
- Account security and authentication
- Compliance with applicable legal and regulatory obligations
Data Sharing
Face data is not sold, rented, or used for advertising purposes. Face data may be shared only with:
- Authorized identity verification service providers acting on our behalf
- Regulatory, law enforcement, or government authorities where required by law
- Service providers that support security and compliance functions under appropriate confidentiality and data protection obligations
Data Retention
Face data is retained only for as long as necessary to fulfill the purposes outlined above, comply with legal or regulatory requirements, resolve disputes, and enforce our agreements. Once no longer required, the data is securely deleted or anonymized.
Data Security
We implement appropriate technical and organizational measures to protect face data from unauthorized access, disclosure, alteration, or destruction. These measures include encryption, access controls, monitoring, and secure storage practices.
User Rights
Subject to applicable laws, you may:
- Request access to your face data
- Request correction of inaccurate information
- Request deletion of your face data where legally permissible
- Withdraw consent for future processing where consent is the legal basis for processing
No Sale of Biometric Data
We do not sell, lease, trade, or otherwise profit from users' face data or biometric information.
Consent
By using features that require facial verification, you acknowledge and consent to the collection, use, storage, and processing of your face data as described in this Privacy Policy.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes through the app or via other communication channels. Your continued use of the apps after such changes constitutes your acceptance of the updated policy.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:
- Qona Sacco Limited
- Email: info@qonasacco.com
- Website: www.qonasacco.com
