Privacy Policy for SaccoBox

1. Introduction

SaccoBox is a core banking platform developed and operated by Sora Hub Technologies Ltd for Savings and Credit Cooperative Societies (SACCOs): member records, savings and deposits, loans, front-office (FOSA) transactions, employer check-off, dividends, accounting, compliance, reporting, a member app and related services.

This Privacy Policy explains how we collect, use, store, protect and disclose information when users access SaccoBox through the web platform, mobile application, support channels or related services.

In most SACCO deployments, the SACCO remains the owner and controller of its institutional and member data. Sora Hub Technologies Ltd acts as a technology provider and data processor, handling data only to provide, secure, support and improve the SaccoBox service.

2. Information We Collect

2.1 Account and user information

We may collect names, phone numbers, email addresses, usernames, passwords, assigned roles, SACCO affiliation, staff designation and other account details needed to create and manage user access.

2.2 Member and SACCO records

Depending on the modules enabled by the SACCO, the platform may process member profiles, member numbers, identification details, contacts, employer and payroll references, nominees and next of kin, share capital, savings and deposit balances, loan applications, guarantors, collateral, repayment schedules, arrears, dividends and statements.

2.3 Financial and operational data

SaccoBox may process teller and cash transactions, deposits and withdrawals, loan disbursements and repayments, M-PESA and bank payment records, check-off schedules, cheques, fixed deposits, interest and dividend computations, general ledger entries, financial statements, prudential reports, audit logs, approvals and dashboards.

2.4 Mobile, device and technical information

When using the mobile app or web platform, we may collect device type, browser details, IP address, login time, error logs, activity logs and synchronization records. Where enabled by the SACCO and the user, the member app may use camera or storage permissions for document and photo capture, verification and support workflows.

3. How We Use Information

We use information to provide and support the SaccoBox service, including:

• creating and managing user accounts, roles and permissions;
• supporting member registry, savings, loan, teller, check-off, dividend, accounting and reporting workflows;
• generating member statements, management reports and operational dashboards;
• supporting the member app, OTP sign-in and payment notifications;
• providing customer support, training, troubleshooting and remote assistance;
• protecting the platform against unauthorized access, misuse, fraud and security threats;
• meeting legal, regulatory, audit, tax, accounting and data protection obligations where applicable.

4. Data Ownership and SACCO Control

Institutional records, member records, savings, loan and transaction data entered by or on behalf of a SACCO remain the data of that SACCO, subject to applicable law and the SACCO’s internal governance rules.

Authorized SACCO administrators can request data exports, account review, user deactivation or account deletion subject to contractual, legal, audit, accounting and operational requirements. We do not sell SACCO or member data.

5. Sharing and Disclosure

We do not sell or rent personal or SACCO data. We may share information only where necessary for service delivery, legal compliance, support or authorized integrations. This may include:

• hosting, infrastructure, backup, email, SMS, payment or technical service providers;
• authorized SACCO administrators and approved users;
• employers, for check-off schedules the member has authorized, and credit reference bureaus where the law and the SACCO’s policy require;
• government, regulatory or legal authorities where required by law or valid legal process;
• professional advisers, auditors or security support teams where necessary and subject to confidentiality.

6. Security and Safeguards

SaccoBox uses layered technical and organizational safeguards designed to protect data confidentiality, integrity and availability. These include secure HTTPS access, domain and traffic protection through Cloudflare, private server hosting, role-based access, SACCO-level security settings, optional two-factor authentication where enabled, audit logs, daily backups, user permission controls and support procedures.

No online system can be guaranteed to be completely risk-free. However, we take reasonable steps to reduce risk, detect issues, control access and support recovery where needed.

7. Hosting and International Processing

SaccoBox may use cloud, VPS, database, DNS, backup, SMS, email and other technology providers. Some infrastructure or service providers may be located outside Kenya. Where data is processed outside Kenya, we apply reasonable safeguards and access controls to protect the data in line with applicable data protection principles.

8. Data Retention

We retain data for as long as required to provide the service, support SACCO operations, meet legal or accounting obligations, resolve disputes, maintain backups, preserve audit trails and comply with applicable agreements. Retention periods may vary depending on the type of data, module used and SACCO requirements.

9. Your Rights and Requests

Subject to applicable law and SACCO governance, users may request access, correction, update, export or deletion of their personal information. Members should normally submit requests through their SACCO administrator. SACCOs may also contact Sora Hub Technologies Ltd for data export, account review or deletion support.

10. Mobile App Permissions

The SaccoBox member app may request permissions such as network access, local storage or camera depending on the enabled features. These permissions support document and photo capture, statements and payments. Users can manage permissions through their device settings, although disabling some permissions may limit certain features.

11. Cookies and Website Data

Our website and web platform may use cookies or similar technologies to maintain sessions, improve performance, remember preferences, support security and understand usage. Users can manage cookies through browser settings, but disabling cookies may affect login and platform functionality.

12. Children's Privacy

SaccoBox is intended for SACCOs, their staff and members. It is not designed for children as a general consumer service. Where a SACCO records minors as nominees or beneficiaries, it must do so lawfully and with appropriate authority.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the platform, law, security practices or operational requirements. The latest version will be posted on this page with an updated date.

14. Contact Us