Data Privacy Statement

DATA PRIVACY STATEMENT

This privacy statement describes how KCB Bank Tanzania Limited and affiliates protect the personal data it processes, why and how we collect and use your personal data and how you can exercise your rights in relation to the processing of your personal data.
This privacy statement should be read together with the Terms and Conditions of Use for other KCB products and services. Where there is a conflict, this privacy statement will prevail.

1. Definitions

1.1 “KCB,” “We,” “Our,” “Ours,” and “Us,”means KCB Bank Tanzania Limited and includes its successors in title and assigns, its affiliates and/or its subsidiaries (as may from time to time be specified by the KCB to you).

1.2. “Personal Data” means any information relating to an identified or identifiable natural person.

1.3. “Processing” means any operation or sets of operations which is performed on personal data or on sets of personal data whether or not by automated means, such as:

a) collection, recording, organization, structuring;

b) storage, adaptation or alteration;

c) retrieval, consultation or use;

d) disclosure by transmission, dissemination, or otherwise making available; or

e) alignment or combination, restriction, erasure or destruction.

1.4. “Sensitive Personal Data” includes data revealing your race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including details of your children, parents, spouse or spouses, sex or sexual orientation.

1.5. “You” or “Your” means:

1.5.1. Customer – (which includes personal representatives and assigns) operating an Account held with us and includes (where appropriate) any person you authorize to give us instructions, the person who uses any of our products and services or accesses any of KCB websites, mobile banking applications, apps, branded pages on third-party platforms and applications accessed or used through such websites or third-party platforms (hereinafter, “our Websites”). “Customer” shall include both the masculine and the feminine gender as well as juristic person.

1.5.2. Any agent, dealer and/or merchants who has signed an agreement with us and is recognized as a merchant or agent in accordance with any applicable laws or Regulations.

1.5.3. Any visitor that is a person (including contractors/subcontractors or any third parties) who gains access to any KCB premises or a virtual visitor to any of our Websites.

1.5.4. Any supplier/ service provider who has been contracted by KCB, any lawyer who has tendered his/her application and/or signed a service level agreement with KCB, any person who has tendered his/her application as a potential employee with KCB, any other third party who has signed an agreement with KCB.

The word “includes” means that what follows is not necessarily exhaustive and therefore the examples given are not the only things/situations included in the meaning or explanation of that text.

2. Collection of Personal Data

KCB will only collect personal data about you in so far as is necessary to achieve the purposes set out in this privacy statement. We collect your Personal Data with your knowledge and consent with exception to cases where processing of the data is permitted by law.

Personal Data may be given to or collected by KCB in writing as part of a written application form, electronically (email), telephonically, online via our website.

KCB will collect your Personal Data when you do any of the following:

a) Make an application, buy or use any of our products and/or services including from third parties through our electronic and digital platforms.

b) Use any of our products and/or services online, on a mobile or other device or through any of our branches or with any of our agents or merchants.

c) Ask KCB for more information about a product or service or contact KCB with a query or a complaint;

d) When you visit or access any of KCB buildings/ premises;

e) Where you’ve been identified as a next of kin or beneficiary by our customer or employee;

f) Where you have applied for employment or are employed or were employed at KCB;

g) Attend an event sponsored by KCB;

h) Make an application to KCB or interact with us a supplier, agent or dealer;

i) Visit, access or use any of our Websites;

j) