Policy Statement
RUPSA Sacco is committed to protecting the privacy and personal data of its members, employees, suppliers, business partners, and other stakeholders.
RUPSA Sacco respects the privacy of all individuals whose personal data it processes and is committed to collecting and using personal data only for lawful, legitimate, and clearly defined purposes. The Sacco shall not disclose personal data to unauthorized persons and shall take reasonable measures to protect individual privacy at all times.
Data Protection Principles
The Society shall process personal data in accordance with the following principles:
Personal data shall be processed lawfully, fairly and in a transparent manner.
Personal data shall be collected only for specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those purposes.
Personal data collected shall be adequate, relevant and limited to what is necessary for the intended purpose.
Personal data shall be accurate and kept up to date.
Reasonable steps shall be taken to correct or delete inaccurate information.
Personal data shall be retained only for as long as necessary to fulfil the purpose for which it was collected or as required by law.
Appropriate technical and organisational measures shall be implemented to protect personal data against unauthorized access, loss, misuse, alteration or disclosure.
The Sacco shall be accountable for compliance with the Data Protection Act, 2019 and shall demonstrate such compliance where required.
Personal Data Collected
RUPSA Sacco collects and processes personal data that is necessary for its business operations, service delivery, customer engagement, contractual obligations, and legal compliance.
The personal data collected may include:
Names and other identification details.
Postal and physical addresses.
Telephone and Mobile numbers.
Email addresses.
Employment and professional information.
Business location.
KRA PIN and other information required for business transaction.
Images, audio and video recordings where applicable.
Website usage information, including cookies & online identifiers.
Any other information voluntarily provided to RUPSA Sacco through its various channels.
Sources
Personal data may be collected directly from data subjects through the following channels:
Sacco Websites and Digital Platforms: Personal data may be collected when individuals visit, register, submit enquiries, complete forms, or interact with RUPSA Sacco’ websites and digital platforms.
Events and Training Programmes: Personal data may be collected from individuals who voluntarily register for Education workshops, elections, webinars, exhibitions, training programmes, and other events organized or supported by RUPSA Sacco.
Official Communication Channels: Personal data may be collected through emails, letters, telephone calls, social media platforms, customer service interactions, online chats, WhatsApp Business, invoices, delivery documents, quotations, and other official communication channels.
Customer Surveys and Feedback: Personal data may be collected through surveys, questionnaires, feedback forms, and research activities conducted by RUPSA Sacco. Participation in such activities shall be voluntary and individuals shall be informed of the purpose for which the information is being collected.
Employment and Human Resource Processes:Personal data may be collected from employees, job applicants, interns, consultants, and contractors during recruitment, onboarding, employment administration, and related human resource processes.
Visitor Registration and Access Control Records: Personal data may be collected from visitors, contractors, suppliers, customers, and other individuals who access RUPSA Sacco’ premises. Such information may be collected through visitor registration books, access control systems, security registers, reception records, or other visitor management processes. The information collected may include names, identification document details, organization, contact information, vehicle registration details where applicable, purpose of visit, person being visited, and the date and time of entry and exit. This information is collected for security, safety, access control, and business continuity purposes.
Personal Data Not Intentionally Collected
RUPSA Sacco does not intentionally collect or process personal data that is not necessary for its legitimate business purposes or legal obligations.
The Sacco does not request or require individuals to provide:
Personal identification numbers (PINs) used to access private accounts.
Passwords for personal accounts.
Credit or debit card numbers unless processed through an authorised and secure payment service provider.
Any other information that is not relevant to the purpose for which personal data is being collected.
Use of Personal Data
RUPSA Sacco uses personal data for legitimate business purposes and in accordance with Data Protection Act, 2019 and applicable Regulations.
Personal data may be used for the following purposes:
To provide products and services to customers and other stakeholders.
To process loans, payments, deliveries, and other business transactions.
To communicate with members, suppliers, employees, and other stakeholders regarding products, services, enquiries, contracts, and business operations.
To improve products, services, websites, applications, and customer experience.
To conduct research, surveys, and business analysis for planning and decision-making purposes.
To maintain the security of Sacco systems, facilities, personnel, and information assets.
To comply with legal, regulatory, contractual, and reporting obligations.
