1. Privacy Statement

This statement provides information on how The Co-operative Bank of Kenya Ltd (hereinafter “the Bank” approaches processing your personal data. Our focus and commitment to respecting your privacy and safeguarding your personal data remain stronger than ever.

1.1 Terms used in this Statement

Personal Data

Information that directly or indirectly identifies or says something about you is referred to as personal data. Examples include your name and address, and information such as your income. Information relating to a sole trader, commercial partnership, or professional partnership is also considered personal data.

Processing Data

Processing means anything that can be done with personal data. This includes the collection, storage, use, transfer, and removal of data.

Whose Personal Data does the Bank process?

We process personal data if we have, want to have, or have had a business relationship with you, or if we have had contact with you.

The people whose personal data we process include:

• Existing bank clients both domestic and foreigners
• Potential bank customers
• People who show an interest in the Bank’s products and services are people who are connected in another way with a business or organization with which we have, want to have, or have had a business relationship, such as third-party participants
• Security providers and guarantors

2. Which Data Does the Bank Process?

2.1 How does the Bank collect your Personal Data?

We receive your personal data when you provide it to the Bank, examples include when opening an account, getting into a contract with us(Loan), data you send to us in order that we can contact you and data arising from any group services that we provide.

We may also receive your data from business units within the Co-operative Bank of Kenya Ltd Group companies or from other financial institutions in the context of combating fraud, money laundering or terrorism. We may also receive data from others, such as suppliers or other parties we work with, or because you have given another party consent to share data with us.

We may also receive data from others, such as public sources like newspapers, public registers and websites.

2.2 How long does the Bank Retain your Data?

We do not keep your data for any longer than necessary to fulfill the purposes for which we collected the data. We have adopted a data retention policy. This policy specifies how long we keep data. In general, we will keep your data for seven years following the termination of the relevant agreement or the ending of your business relationship with Cooperative Bank, unless there is a legal obligation to preserve the data longer e.g. if the regulator asks us to keep specific data for longer in the context of risk models. In some cases, we use shorter retention periods.

In specific situations, we may also keep data for longer than we are required by the retention period fixed by us. We will do this if, for example, the judicial authorities request camera images, in which case we will keep the images for longer than we usually do, or if you have submitted a complaint, in which case the underlying data must be kept for longer.

Once we no longer require the data for the purposes described before, we may keep the data for archiving purposes, in the event of legal proceedings, or for historic or scientific research purposes or statistical purposes.

2.3 Processing of special categories of Data at the Bank

We process special categories of personal data where this is permitted by law and consent is acquired, this may include the use of Biometrics, criminal convictions, etc. If you give us consent to record special categories of personal data relating to you, or you have made this information public yourself, we will only process the information if this is necessary so that we can provide our services.
If you have given us consent to record special categories of personal data, you may withdraw that consent at any time. To do this, please contact your Relationship Manager or through our official communication channels.

2.4 Does the Bank use Automated Individual Decision-making including Profiling?

We will only decide based solely on automated processing including profiling which produces legal effects concerning you or significantly affects you, in case it is allowed by law and we have gained consent.

We do not envisage that any decisions will be taken about you that produce legal effects or significantly affects you.

2.5 Who at the Bank has access to your Data?

Within Cooperative Bank your personal data can be accessed only by individuals who need to have access owing to their role and for official business purposes. All these people are bound by a duty of confidentiality.

2.6 Does the Bank use your Personal Data for any other purpose?

If we want to use the information for any purpose other than the purpose for which it was obtained, we may do this if the two purposes are closely related.

If there is not a sufficiently strong correlation between the purpose for which we obtained the data and the new purpose, we will ask you to give your consent. If you have given us consent, you may withdraw that consent at any time. To do this, please contact your Relationship Manager or through our official communication channels.

2.7 Does the Bank Transfer your data to other countries outside Kenya?

Within the Co-operative Bank of Kenya Ltd Group Companies, Your personal data may be shared by Group Businesses, for example, because you ask us to do this, or because you also purchase a product from a different division of the Bank. Information that has been used to establish your identity may also be used by another division of the Bank with which you want to do business.

Outside the Co-operative Bank of Kenya Ltd Group Companies, We also transfer data if this is necessary in order to perform our agreements with you. For example, we use third parties such as SWIFT to enable you to make payments. Other Branches or Companies in the CO-OP Bank Group (i.e. Co-op Bank, its subsidiaries, and affiliates), any regulatory, supervisory, governmental or quasi-governmental authority with jurisdiction over Co-op Bank Group members, any agent, contractor or third-party service provider, professional adviser or any other person under a duty of confidentiality to the Co-op Bank Group, credit reference agencies and, in the event of default, debt collection agencies, any actual or potential participant or sub-participant in, assignee or transferee of, any of the Co-op Bank Group’s rights and/or obligations in relation to you. These third parties are subject to supervision by their regulators.

If we transfer your data to other parties outside Kenya, we take additional measures to protect your data. Cooperative Bank may leverage on technologies such as Cloud, which may result in your data being shared and stored in different jurisdictions. However, in such cases, the highest level of protection will always be embedded to safeguard your data.

2.8 Customer Data Rights at the Bank

a) Right to Access

You may ask through the branch or relationship manager to access all the information that we have and process in relation to you. The data protection office shall respond to such requests as stipulated by the law.

b) Right to be Forgotten

You may request that we erase data concerning yourself that we have captured, for example, if you object to the processing of your personal data. Your interest must also be greater than the Bank’s interest in processing the data.

c) Right to Data Portability

You have the right to request the Bank to supply you with data that you previously provided to the Bank in the context of a contract with us or with your consent, in a structured, machine-readable format, or that we transfer such data to another party. If you ask us to transfer data directly to another party, we can do this only if this is technically feasible.

d) Right to Rectification

If you believe your personal data has been processed incorrectly or incompletely, you may request that we change or supplement the data.

e) Right to restriction of processing

You may request that we restrict the personal data relating to you that we process. This means that we will process fewer personal data relating to you.

f) Right to object to Direct Marketing

You have the right to request the Bank to stop sending marketing communication. You can place your request to the Contact center or branch.

2.9 Whom to contact to place a complaint or log in an inquiry regarding Personal Data

If you have any questions concerning the processing of personal data by us, please contact:

Your Relationship Manager or Branch with which you do business. In the case of matters concerning the exercising of your rights and other questions about the processing of your personal data kindly contact us on dataprotection1@co-opbank.co.ke

or through our official communication channels.

Right to amend this privacy statement

We reserve the right to amend this privacy statement at any time. All amendments to this privacy statement will be posted on the website. Unless otherwise stated, the current version shall supersede and replace all previous versions of this privacy.