Privacy Policy

SaccoWorks ("we", "us", or "our"), a cloud-based Sacco management software built and operated by eLivecode Solutions Limited, is committed to protecting the privacy of our clients (Saccos, Cooperatives, and Micro-Finance Institutions) and their individual members.

This Privacy Policy explains how we collect, use, process, and safeguard information when you use our multi-tenant SaaS platform, websites, and associated services. By accessing or using SaccoWorks, you consent to the data practices described in this policy.

We process data in two capacities:

• As a Data Controller: We collect business contact details, billing details, and login credentials from Sacco administrators and staff to manage subscriptions and accounts.
• As a Data Processor: We host and process member data uploaded by the Sacco. This includes member names, national IDs, phone numbers, email addresses, share/contribution records, loan details, and transaction history.

We also collect usage metadata, IP addresses, browser information, and transaction log data (such as Safaricom M-Pesa API response logs) to ensure system reliability and security.

We use the processed information to:

• Provide, maintain, and improve the SaccoWorks platform features (such as BOSA, FOSA, and loan processing).
• Execute real-time Safaricom M-Pesa payment integrations (STK Push, C2B deposit alerts, and B2C disbursements) and auto-reconciliation.
• Generate reports and dashboards required for regulatory compliance, including compliance with the Sacco Societies Regulatory Authority (SASRA).
• Send system notifications, SMS alerts, and transaction confirmations to cooperative members on behalf of the Sacco.
• Investigate and resolve support requests, technical issues, and system bugs.

Security is at the core of SaccoWorks. We implement robust technical and organizational measures to protect your data:

• Encryption: All data is encrypted in transit using Transport Layer Security (TLS) and at rest using industry-standard AES-256 encryption.
• Infrastructure Security: SaccoWorks is hosted in secure, ISO-certified data centers with 24/7 monitoring, redundant firewalls, and automatic backups.
• Multi-Tenancy Isolation: Data from each Sacco is logically separated at the database level to prevent cross-tenant access.
• Access Controls: System access is restricted based on user roles and permissions set by the Sacco administrators. Support staff access is strictly audited and limited.

SaccoWorks and eLivecode Solutions Limited comply fully with the **Kenya Data Protection Act 2019**. We process personal data in accordance with the principles set out in the Act:

• Personal data is processed lawfully, fairly, and in a transparent manner.
• Data is collected for explicit, specified, and legitimate purposes (Sacco management and compliance).
• We minimize data collection to what is necessary for our operational services.
• We maintain audit trails to track data modifications, supporting SASRA compliance guidelines.

We do not sell, rent, or trade your personal data. We only share information with third-party service providers under strict data processing agreements as necessary to deliver services:

• Telecom Providers: Safaricom (M-Pesa integrations) and SMS gateway providers to send transaction alerts.
• Cloud Service Providers: Secure hosting and database service providers who process data strictly under our instructions.
• Legal Obligations: When required by Kenyan law, court order, or regulatory bodies such as SASRA.

We retain Sacco and member data only for as long as the Sacco maintains an active subscription with SaccoWorks. Upon termination of service:

• We provide a comprehensive data export (CSV/SQL formats) to the Sacco administration.
• Data is permanently deleted from our primary databases within 90 days of contract termination, subject to any legal or regulatory record-keeping requirements (e.g. anti-money laundering regulations).

Under the Kenya Data Protection Act 2019, individual members have the right to request access to their personal data, correct inaccurate details, or request deletion/rectification.

Since SaccoWorks processes member data on behalf of the Sacco, members should submit data rights requests directly to their respective Sacco administration. We will support the Sacco in fulfilling these requests.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us at: