Privacy notice

This notice explains how Oppi Technologies Limited handles personal data in ChamaBook under the Kenya Data Protection Act, 2019. It applies to everyone whose data is held in ChamaBook: members and officials of chamas, welfare groups, investment groups, SACCOs and every other kind of group that uses it, people who apply to register a group or contact us, and our own staff accounts.

Introduction

ChamaBook is a record-keeping and payments platform for groups, operated by Oppi Technologies Limited, Westlands, Nairobi, Kenya.

Your group is the data controller for its members' records: it decides what is collected and why. Oppi Technologies Limited acts as its data processor, and is the controller for platform accounts, security logs and registration requests.

Information we collect

  • Identity and contact: name, phone number and email address.
  • Identity checks (KYC): ID or passport number, date of birth, KRA PIN, address, next of kin, ID photos and a selfie, when your group asks for them.
  • Financial records: contributions, loans, guarantees, merry-go-round turns, fines, dividends, payouts and M-PESA or bank references.
  • Security records: sign-in history, device and IP address, two-step sign-in events and one-time code requests.
  • Registration requests: the contact details you give when you ask us to set up a group or send us a message.

How we use your information

  • To keep your group's books and run its savings, loans and payouts (performance of your membership agreement).
  • To verify identity and prevent fraud (your consent, recorded when you submit KYC, and legitimate interest).
  • To keep financial records for as long as the law requires (legal obligation).
  • To send receipts, reminders and security messages (performance of the agreement).
  • To send news and offers, only if you opt in. You can opt out at any time in your profile.

Cookies and similar technologies

ChamaBook uses essential cookies to keep you signed in and, if you choose, to remember a trusted device for 30 days. Your language and theme choices are stored on your device. We don't use advertising or tracking cookies.

How we protect your data

ID numbers, dates of birth, KRA PINs, addresses, next of kin and identity documents are encrypted at rest. Documents can be opened only by reviewers and every view is logged. Connections are encrypted, officials sign in with authenticator apps, and every money movement needs a fresh confirmation. The group ledger can't be edited, and its integrity is checked every night.

Who we share it with

  • Officials of your group see what their role needs. Other members see the group's ledger with names hidden unless the group chooses full transparency.
  • Payment providers (Safaricom M-PESA, Airtel Money and banks) process the payments you make or receive.
  • Messaging providers deliver SMS and email on our behalf.
  • Hosting and security providers that store and protect the service, under data processing agreements.
  • Authorities, only when the law requires it.

We don't sell personal data.

Transfers outside Kenya

Where a provider stores or processes data outside Kenya, we do so only with the safeguards sections 48 to 50 of the Data Protection Act, 2019 require, and record them in our data protection impact assessment.

How long we keep it

Financial records are kept for as long as the law requires after a member leaves. Identity documents are deleted automatically when the retention period ends. Security logs are kept for one year.

Your rights

You can ask to see your data, download a copy, correct it, object to processing or have it erased where the law allows. Signed-in members can do most of this from Profile → Privacy, and requests are answered within the statutory timelines.

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC).

Children's privacy

ChamaBook is meant for adults. Groups should not add members under 18 without the consent of a parent or guardian, and we delete such data when we learn it was collected without that consent.

Changes to this notice

When we change this notice we raise its version (currently 2026-01) and ask you to accept it again the next time you sign in.

Contact us

Data Protection Officer: [email protected]

Support: +254738506251, [email protected]

Oppi Technologies Limited, Westlands, Nairobi, Kenya