Who runs this
GroupFund is run by The Boys Club Alliance (TBCA). It keeps the records of chamas and other savings groups, which it calls clubs, in Kenya.
Each club decides what it keeps about its own members. For members' records the club is in charge (the data controller) and we keep them on its behalf (the data processor). For people who ask us to start a club, and for running the platform itself, we're in charge.
What we keep
- When a group asks to start a club: the group's name, county, town and size, and the name, email and phone number of the person asking, what they wrote, and when they agreed to these policies.
- About each member, as their club records it: name, email, phone number, position in the club and the date they joined.
- The club's money records: contributions and the months they cover, loans, repayments, guarantors and fines.
- Receipt: the photos, screenshots and payment messages members send as proof, and the receipt numbers mobile money services send back.
- Club documents officials upload, such as the constitution and the club's spreadsheets.
- Logging in: a password, stored only in a scrambled form that can't be read back, passkeys and PINs if a member sets them, and when they last logged in.
- Messages: the emails and texts the club sends through the platform, and who they went to.
- Changes: who changed a club's settings or confirmed a payment, and when.
Why we keep it
- To keep the club's records and show each member their own.
- To check payments, including asking a mobile money service whether a payment went through.
- To send the emails and texts the club has chosen.
- To keep accounts safe, and to find out what happened if something goes wrong.
We don't sell anyone's information, use it for adverts, or use it to build profiles of people.
Who can see it
- A member sees their own records and receipts.
- A club's officials see what their position allows. The club sets that.
- Our own staff see a club's records only to set the club up, to help when it asks, or to fix a fault, and only as much as that needs.
- Services that do part of the work see only what that part needs: the company that hosts our server, the service that delivers our emails, and the mobile money and text services a club connects with its own account.
- Anyone the law requires us to tell, when there's a lawful order.
Where it's kept
On a rented server. The country it's in will be named here before real clubs join.
How long it's kept
- A club's records are kept while the club uses the platform. A member's records stay in the club's book after they leave, because the club's accounts need them.
- When a club leaves, it gets a copy of its records. We then delete them within 90 days, and they leave our backups within a further 30 days.
- A request to start a club that doesn't go ahead is deleted after 12 months.
How it's protected
- Each club's records sit in their own part of the database, apart from every other club's.
- Everything travels over an encrypted connection.
- Passwords are stored scrambled. A club's mobile money and text keys are stored encrypted and never shown again.
- A receipt can be opened only by the member who sent it and the officials who check it.
- Every confirmed payment and every change to a club's settings is kept with who did it.
What you can ask for
- To see what's kept about you, and to have a copy.
- To have a mistake corrected.
- To have something deleted, unless the club must keep it by law or for its accounts.
- To object to a use of your information, or to withdraw an agreement you gave.
A member asks their club's officials first, because the club decides about its own records. Anyone can also write to [email protected]. We reply within 30 days.
You can complain to the Office of the Data Protection Commissioner, under Kenya's Data Protection Act, 2019.
Cookies
Only the ones the platform needs to work: one keeps you logged in, and one stops another website sending forms in your name. No tracking or advertising cookies.
Children
The platform is for adults. Clubs shouldn't add anyone under 18.
Changes to this notice
If this notice changes in a way that matters, we'll say so on the platform before the change applies, and ask again where your agreement is needed.