This Privacy Statement explains how the Bank collects, receives, uses, stores, shares, protects and retains personal data in accordance with the Data Protection Act, 2019, the regulations made under the Act and other applicable laws in Kenya.
Last updated: 31st October 2026
Introduction
Caritas Microfinance Bank Limited (“the Bank”, “Caritas Microfinance Bank”, “we”, “us” or “our”) including its successors in title and assigns, its affiliates and/or its subsidiaries (as may from time to time be specified by us to you) is committed to protecting the privacy and personal data of individuals whose information we process in the course of our banking and business operations.
This Privacy Statement explains how the Bank collects, receives, uses, stores, shares, protects and retains personal data in accordance with the Data Protection Act, 2019, the regulations made under the Act and other applicable laws in Kenya.
The Statement applies to customers, prospective customers, borrowers, guarantors, security providers, website visitors, suppliers, employees and job applicants, authorized representatives, and other individuals whose personal data the Bank processes.
It should be read together with any relevant product-specific notices, account-opening documents, loan application forms, contractual terms and other disclosures provided by the Bank.
Who We Are
We are a financial institution operating in Kenya and committed to processing personal data in accordance with the Data Protection Act, 2019 and applicable regulations. In the course of our banking and business operations, the Bank may act as a data controller, determining the purposes and means of processing personal data, or, where applicable, as a data processor, processing personal data on behalf of another data controller. To help you understand this Statement and how it applies to you, the following section explains key terms, including personal data, data controller, data processor, processing and sensitive personal data.
Definitions
“Personal Data” means any information relating to an identified or identifiable natural person.
“Processing” means any operation or set of operations which are performed on personal data or on sets of personal data whether or not by automated means, such as: collection, recording, organisation, structuring; storage, adaptation or alteration; retrieval, consultation or use;
disclosure by transmission, dissemination, or otherwise making available; or alignment or combination, restriction, erasure or destruction.
“Sensitive Personal Data” includes data revealing your race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including details of your children, parents, spouse or spouses, sex or sexual orientation (where Personal Data and Sensitive Personal Data are used interchangeably in this Statement and any reference to one includes the other).
“You” or “Your” means:
Customer – (which includes personal representatives and assigns) operating an Account held with us and includes (where appropriate) any person you authorize to give us instructions, the person who uses any of our products and services or accesses any of Caritas Microfinance Bank websites, mobile banking applications, apps, branded pages on third-party platforms and applications accessed or used through such websites or third-party platforms (hereinafter, “our Websites”).
“Customer” shall include both the masculine and the feminine gender as well as juristic person.
Any agent, dealer and/or merchants who has signed an agreement with us and is recognized as a merchant or agent in accordance with any applicable laws or Regulations.
Any visitor that is a person (including contractors/subcontractors or any third parties) who gains access to any Caritas Microfinance Bank premises or a virtual visitor to any of our websites.
Any supplier or service provider who has been contracted by the Bank, including lawyers, valuers and auditors.
Any person who has tendered his/her application as a potential employee with Caritas Microfinance Bank whether or not they are offered employment or any person who has gone through the employment process whether or not they are offered employment or any current or former employee of the Bank.
Any other third party who has signed an agreement with the Bank.
The word “includes” means that what follows is not necessarily exhaustive and therefore the examples given are not the only things/situations included in the meaning or explanation of that text.
Personal Data We Collect
The personal data collected by the Bank depends on the products or services you apply for or use, the nature of your relationship with the Bank and applicable legal and regulatory requirements. The Bank may collect personal data directly from you or, where lawful and necessary, from authorized third parties.
Customer and prospective customer information
We may collect the following categories of personal data from customers, prospective customers and individuals acting on their behalf:
Identification and contact information: Full name, identification document type and number, photograph, date of birth, nationality, gender, marital status where relevant, residential and postal address, telephone number, email address, occupation and other information required to verify your identity.
Employment, business and financial information: Employer or business details, employment terms where relevant, income, source of funds, financial position and other information necessary to assess eligibility for the Bank’s products and services, meet regulatory requirements or manage the banking relationship.
Account and transaction information: Account details, account operating instructions, specimen signature, transaction records, payment information and other banking information generated when you use the Bank’s products, services, branches or digital platforms.
Loan and credit information: Loan applications, credit history, existing credit obligations, repayment capacity, repayment performance, credit reference bureau information, and details of guarantors, collateral, security providers or other information relevant to credit assessment, loan administration and recovery.
