Privacy Policy - BUDDU CBS PEWOSA SACCO LTD

Privacy Policy

BUDDU CBS PEWOSA SACCO LTD

Introduction

We, BUDDU CBS PEWOSA SACCO LTD, are a co-operative savings and credit society having our registered address at Plot 11c, Birch Avenue, Masaka City, P.O. Box 300 Masaka, Uganda ("BUDDU CBS PEWOSA SACCO LTD", "We", "Us", "Our").

BUDDU CBS PEWOSA SACCO LTD respects your right to privacy and processes personal information you provide in accordance with our Data Protection Policy, which complies with government requirements and the Data Protection and Privacy Act No. 9 of 2019.

We have prepared this Privacy Policy to explain how, why, and when we collect data from you.

Definitions and Interpretation

In this Policy, the following terms shall have the following meanings:

"Personal Data" means any and all data that relates to an identifiable person who can be directly or indirectly identified from that data. In this case, it means personal data that you give to us via our mobile app.

What Does This Policy Cover?

This Privacy Policy applies to visitors, employees, customers, prospective customers, and suppliers’ use of our mobile app.

Your Rights

As a data subject, you have the following rights which this Privacy Policy and our use of personal data have been designed to uphold:

  • 📌 The right to be informed about our collection and use of personal data.
  • 📌 The right of access to the personal data we hold about you.
  • 📌 The right to rectification if any personal data we hold about you is inaccurate or incomplete.
  • 📌 The right to be forgotten – i.e. the right to ask us to delete any personal data we hold about you.
  • 📌 The right to restrict (i.e. prevent) the processing of your personal data.
  • 📌 The right to data portability (obtaining a copy of your personal data to re-use with another service or organization).
  • 📌 The right to object to us using your personal data for particular purposes.
  • 📌 Rights with respect to automated decision-making and profiling.

We will consider all requests in respect of these rights. Please note, however, that certain personal information may be exempt from such requests in certain circumstances (e.g., if we must retain the data to comply with legal obligations or defend legal claims). If an exception applies, we will inform you when responding to your request. We may also request proof of identity before responding.

If you have any cause for complaint about our use of your personal data, please contact us using the details provided under the “How Can You Access Your Data” section and we will do our best to resolve it. If we are unable to help, you also have the right to lodge a complaint with the relevant government authority.

What Data Do We Collect?

When you register on this site or interact with our services, we may collect certain types of data to enable us to serve you better. We always aim to collect only the minimum data required to fulfill your request or enquiry.

📋 Personal Data

If you register, you may be asked to provide details such as:

  • Name
  • Address
  • Email address
  • Telephone number
  • Login details (username and password)

We only request this information if you want to use a service, make an enquiry, or discuss our products/services.

💻 Technical Data

We may automatically collect technical data necessary for you to use our app, including:

  • Internet Protocol (IP) address
  • Login information
  • Browser type
  • Information on how visitors interact with our app (collected anonymously)

🍪 Cookies & Sessions

Our app uses cookies and sessions — small files placed on your browser — to enhance your experience by remembering your preferences. This allows us to provide a more tailored experience in the future.

Detailed information about the cookies we use and their purposes can be found in our Cookie Policy when visiting our app.

How Do We Use Your Data?

If we collect personal data, it will be processed and stored securely, only as long as necessary for the purpose it was collected. We comply with our obligations and safeguard your rights under the DPDP Act at all times.

If you contact us or register on our APP, we may use your data in the following ways:

  • To receive and reply to your email
  • To contact you for legitimate business interests
  • To contact you about your account and our services
  • Service-related communications (subscription updates, reminders, APP comments)
  • To fulfill subscription orders and provide product information
  • To track traffic flows and improve usability of our APP
  • Planning and managing business activities via aggregated analysis
  • For APP maintenance, improvement, and technical support
  • To ensure the security of our APP
  • Recognize you on return visits and customize APP experience
  • Internal corporate reporting and business administration
  • Comply with legal obligations and establish, exercise or defend legal rights

We provide an unsubscribe option on all of our communications.

