This Privacy Policy describes how Daimafund ("we", "us", "our") collects, uses, stores, and protects personal data of our users in compliance with the Data Protection Act, 2019 of Kenya and the Data Protection (General) Regulations, 2021.
1. Data controller
Daimafund acts as a data processor on behalf of each chama, SACCO, or organisation ("Organisation") that subscribes to our platform. Each Organisation is the data controller of its members' personal data. Our contact: master@daimafund.com.
2. What we collect
We collect only the data needed to operate the platform:
- Identity: full name, national ID or passport, KRA PIN, date of birth, gender
- Contact: email address, phone number, postal/physical address
- Financial: contributions, loan history, M-Pesa transaction references, bank statements you upload, wallet balances
- Account: password (hashed with bcrypt), session cookies, IP address, browser type
- Activity: login times, pages visited, actions taken (kept for audit and security)
3. Why we collect it
- To provide chama management services: track contributions, process loans, manage meetings, hold elections
- To process payments via licensed payment service providers (Intasend, Paystack, Safaricom)
- To comply with Kenyan tax (KRA) and anti-money-laundering (AML) requirements
- To detect fraud and protect member funds
- To improve the service and respond to support requests
4. Who we share data with
We share data only when necessary and only with parties bound by data protection obligations:
- Your Organisation's appointed officers (admins, treasurers, secretaries)
- Licensed payment processors when processing your M-Pesa, bank, or card payments
- Cloud hosting providers in Kenya or jurisdictions with equivalent data protection
- Kenyan regulators (CBK, ODPC, KRA) when legally compelled
We do not sell your data, ever.
5. How long we keep it
- Financial records: 7 years (KRA tax law requirement)
- Member profile: while your Organisation remains active + 1 year
- Activity / audit logs: 1 year
- Account closed: anonymised within 30 days unless legally required to retain
6. Your rights under the DPA
You have the right to:
- Access the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Delete your data (subject to legal retention obligations)
- Object to processing for marketing
- Port your data to another service
- Withdraw consent at any time
- Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) — odpc.go.ke
Email master@daimafund.com to exercise any of these rights. We respond within 7 business days.
7. Security
We use industry-standard safeguards:
- TLS 1.2+ for all data in transit
- Bcrypt password hashing with cost factor 12
- Multi-tenant isolation enforced at the database query layer
- Role-based access control on every page
- Rate-limited login (5 attempts / 5 minutes per account)
- Daily encrypted backups
- Audit trail of every privileged action
8. Cookies
We use a single session cookie (HttpOnly, Secure, SameSite=Lax) to keep you signed in. No third-party tracking cookies.
9. Changes to this policy
We may update this policy as the service evolves or laws change. Material changes will be emailed to all registered users 14 days before they take effect.
10. Contact
For any privacy question: master@daimafund.com