Tandika Core Banking

Tandika Technologies ("we", "us", "our") operates the Tandika Core Banking mobile application and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service, and describes your rights in relation to that information.

By accessing or using the Service, you agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree, please discontinue use of the Service.

1 Information We Collect

a. Information you provide

• Full name, national ID number, date of birth, and gender.
• Contact details - phone number, email address, and physical address.
• Account and membership details - member ID, SACCO or institution affiliation.
• Financial information - savings deposits, shares, loans, contributions, withdrawals, and repayment history.
• Identity documents - national ID, passport photo, or other verification material you upload.
• Guarantor and collateral information, where applicable to a loan application.

b. Information collected automatically

• Device information - model, operating system, unique device identifiers.
• Usage data - pages viewed, features accessed, session times, crash logs.
• Network information - IP address, approximate location derived from IP.
• Push notification tokens used to deliver account alerts.

c. Information from third parties

• Payment gateway confirmations (e.g. TandiPay) when you top up your savings.
• Identity verification services, where required by law or by your institution.
• Your SACCO or financial institution, which provides your membership record.

2 How We Use Your Information

We use the information we collect to:

• Create and manage your account on the Service.
• Process savings deposits, shares, contributions, withdrawals, loan applications and repayments.
• Verify your identity and comply with anti-money-laundering (AML) and know-your-customer (KYC) obligations.
• Send you transaction confirmations, account statements, reminders, and service updates.
• Respond to your enquiries and provide customer support.
• Detect, prevent, and investigate fraud, security incidents, and misuse.
• Improve the Service - diagnose errors, understand usage patterns, and prioritise new features.
• Comply with applicable laws, regulations, and lawful requests from public authorities.

3 Legal Basis for Processing

Where required by data protection laws - including the Uganda Data Protection and Privacy Act, 2019, and the EU General Data Protection Regulation, where applicable - we process your personal data on the following bases:

• Contractual necessity - to deliver the Service you signed up for.
• Legal obligation - to meet record-keeping, tax, and AML requirements.
• Legitimate interest - to prevent fraud, secure the Service, and improve features, balanced against your rights.
• Consent - for optional features such as marketing, which you may withdraw at any time.

4 How We Share Your Information

We do not sell your personal data. We may share it only in the following circumstances:

• With your SACCO or financial institution - to operate your account, process transactions, and generate statements.
• With service providers - payment processors (e.g. TandiPay), cloud hosting, analytics, push-notification providers, and identity verification services. They are contractually bound to use your data only for the purposes we specify.
• With regulators and law enforcement - when required by law, court order, or to protect the rights and safety of Tandika, our users, or the public.
• With your consent - for any other purpose we disclose to you and you agree to.

5 Data Storage & Security

Your data is stored on secure servers operated by Tandika and its infrastructure providers. We use industry-standard technical and organisational safeguards, including:

• Encryption in transit (HTTPS / TLS) and at rest.
• Role-based access controls, so staff see only what their role requires.
• Authentication controls - password policies, biometric login, session expiry.
• Regular backups, monitoring, and security reviews.

No method of transmission or storage is 100 % secure. While we strive to protect your information, we cannot guarantee absolute security. If you suspect your account has been compromised, contact us immediately using the details in section 12.

6 Data Retention

We retain your personal data only as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law. Specifically:

• Financial records (transactions, loans, repayments) - retained for the period required by tax and financial-services regulations.
• Identity verification records - retained for the AML / KYC period required by law.
• Usage and diagnostic data - retained for a shorter period, then aggregated or deleted.
• Marketing consent - until you withdraw it.

7 Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Delete your data, where no legal obligation requires us to keep it.
• Restrict or object to certain processing activities.
• Port your data to another service provider in a machine-readable format.
• Withdraw consent for optional processing at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@tandikatechnologies.com. We will respond within the timeframe required by applicable law.

8 Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

9 Third-Party Services

The Service integrates with the following categories of third parties. Each maintains its own privacy policy:

• Payment processors - to facilitate deposits and withdrawals.
• Cloud hosting and storage - to host the Service and store documents.
• Push notification providers (e.g. OneSignal) - to deliver account alerts.
• Analytics and crash reporting - to keep the Service stable and improve it.

10 International Transfers

Your information may be transferred to and processed in countries other than your own where our service providers operate. Where required, we implement appropriate safeguards - such as standard contractual clauses - to ensure your data remains protected in accordance with this policy.

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated through the Service or by email.

We encourage you to review this page periodically so you remain aware of how we protect your information.

12 Contact Us

If you have questions about this Privacy Policy, or wish to exercise any of your data rights, contact us: