Privacy policy and data protection notice

Last updated: October 2026

Tumsifu Sacco Society Ltd ("Tumsifu SACCO", "we", "us") respects your privacy. This policy explains what personal data we collect through this website and when you join or deal with the SACCO, why we collect it, who we share it with, how long we keep it and the rights you have under the Data Protection Act, 2019 of Kenya.

Tumsifu SACCO is the data controller for the personal data described here. You can reach us at Karen Community Church, Ngong View Road, Nairobi, by email at info@tumsifusacco.co.ke or by phone on +254 732 834878.

1. What we collect

Through this website. This website is for information. It does not ask you to log in and does not use advertising or tracking cookies. We only collect personal data when you choose to send it to us:

• Contact form: your name, phone number, email address, the topic you choose and your message.
• Emails and calls: the details you share when you write to us or call us.
• Technical data: like any website, our hosting provider automatically records basic technical details such as your IP address, browser type and the pages visited, to keep the site secure and working.

When you become a member. When you join or use our services, we collect the details on our forms, including your name, national ID number, KRA PIN, date of birth, contact details, passport photo, next of kin and beneficiaries (nominees), employment and income details where needed for a loan, your savings, share and loan records, and the details of guarantors. For a Junior Account we collect the child's basic bio-data and the guardian's details.

The Members Portal is a separate service run on the SACCO's management system. When you log in there, that system handles your data under the terms shown on the portal.

2. Why we use it

We use personal data only for clear purposes, and on a lawful basis under the Data Protection Act, 2019:

• To answer your enquiry or complaint, based on your consent, which you give when you send the contact form.
• To run your membership: registering you, recording your deposits, share capital and Christmas or Junior savings, processing and recovering loans, and paying out benefits to your nominees. This is necessary to perform our contract with you.
• To meet our legal duties, such as keeping proper accounts, annual audits, reporting to the authorities that regulate co-operative societies and SACCOs, tax, and preventing fraud and money laundering.
• To keep members informed about meetings such as the AGM, changes to products and important notices, as part of our legitimate interest in running the SACCO well.

We do not sell personal data, and we do not use it for marketing by other organisations.

3. Who we share it with and how long we keep it

Only authorised officials and staff who need your data for their work can see it. We share personal data only where necessary:

• with the providers of our SACCO management system, website hosting and email, who process it on our instructions and must keep it secure;
• with banks and mobile money providers (such as M-Pesa) to process payments and loan disbursements;
• with our external auditors, and with regulators, courts or government authorities where the law requires it;
• with your guarantors, or the members you guarantee, to the extent needed to manage a loan; and
• with your nominees or legal representatives when benefits are paid out.

We store records at our office and in our management system, and protect them with access controls, passwords and secure storage. We keep enquiries sent through this website for up to 12 months after we have dealt with them, unless they become part of your member records. We keep member, savings and loan records for as long as you are a member and afterwards for as long as the law requires for financial and tax records. When data is no longer needed, we delete or destroy it securely.

4. Your rights

Under the Data Protection Act, 2019, you have the right to:

• be told how your personal data is used, as set out in this policy;
• see the personal data we hold about you and get a copy of it;
• have inaccurate or incomplete data corrected;
• have data deleted where it is false, misleading or no longer needed, unless the law requires us to keep it;
• object to the use of your data, or withdraw your consent, at any time; and
• receive your data in a format you can take elsewhere, where this applies.

To use any of these rights, write to info@tumsifusacco.co.ke, call +254 732 834878 or visit the office. We may ask you to confirm your identity first. We will respond as soon as we can, within the time the law allows. Some requests, such as deleting loan records, may be limited while you have an active loan or where the law requires us to keep records.

If you are not satisfied with how we handle your data, you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

5. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.