Data Protection

pawa Loans is built for Kenyan SACCOs, chamas, and microfinance groups, so data protection here is approached under Kenya's Data Protection Act, 2019, the law that governs how personal data is collected, processed, and protected in Kenya, rather than a foreign framework like the EU's GDPR (though the two share very similar principles, and this page follows the same structure a GDPR-style notice would).

1. Controller and processor, who's responsible for what

Under the Act, a data controller decides why and how personal data is processed; a data processor processes it on the controller's instructions. This distinction matters for how pawa Loans actually works:

Practically, this means: if you're a member and want to know what data your SACCO holds on you, that request goes to your SACCO first, they control the record. If you're a SACCO administrator, pawa Loans processes your members' data strictly according to your organisation's own instructions and configuration.

2. Your organisation's own obligations

If your SACCO or chama collects and processes members' personal data (which every SACCO does, by definition), you may have your own obligations under the Act as a data controller, including registering with the Office of the Data Protection Commissioner (ODPC) where required, and ensuring you have a lawful basis for collecting your members' information. pawa Loans gives you the tools to process that data securely, but registration and lawful-basis obligations that attach to your organisation specifically are yours to meet, the same way they would be if you used any other system, or a spreadsheet.

3. Data subject rights

The Data Protection Act gives individuals (data subjects) rights over their own personal data, broadly similar to GDPR's rights. Depending on your role, these include the right to:

• Be informed of how your data is being used.
• Access the personal data held about you.
• Request correction of inaccurate or outdated data.
• Request deletion of your data, subject to any legal or regulatory retention requirement (for example, financial records a SACCO must keep for audit purposes).
• Object to processing in certain circumstances.
• Data portability, receiving your data in a usable format.

For member data, these requests are directed to your SACCO or chama as the controller. pawa Loans supports businesses in fulfilling them, member records, statements, and documents are retrievable and exportable within the platform for exactly this reason.

4. Lawful processing

Personal data on pawa Loans is processed for specific, legitimate purposes tied to running a SACCO or chama, membership administration, savings and loan management, statutory and regulatory reporting, and communicating with members about their own accounts, not for unrelated purposes.

5. Security measures

Access to the platform is role-based, staff only see what their role requires, and member-facing access is separately authenticated so members can only ever reach their own account. Significant actions are recorded in an audit trail. These are organisational and technical measures in the spirit of the Act's requirement to implement appropriate safeguards against unauthorised access, loss, or disclosure.

6. International transfers

pawa Loans is built for the Kenyan market. Where any data is processed by an infrastructure or service provider outside Kenya (for example, cloud hosting), we expect that provider to maintain protections consistent with the Act's requirements for cross-border transfers.

7. Data breach notification

In the event of a data breach likely to result in real risk to affected individuals, we are committed to notifying affected businesses without undue delay, consistent with the Act's breach notification expectations, so they can in turn meet their own notification obligations to their members and, where required, the ODPC.

8. Questions or requests

For questions about how pawa Loans handles data protection, or to make a request related to your own account, info@pawaloans.co.ke. If you're a member with a question about your own data specifically, please start with your SACCO or chama, they control your record.