1. Overview & Scope
Kanzu Finance Limited ("KFL", "we", "our") operates payment system infrastructure and software platforms (including Kanzu Banking). This Privacy Notice explains how we collect, process, store, and protect personal data belonging to our institutional clients, their members/end users, direct platform users, and prospective applicants.
All processing of personal data is carried out in strict compliance with the Uganda Data Protection and Privacy Act 2019 (DPPA) and the Data Protection and Privacy Regulations 2021.
2. Personal Data We Collect
We collect only the personal data strictly necessary to deliver secure, reliable payment and core banking services:
- Identity Data: Full legal name, National Identification Number (NIRA-verified), date of birth, photo/ID copies, and business registration details for institutional representatives.
- Contact Data: Mobile phone number, physical address, and email address.
- Financial & Transaction Data: Mobile money wallet identifiers (MTN MoMo, Airtel Money), bank account details (Housing Finance Bank, Stanbic Bank), transaction history, loan records, wallet balances, and transaction limits.
- KYC & AML Compliance Data: Source-of-funds declarations, sanctions and watchlist screening results, customer risk ratings, and Due Diligence documentation required by regulatory authorities.
- Technical & System Data: IP addresses, mobile network identifiers (MSISDN), USSD session logs, device identifiers, and platform access logs.
3. Lawful Bases for Processing
We process personal data only where a valid legal basis exists under the DPPA:
- Performance of a Contract: To provision accounts, execute payment flows, and process financial transactions requested by you or your institution.
- Legal Obligation: To comply with statutory requirements under the National Payment Systems Act 2020, Anti-Money Laundering Act 2013, and Bank of Uganda directives.
- Legitimate Interests: To maintain network security, prevent fraud, and ensure overall payment system availability.
- Consent: For optional features, analytics, or direct marketing communications (which can be withdrawn at any time).
4. Data Security & Cross-Border Hosting
- Encryption Standards: All personal data is encrypted at rest using AES-256 (including application-layer field encryption for sensitive identity numbers) and in transit across all channels using TLS 1.2 or higher.
- Hosting & International Transfers: KFL's primary production cloud infrastructure is hosted in Amazon Web Services (AWS). Transfer and processing in this region are secured under AWS's standard contractual safeguards and Data Processing Addendum in full compliance with section 19 of the DPPA 2019.
- Third-Party Disclosure: Personal data is never sold or shared with third parties for marketing purposes. Data is shared only with verified settlement/telecom/bank partners (MTN, Airtel) necessary to execute transactions or verify identities.
5. Data Retention
Personal data is retained in accordance with statutory requirements and KFL's Master Data Retention Schedule (KFL-DAT-POL-001 Annex A):
- Transaction, KYC, and Customer Records: Retained for 10 years following account closure or transaction completion, as mandated by Section 10 of the Anti-Money Laundering Act 2013 and National Payment Systems requirements.
- Support & Complaint Records: Retained for 3 years following final resolution.
- Secure Disposal: Upon expiry of mandatory retention periods, data is permanently erased using cryptographic or secure electronic deletion procedures.
6. Contact Us & Data Protection Officer
For any inquiries, to exercise your privacy rights, or to report a privacy concern, please contact:
- General Privacy Contact: privacy@kanzufinance.com
- Data Protection Officer (DPO): Risk & Compliance Officer (dpo@kanzufinance.com)
- Regulatory Oversight: You also have the right to lodge a complaint with the Personal Data Protection Office (PDPO) of Uganda.