Legal Bases for Using Your Personal Information

We consider that the legal bases for using your personal information as set out in this Privacy Policy are as follows:

  • Necessary to perform our obligations under any contract with you (e.g., comply with the terms of use of our APP).
  • Necessary for complying with our legal obligations (e.g., for health and safety purposes).
  • Necessary for our legitimate interests or those of others (e.g., to ensure the security of our APP), including:
    • Run, grow and develop our business;
    • Operate our APP;
    • Carry out marketing, market research, and business development.

If we rely on our legitimate interests for using your personal information, we undertake a balancing test to ensure your interests or fundamental rights are not outweighed. We may process your personal data for marketing purposes on the basis of your consent, which you may withdraw at any time by contacting us at info@buddupewosacco.com. Withdrawing consent may affect our ability to provide certain services, e.g., e-mail marketing updates.

How Long Do We Keep Your Data?

BUDDU CBS PEWOSA SACCO LTD will not keep personal data longer than necessary for the purposes it was collected and to meet government obligations.

When personal data is no longer required, all reasonable steps will be taken to securely erase or otherwise dispose of it without delay, in accordance with law and regulations.

<

Children

Our APP and services are not directed at children and we do not knowingly collect any personal data from children.

If you are a child and we learn that we have inadvertently obtained personal data from you via Our APP, or from any other source, we will delete that information as soon as possible.

Please contact us at info@buddupewosacco.com if you are aware that we may have inadvertently collected personal data from a child.

Where Do We Store Your Data?

The data that we collect from you is stored securely within BUDDU CBS PEWOSA SACCO LTD resources and evaluated cloud infrastructure. It may also be processed within our HO, branches, or by our trusted suppliers.

By submitting your personal data, you agree to its transfer, storage, and processing. We ensure your data is treated securely in accordance with your rights and this Privacy Policy.

If you register for our alert service, we may need your name and email address. This information is stored securely and may be accessed by BUDDU CBS PEWOSA SACCO LTD staff for administration only. It will not be shared with third parties.

Risks and How We Keep Your Personal Data Secure

Data security is very important to us. We have implemented robust security procedures and technical measures to safeguard any data we hold, even if it is only your email address.

Access to internal servers is limited to specialized IT and Data personnel only.

While we take all precautions, data transmitted over the internet cannot be guaranteed fully secure. You acknowledge and accept that transmission is at your own risk.

You are responsible for keeping any password we provide or you choose for accessing your online account confidential.

How Can You Access Your Data? (Subject Access Request)

You have the right to request a copy of any personal data we hold about you. Currently, there is no fee for reasonable requests, though the bank reserves the right to charge for extensive copies.

We may require proof of identity before fulfilling your request.

Contact Information:

Do We Share Your Personal Data?

To provide services, we may share your personal data with BUDDU CBS PEWOSA SACCO LTD group companies, external suppliers, service providers, and subcontractors, including payment processors and insurers, some of whom may be outside the country.

We do not subscribe you to marketing emails without your consent.

Any third parties with whom we share your data are bound by privacy and security obligations consistent with this Privacy Policy and applicable laws. Vendors assisting with processing are not allowed to sell or give away your data.

Cookies

A cookie is a small data file stored on your computer to track activity. Our APP does not use cookies.

Links to Other APPs

We may provide links to other APPs which are outside our control. We are not liable for issues arising from their use of your information. Please review the privacy policies and terms of each APP provider to understand how your information may be processed.

Changes to Our Privacy Policy

We may update this Privacy Policy from time to time (e.g., if laws change). Any updates will be immediately posted on Our APP. Your first use of the APP following any changes constitutes acceptance of the updated terms. We recommend checking this page regularly to stay up-to-date.

This policy is publicly available and is part of the KCCB APP for easy access by visitors, data subjects, PII principals, or any interested parties.

Exception(s)

Any exceptions to this policy shall be documented, assessed, and communicated as follows:

  • Limitations due to legacy business applications or decency causing delays/non-patching of vulnerabilities; necessary workarounds or compensatory controls shall be implemented.
  • Such issues shall be reported as residual risks in the result of risk assessment if protection cannot be immediately applied, with risk acceptance by the process owner and management.
  • Any cyber incidents arising from such exceptions shall be recorded in the system and reported to management and regulatory authorities.

Non-compliance

Any deviation from the requirements of this policy shall be reported as non-compliance in the form of a nonconformity report, unless it has already been documented as an exception.