To investigate and prevent fraud, misuse of systems, security incidents, and unlawful activities.
To send information about products, services, events, promotions, and other business-related communications.
Personal data shall not be used for purposes that are incompatible with the purpose for which it was originally collected unless permitted with the consent of the data subject.
Third Party Service Providers
RUPSA Sacco may engage third-party service providers to support its operations, including website hosting, application hosting, email services, messaging services, payment processing, logistics, and other business functions.
Where personal data is shared with third-party service providers, RUPSA Sacco shall ensure that appropriate contractual, technical, and organizational safeguards are in place to protect such data and ensure compliance with Data Protection Act, 2019.This may include a Data Processing Agreement (DPA).
The Society may disclose personal data where required by law.
External Websites
The Sacco’s websites and digital platforms may contain links to external websites operated by third parties. RUPSA Sacco is not responsible for the privacy practices, content, or security of such websites. Individuals are encouraged to review the privacy policies of external websites before providing personal information.
The Society’s website and digital platforms may use cookies and similar technologies to improve functionality, enhance user experience and analyse website usage.
Users may manage cookie preferences through their browser settings.
Lawful Basis for Processing Personal Data
i. RUPSA Sacco shall process personal data only where there is a lawful basis for doing so
Such lawful bases may include:
a) Consent of the data subject.
b) Performance of a contract.
c) Compliance with a legal obligation.
d) To protect the life, health, safety, or well-being of an individual where necessary.
e) Performance of a task carried out in the public interest.
f) Legitimate interests pursued by RUPSA Sacco, provided such interests do not override the rights and freedoms of the data subject.
ii. Where processing is based on consent, the data subject shall have the right to withdraw consent at any time, subject to applicable legal and contractual requirements.
iii. Where consent is relied upon as the lawful basis for processing personal data, the Society shall ensure that consent is freely given, specific, informed and unambiguous.
iv. Data subjects may withdraw consent at any time by notifying the Society.
v. Withdrawal of consent shall not affect the lawfulness of processing undertaken before the withdrawal.
vi. The Society shall only process personal data relating to minors, where permitted by law and where appropriate consent has been obtained from a parent or legal guardian.
vii. Where a minor is named as a beneficiary, nominee or dependant, only the minimum personal data necessary shall be collected and processed.
Rights of Data Subjects
RUPSA Sacco recognizes and shall uphold the rights of data subjects as provided under the Data Protection Act, 2019.
These rights include:
The right to be informed about the collection and use of personal data.
The right to access personal data held by RUPSA Sacco.
The right to request correction of inaccurate or incomplete personal data.
The right to object to the processing of personal data.
The right to request deletion of personal data where applicable.
The right to withdraw consent where processing is based on consent.
The right to data portability where applicable.
The right to lodge a complaint with the Office of the Data Protection Commissioner.
Data Retention and Disposal
Personal data shall be retained only for as long as necessary to fulfil the purpose for which it was collected, meet legal and regulatory obligations, resolve disputes, and enforce contractual rights.
Where personal data is no longer required, RUPSA Sacco shall securely destroy, delete, anonymize, or archive the information in accordance with its Records Management and Archiving procedures.
Information Security
RUPSA SACCO shall implement appropriate administrative, physical and technical measures to safeguard personal data against unauthorized access, alteration, disclosure, loss or destruction.
Cross-Border Transfer of Personal Data
i. RUPSA Sacco may transfer personal data outside Kenya where it is necessary for business operations, service delivery, cloud hosting, communication services, or other legitimate purposes.
ii. Any transfer of personal data outside Kenya shall be undertaken in accordance with the Data Protection Act, 2019. RUPSA Sacco shall ensure that appropriate safeguards are in place to protect the privacy, confidentiality, integrity, and security of personal data.
iii. Where required by law, the Sacco shall obtain the necessary approvals, contractual safeguards, or consent from the data subject before transferring personal data outside Kenya.
Amendments to this Statement
RUPSA Sacco reserves the right to amend this privacy and security statement at any time. All amendments to this privacy and security statement will be posted on www.rupsasacco.com. Unless otherwise stated, the current version shall supersede and replace all previous versions of this privacy and security statement
July 07/2026 | RUPSA SACCO