Know Your Customer (KYC) and regulatory information: Information and supporting documents required to verify your identity, establish beneficial ownership where applicable, confirm the source of funds, prevent fraud, and comply with applicable anti-money laundering, counter-terrorism financing and other legal or regulatory obligations. This information may be obtained from you or, where permitted by law, from authorized third parties or public sources.
Communications and customer interactions: Information contained in enquiries, complaints, applications, correspondence, telephone calls, emails, social media interactions, customer care engagements, meetings and other communications with the Bank. Communications may be recorded where applicable and in accordance with the law.
Digital and website information: Where you access the Bank’s website or digital platforms, we may collect technical and usage information, access times, pages visited and information submitted through online forms. Cookies or similar technologies may be used where applicable, subject to the Bank’s disclosed practices and applicable law.
Security and premises information: Where applicable, we may collect visitor registration details and use CCTV footage at our premises for security, safety, access control, crime prevention and incident investigation. Any additional information collected through visitors, vehicle or device registers will depend on the security arrangements in place.
Marketing and engagement information: Where applicable and as required by law, we may collect your contact details, product or service preferences, event registration details and communication preferences to administer engagements and provide information about the Bank’s products and services.
Guarantors, security providers and other related individuals
Where you act as a guarantor, provide security, represent a customer or participate in a transaction involving the Bank, we may collect identification, contact, financial, contractual and security-related information necessary to assess, document and administer the arrangement, comply with legal requirements or enforce the Bank’s rights.
Where a customer is a company or other legal entity, the Bank may collect personal data relating to its directors, shareholders, beneficial owners, authorized signatories, representatives and other relevant individuals. This may include their names, identification details, contact information, nationality, addresses, occupation, ownership or control interests and other information required for due diligence and regulatory compliance.
Information obtained from other sources
Where lawful and necessary, the Bank may obtain personal data from credit reference bureaus, government agencies, regulators, public records, employers, financial institutions, business partners, professional advisers, service providers, security providers and other authorized sources relevant to an application, transaction, service or banking relationship.
Where personal data is obtained indirectly, the Bank will provide any required information to the affected individual in accordance with applicable data protection law, subject to any lawful exception.
Sensitive personal data
Where necessary and permitted by law, the Bank may process sensitive personal data or other specially protected information for a specific and lawful purpose, subject to applicable legal requirements and safeguards. Any collection of biometric, health or similar information will depend on the Bank’s actual services and operational requirements.
Mailing lists, events and other engagements
Where applicable, the Bank may lawfully collect your name, contact details, job title, employer or business details, product or service interests, event attendance and communication preferences when you subscribe to communications, attend an event or otherwise engage with the Bank. Marketing communications will be undertaken in accordance with applicable law and your preferences where relevant.
The categories listed above are illustrative and not exhaustive. The specific information collected will depend on the nature of your interaction with the Bank and the purpose for which the information is required.
Why We Collect and Use Personal Data
The Bank processes personal data for specified, explicit and legitimate purposes and in accordance with the Data Protection Act 2019 and other applicable laws. The information is used only where necessary for the relevant purpose and on an applicable lawful basis.
The Bank may process personal data for the following purposes, including but not limited to:
Account opening and management: To establish and maintain customer relationships, open and administer accounts, verify account operating instructions and provide the Bank’s products and services.
Loan processing and credit administration: To receive and assess loan applications, evaluate creditworthiness and repayment capacity, make lending decisions, disburse and administer credit facilities, monitor repayments and manage credit risk.
Customer due diligence and identity verification: To identify and verify customers and other relevant parties, confirm addresses and sources of funds, establish beneficial ownership where applicable, and comply with Know Your Customer (KYC), anti-money laundering, counter-terrorism financing and other applicable legal and regulatory requirements.
Transactions and payments: To process and record deposits, withdrawals, loan disbursements, repayments, transfers and other authorized transactions.
Credit reporting and risk assessment: Where lawful, to obtain, assess and share relevant credit information with credit reference bureaus and other authorized institutions for credit assessment, reporting and risk management.
Collections and recovery: To follow up overdue facilities, communicate with borrowers and guarantors, manage arrears, enforce security and pursue lawful debt recovery through internal teams, advocates, recovery agents or other authorized parties.
Regulatory and statutory compliance: To fulfil applicable legal, regulatory and reporting obligations, including record-keeping, taxation, financial crime prevention, regulatory inspections and data protection requirements.
Fraud prevention, detection and security: To detect, prevent and investigate suspected fraud, money laundering, unauthorized transactions, security incidents and other unlawful activities, and to protect the Bank, its customers, staff and assets.
Customer service and complaints management: To respond to enquiries, requests and complaints, verify instructions, resolve disputes and maintain records of customer interactions.
Legal proceedings and dispute resolution: To establish, exercise or defend the Bank’s legal rights and interests, including managing litigation, arbitration, mediation, debt recovery proceedings and other disputes where the same arises.
Communications and service administration: To communicate with customers and other relevant parties about applications, accounts, transactions, loan facilities, contractual obligations, service changes and other matters relating to the Bank’s products and services.
Supplier and business partner management: To conduct due diligence and risk assessments, enter into and administer contracts, manage service providers and professional advisers, process payments and monitor the performance of suppliers and other business partners.
Website and digital platform administration: To operate, maintain and secure the Bank’s website and digital platforms, process online requests, troubleshoot technical issues and improve the functionality and user experience of the Bank’s digital services.
Service quality and product improvement: Where lawful, to assess the use and performance of the Bank’s products and services, conduct surveys, evaluate customer feedback, support staff training and improve operational processes. Where appropriate, information may be aggregated or anonymized for statistical, analytical or research purposes.
Marketing and promotional communications: Where permitted by law, to inform customers and prospective customers about the Bank’s products, services, offers and events, subject to applicable consent requirements and any relevant right to opt out.
Premises and physical security: Where applicable, to manage access to the Bank’s premises, maintain security records, prevent and investigate incidents, and protect the safety of customers, staff and visitors.
Employment, governance and recruitment: Where applicable, to assess job applicants, conduct lawful background checks, administer employment or contractual relationships, maintain staff records and discharge governance and administrative responsibilities.
Corporate transactions and business continuity: Where necessary and lawful, to facilitate restructuring, sale, transfer or other transaction involving the Bank or its assets, subject to applicable confidentiality, data protection and other legal requirements.
Other lawful purposes: To process personal data for another specific purpose disclosed to you at the time of collection, or for further processing otherwise permitted by applicable law.
The Bank will not use personal data for a purpose incompatible with the purpose for which it was collected unless the further processing is permitted by law. Where required, the Bank will provide additional information about the purpose and applicable lawful basis for processing.
Lawful Basis for Processing
The Bank processes personal data where an applicable lawful basis exists under the Data Protection Act, 2019. Depending on the circumstances, this may include:
Your consent, where consent is the appropriate lawful basis.
The need to take steps at your request before entering into a contract or to perform a contract with you.
Compliance with a legal obligation applicable to the Bank.
Protection of your vital interests or those of another individual, where applicable.
Performance of a task carried out in the public interest or under official authority, where applicable.
A legitimate interest pursued by the Bank or another party, where the applicable legal requirements are met and the interests or fundamental rights and freedoms of the data subject do not override that interest.
The applicable basis depends on the particular processing activity.
Where consent is relied upon, you may withdraw it, subject to applicable law. Withdrawal does not affect the lawfulness of processing undertaken before withdrawal and does not prevent processing that has a separate lawful basis.
Who We Share Personal Data With
The Bank may share personal data with third parties where necessary for the purposes explained in this Statement and where disclosure is authorized or required by law.
Depending on the circumstances, recipients may include:
Regulators and public authorities: Including the Central Bank of Kenya, the Office of the Data Protection Commissioner, law enforcement agencies, courts and other competent authorities.
Credit reference bureaus and financial institutions: For lawful credit assessment, credit reporting, verification and transaction-related purposes.
Technology and service providers: Including providers of banking systems, information technology, hosting, communications, payment processing, document management, cybersecurity and other operational services.
Professional advisers: Including advocates, auditors, consultants, insurers, valuers and other advisers engaged by the Bank.
Debt recovery and enforcement providers: Including authorized recovery agents, advocates, auctioneers and other parties engaged in lawful recovery or enforcement activities.
Business partners and transaction participants: Where necessary to provide a requested service, administer a transaction or fulfil a lawful arrangement.
Authorized representatives: Including persons lawfully authorized to act on your behalf, subject to the Bank’s verification requirements.
Other lawful recipients: Where disclosure is necessary to comply with the law, protect the Bank or another person, investigate unlawful activity or establish, exercise or defend legal rights.
The Bank will take appropriate steps to ensure that third parties processing personal data on its behalf are subject to relevant contractual, technical and organizational safeguards.
Personal data will not be disclosed to unrelated third parties without an appropriate lawful basis.
Transfer of Personal Data Outside Kenya
Where the Bank’s service providers, technology systems or business arrangements involve personal data being transferred to, stored in or accessed from outside Kenya, the Bank will ensure that the transfer complies with the Data Protection Act, 2019 and applicable regulations.
Depending on the circumstances, the Bank will ensure that the applicable statutory requirements for cross-border transfers are satisfied, including the use of appropriate safeguards or other legally recognized conditions where required.
The Bank will take appropriate steps to protect personal data transferred outside Kenya and will provide any information or notices required by applicable law.
How We Protect Personal Data
The Bank implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure or destruction.
These measures may include access controls, authentication mechanisms, confidentiality obligations, staff training, security monitoring, contractual safeguards and other appropriate information security controls.
Access to personal data is restricted in accordance with applicable authorization and operational requirements. Third parties authorized to process personal data are expected to comply with the relevant confidentiality and data protection obligations.
How Long We Retain Personal Data
The Bank retains personal data for as long as reasonably necessary for the purpose for which it was collected, to comply with applicable legal and regulatory requirements, to administer the banking relationship, to resolve disputes and to establish, exercise or defend legal rights.
The applicable retention period depends on the type of information, the nature and duration of the relationship, statutory record-keeping obligations, outstanding facilities, complaints, investigations and any ongoing or anticipated legal proceedings.
When personal data is no longer required, the Bank will take appropriate steps to securely delete, destroy, anonymize or otherwise dispose of it in accordance with applicable law and the Bank’s retention procedures.
Cookies and Website Technologies
The Bank’s website may use cookies or similar technologies to support essential functionality, maintain security, remember preferences and, where enabled, understand website performance.
Where consent is required for cookies, the Bank will apply the relevant consent arrangements. You may manage cookie preferences through the website’s settings, where available, or through your browser settings.
Further information will be provided in the Bank’s Cookie Policy or cookie settings, where applicable.
Marketing and Customer Communications
Where lawful, the Bank may use your contact details to provide service-related communications, transaction notifications, security alerts, regulatory notices and other information necessary for administering your relationship with the Bank.
Where consent is granted, the Bank may also send information about its products, services and promotional activities.
You may object to direct marketing or withdraw your consent, where applicable, through the mechanism provided in communication or by contacting the Bank.
Your Data Protection Rights
Under the Data Protection Act, 2019, you have rights in relation to your personal data, subject to applicable legal conditions and limitations. These include the right:
To be informed about the use of your personal data.
To access personal data held about you.
To object to the processing of all or part of your personal data, as provided by law.
To request correction of false, misleading, inaccurate or incomplete personal data.
To request deletion of false or misleading personal data, subject to applicable law.
To withdraw consent where processing is based on consent.
To request data portability where the statutory requirements are met.
To exercise applicable rights concerning decisions based solely on automated processing, including profiling, where the law provides such rights.
The exercise of these rights may be subject to identity verification, the rights of other persons, statutory obligations, record-retention requirements and other limitations prescribed by law.
To exercise your rights, please contact the Bank using the details below. The Bank may request additional information that is reasonably necessary to verify your identity or clarify your request.
Contacting the Bank and Exercising Your Rights
If you have questions about this Privacy Statement, wish to exercise your data protection rights or have concerns about how your personal data is processed, you may contact:
The Data Protection Officer
Caritas Microfinance Bank Limited
Email: [email protected]
Postal address: 15352-00100, Nairobi
You may also contact the Bank through its official customer care channels:
Tel: 020 515 1500
Cell: +254 729 986 331
Email: [email protected]
Automated Processing and Decision-Making
The Bank may use automated systems to support activities such as transaction processing, fraud detection, credit assessment, risk management and service delivery, where applicable.
Where a decision is based solely on automated processing and produces legal effects or similarly significant effects on you, the Bank will comply with the applicable requirements of the Data Protection Act, 2019, including any relevant safeguards and rights.
Further information about a particular automated decision-making activity will be provided where required by law.
Changes to This Notice
The Bank may review and update this Privacy Statement to reflect changes in its products and services, personal data processing activities, website functionality, applicable law or regulatory requirements.
The latest version will be published on the Bank’s website with the relevant revision date. Where required by law, the Bank will take additional steps to notify affected individuals of material changes.
Accessibility
The Bank aims to make this Privacy Statement accessible and understandable to individuals who interact with its services. If you require clarification, please contact the Bank through the channels set out in Section 14.