Privacy Policy

The FinTech Association of Kenya, referred to in this policy as FINTAK, we or us, is responsible for deciding how personal data collected through this website is used.

We may collect the following information.

• Identity and contact information, including your name, email address, telephone number and location.

• Professional and organisational information, including your employer, job title, business sector, company registration information and professional interests.

• Membership information submitted when an organisation applies for or administers FINTAK membership, including the details of its nominated representatives.

• Complaint information, including the financial service provider involved, the relevant service, when the matter occurred, what happened, the outcome sought and any supporting material voluntarily provided.

• Newsletter and communication preferences, including your subscription, consent and opt-out choices.

• Event, training and programme information, including registrations, attendance and participation records.

• Payment and transaction information where a paid service is used. Payments may be processed by an authorised payment provider. FINTAK does not receive or store complete payment-card details handled directly by that provider.

• Communications sent to FINTAK through website forms, email, telephone or other official channels.

• Technical information generated when you use the website, including your internet protocol address, browser, device type, pages visited, referral source and cookie or analytics information.

Some complaint documents may contain sensitive personal information. Please provide only information that is relevant to resolving the complaint and avoid submitting another person’s personal data unless you are authorised to do so.

FINTAK’s services are intended for adults and organisations. We do not knowingly collect personal data directly from children through this website.

FINTAK processes personal data only where it has a lawful reason to do so. Depending on the interaction, this may be consent, performance of an agreement, compliance with a legal obligation or FINTAK’s legitimate interest in operating the association and serving Kenya’s fintech ecosystem.

We use personal data to:

• assess and administer membership applications

• maintain member and organisational records

• provide membership services and communicate with nominated representatives

• register participants for events, training, consultations and other programmes

• respond to enquiries and provide requested support

• receive, assess, escalate and track consumer complaints

• share a complaint with the financial service provider named by the complainant where the complainant has consented to that disclosure

• identify recurring sector concerns using aggregated or anonymised information

• send newsletters and association updates where a person has subscribed or another lawful basis applies

• process payments and maintain the records required for financial reporting

• conduct policy consultations, research and industry engagement

• maintain the security, availability and performance of the website

• understand how visitors use the website and improve FINTAK’s services

• prevent fraud, misuse and unauthorised access

• comply with applicable laws, regulatory requirements and lawful requests

Consent may be withdrawn at any time. Withdrawal does not affect processing that occurred lawfully before consent was withdrawn. Every marketing communication will provide a practical way to unsubscribe.

FINTAK does not sell or rent personal data.

We may disclose limited personal data to:

• FINTAK employees, authorised representatives and advisers who require it to perform their responsibilities

• technology, website-hosting, email, analytics, payment and other service providers processing information on FINTAK’s behalf

• a financial service provider named in a complaint, where the complainant has expressly consented to that disclosure

• event, training or programme partners where sharing is necessary and the individual has been informed

• professional advisers, auditors and insurers where access is necessary for lawful professional services

• regulators, courts, law-enforcement agencies or other public authorities where disclosure is required or authorised by law

• another organisation involved in a restructuring, merger or transfer of FINTAK’s operations, subject to appropriate confidentiality and data-protection requirements

FINTAK may share anonymised or aggregated information about industry trends and complaint patterns. Information shared in that form will not be intended to identify an individual.

Service providers may process information outside Kenya. Where personal data is transferred outside Kenya, FINTAK will apply the safeguards required by Kenyan law, including an adequacy assessment, appropriate contractual protection, another legally recognised safeguard or the data subject’s consent where consent is the applicable basis.

Service providers may use personal data only for the agreed purpose and must protect it in accordance with their contractual and legal obligations.

Under Kenya’s Data Protection Act, 2019, and its regulations, you may have the right to:

• be informed about how your personal data is used

• request access to personal data held about you

• request correction of inaccurate, incomplete or misleading information

• object to certain processing

• request restriction of processing in appropriate circumstances

• request deletion of personal data where the legal conditions are met

• request the transfer of eligible personal data in a structured and commonly used format

• withdraw consent where processing depends on consent

• object to direct marketing

• challenge a decision based solely on automated processing where it produces legal or similarly significant effects

A request may be sent to:

Head of Data Protection
FinTech Association of Kenya
Email: info@fintechassociation.africa
Telephone: +254 798994015
Nairobi, Kenya

Please describe the request clearly and provide sufficient information for FINTAK to confirm your identity and locate the relevant records. FINTAK may request additional verification before disclosing or changing personal data.

Some requests may be limited by legal obligations, the rights of another person or another lawful reason. Where a request cannot be fulfilled, FINTAK will explain the reason where the law permits.

A person who believes their personal data has been processed unlawfully may also lodge a complaint with the Office of the Data Protection Commissioner through www.odpc.go.ke.

FINTAK retains personal data only for as long as it is reasonably required for the purpose for which it was collected, to resolve disputes and to satisfy legal, regulatory, contractual, accounting or reporting requirements.

Unless a longer period is required by law or an active dispute:

• active membership records are retained for the duration of membership and for up to seven years after membership ends

• unsuccessful or incomplete membership applications are retained for up to twelve months

• complaint records are retained for up to three years after the complaint is closed

• contact enquiries and routine correspondence are retained for up to two years after the last substantive communication

• event and programme records are retained for up to three years, while associated financial records may be retained for up to seven years

• newsletter subscriber information is retained until the person unsubscribes, after which limited information may be retained to honour the opt-out request

• website analytics information is retained for no longer than fourteen months unless it has been anonymised

Information may be retained for longer where a complaint, investigation, legal claim, audit or statutory obligation remains active. Once personal data is no longer needed, it will be deleted, securely destroyed or anonymised.

FINTAK applies reasonable administrative, technical and organisational safeguards intended to protect personal data against loss, unauthorised access, alteration, disclosure or destruction. These safeguards include access restrictions, account controls, appropriate service-provider agreements, system maintenance and internal handling procedures.

No internet-based service can guarantee absolute security. Where a personal-data breach occurs, FINTAK will investigate it and make any notifications required under Kenyan law.

FINTAK may update this policy when its services, legal obligations or data-handling practices change. The revised policy will be published on this page with a new “Last updated” date.