Privacy notice

Elite Savings and Credit Cooperative Society Limited, of [registered office address], registration [society registration number], is the data controller for the personal data described here. Our Data Protection Officer can be reached at [[email protected]].

• Identity data — your name, member number and National ID number, used to confirm it is you before we grant access to an account.
• Contact data — the mobile number registered to your membership, used to send one-time verification codes and account notices.
• Authentication data — your PIN and any one-time codes, which we store only as irreversible cryptographic hashes and never in a readable form.
• Account and transaction data — your savings, contributions, loans and repayments.
• Security logs — the date, time, outcome and originating IP address of sign-in and account recovery attempts.

We process identity, contact and authentication data to perform the membership contract between you and the SACCO, and to meet our legal obligations as a licensed cooperative society — including the record-keeping and anti-money-laundering duties placed on us by Kenyan law.

We process security logs in our legitimate interest in keeping member funds safe: detecting attempts to break into accounts, and being able to investigate afterwards if one succeeds.

We do not sell your personal data, and we do not share it for marketing. We disclose it only to service providers acting on our instructions — such as the SMS gateway that delivers your one-time codes — and to regulators, auditors or law enforcement where we are legally required to.

Membership and transaction records are retained for as long as you are a member and for the period afterwards that cooperative and tax law requires. Security logs are kept for a limited period sufficient to investigate account compromise, then deleted. One-time codes are discarded as soon as they are used or expire, whichever is first.

• PINs and one-time codes are hashed with a memory-hard algorithm (Argon2id) — we cannot read them, and neither can anyone who obtains a copy of our database.
• Your session is held in a cookie that JavaScript cannot read, which limits what an injected script could steal.
• Repeated failed sign-in attempts lock the account for a period, and code requests are rate limited.
• Access to member records inside the SACCO is restricted to staff whose role requires it, and is logged.

Under the Data Protection Act, 2019 you may ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct data that is inaccurate or incomplete;
• delete data we no longer have a lawful reason to keep;
• stop or restrict a particular use of your data; and
• transfer your data to another organisation where that is technically feasible.

Write to [[email protected]] to make a request. We will respond within the statutory period. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner.