Data protection notice
1. Our approach
SaccoSphere is built around the Data Protection Act 2019 from the architecture up, not as a policy layered on afterward: per-tenant data isolation, consent tracking, and managed retention and erasure workflows run underneath every SACCO on the platform.
2. Lawful basis
Personal data is processed under a SACCO’s own lawful basis for serving its members (contractual necessity and legal/regulatory obligation), with explicit consent sought for anything beyond that — for example, cross-SACCO guarantor or credit-signal features a member opts into.
3. Retention
Retention periods follow each SACCO’s regulatory obligations (including CBK/SASRA transaction-record expectations). Retention rules are configured per data category, not as a single blanket period.
4. Erasure requests
A documented erasure workflow logs every request, applies it within the active retention window, and records the outcome for audit — erasure is never a silent, untracked database delete.
5. Cross-border transfer
Infrastructure is hosted with providers capable of meeting the Data Protection Act’s cross-border transfer requirements; specifics are available on request.
6. Registering as a data controller/processor
ODPC registration is in progress — see the licences table on our Security & compliance page for current status.
7. Exercising your rights
Contact anthony@saccosphere.co.ke, or your SACCO directly as the data controller for your membership.