Privacy Policy

This Privacy Policy explains how Kitita ("KiTiTa", "we", "us", or "our") collects, uses, shares, and protects your personal information when you use the KiTiTa application and website (the "Service"). We are committed to protecting your privacy and handling your data in accordance with the Kenya Data Protection Act, 2019 and other applicable laws.

1. Who We Are

KiTiTa is a non-custodial group financial management platform for chamas, SACCOs, and community groups. For the purposes of applicable data protection law, Kitita is the data controller responsible for your personal information. You can reach us at kitita@baruamail.com.

2. Information We Collect

We collect the following categories of information:

• Account information: your name, email address, phone number, and password (stored in encrypted form) when you register.
• Group and financial records: contribution records, loan records, repayment schedules, ledger entries, group roles, and other data you or your Group members enter. KiTiTa stores these records but does not hold or move the underlying funds.
• Evidence files: documents or images you upload as proof of transactions.
• Usage and device information: log data, device type, operating system, and app interactions, collected to operate and improve the Service.
• Communications: messages you send to us for support or enquiries.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and operate the Service;
• Create and manage your account and Group memberships;
• Display contribution, loan, and ledger records to authorised Group members;
• Send transactional communications, reminders, and notifications;
• Verify your identity and secure your account;
• Improve, troubleshoot, and develop new features;
• Comply with legal obligations.

4. Legal Basis for Processing

We process your personal data on the following bases: performance of our contract with you (to provide the Service); your consent (which you may withdraw at any time); our legitimate interests in operating and improving the Service; and compliance with legal obligations.

5. How We Share Information

We do not sell your personal information. We share information only as follows:

• Within your Group: records you enter are visible to other members of the same Group according to their assigned roles and permissions.
• Service providers: trusted third parties who host our infrastructure, store data, or deliver communications on our behalf, under appropriate confidentiality obligations.
• Legal requirements: where required by law, court order, or to protect the rights, safety, and security of KiTiTa or others.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it to comply with legal, accounting, or regulatory obligations.

7. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption of credentials, access controls, and secure infrastructure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Be informed of how your data is used;
• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your personal data;
• Object to or restrict certain processing;
• Withdraw consent at any time;
• Lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of these rights, contact us at kitita@baruamail.com.

9. Cookies and Local Storage

Our website uses minimal local storage to remember your display preferences, such as light or dark mode. We do not use third-party advertising cookies.

10. International Data Transfers

Where your data is processed or stored outside Kenya by our service providers, we take steps to ensure it receives an adequate level of protection consistent with applicable data protection law.

11. Children's Privacy

The Service is not directed to individuals under 18 years of age, and we do not knowingly collect personal data from children. If we learn that we have collected such data, we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the Service. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at kitita@baruamail.com.