Sanaa Finance – Privacy Policy

Sanaa Finance is a savings, loans and cooperative finance app operated by Sanaa Co. ("Sanaa", "we", "us") in Uganda and the Democratic Republic of the Congo. This policy explains what personal data we collect, why, who sees it, and the choices you have. By using the app you agree to this policy.

1. Who is responsible for your data

Sanaa Co., Kampala, Uganda. Where the app is used by a SACCO, microfinance institution or group (a "Partner Institution"), that institution also decides how your data is used for your membership, and we process it on its behalf.

2. Data we collect

• Identity and KYC: full name, phone number, date of birth, national ID or other identification details and document images, photo or selfie, address, next of kin where required.
• Account data: membership tier, role, PIN (stored in protected form), login and session records.
• Financial data: savings, deposits, withdrawals, loans, repayments, dividends, and transaction history.
• Payment data: mobile money and card payment references from our payment provider, PesaPal. We do not store your full card number.
• Device data: device identifiers, model, operating system, app version, IP address and crash logs. We use this to lock your account to your registered device and to prevent fraud.
• Communications: messages you send to support and notifications we send you, including by SMS or WhatsApp.
• Photos and documents: only the images you choose to upload, such as ID document photos, a selfie or a profile picture. You select them through the Android system photo picker or take them with your camera. The app cannot browse your gallery or access any other photos.

3. How we use your data

• To register you, verify your identity and approve your membership. Uploaded photos are used only for identity verification and profile display.
• To run your savings and loan accounts and process payments.
• To assess eligibility and loan limits, including credit scoring.
• To secure your account, prevent fraud and meet anti-money-laundering rules.
• To send service notices, reminders and support replies.
• To meet legal and regulatory duties, including reporting to regulators.
• To improve the app through aggregated, de-identified analytics.

4. Who we share data with

• Your Partner Institution (your SACCO, MFI or group), for your membership and loans.
• Payment providers such as PesaPal and mobile money operators, to process transactions.
• Service providers for hosting, SMS and WhatsApp messaging, and crash reporting, under confidentiality terms.
• Regulators, courts and law enforcement when the law requires it.
• Lenders on our credit marketplace, only with your consent, when you apply for a loan from a lender other than your own institution.

We do not sell your personal data.

5. Legal basis

We process your data to perform our agreement with you, to comply with the law (including Uganda's Data Protection and Privacy Act, 2019, and applicable DRC law), for our legitimate interest in security and fraud prevention, and on your consent where we ask for it. You can withdraw consent at any time, though some features may then stop working.

6. Storage and security

Data is stored on secured servers and transmitted over encrypted connections. We use role-based access, device locking, session controls and activity logs. No system is completely secure, so please keep your PIN private and tell us at once if you lose your phone. Your data may be processed outside your country; where that happens we require appropriate safeguards.

7. Retention

We keep your data while your account is active and afterwards for as long as financial, tax and regulatory rules require (usually several years). After that we delete or anonymise it.

Identity document images are kept only as long as needed for verification and legal record-keeping, then deleted.

8. Your rights

You may ask to access, correct, update or delete your data, object to certain uses, or withdraw consent. Some records cannot be deleted while a loan is outstanding or while the law requires us to keep them.

Account and data deletion: contact us using the details below, or ask your Partner Institution. We will respond within 30 days.

9. Children

Sanaa Finance is for adults aged 18 and over. We do not knowingly collect data from children. If you think a child has registered, contact us and we will remove the account.

10. Third-party services

Payments are handled by PesaPal and mobile money operators under their own privacy policies. We are not responsible for their practices.

11. Changes to this policy

We may update this policy. We will post the new version here and notify you in the app for material changes.

12. Contact us

Sanaa Co., Kampala, Uganda
WhatsApp: 0706272481
Email: [email protected]
Web: sanaa.ug

You may also complain to the Personal Data Protection Office in Uganda if you believe your data has been mishandled.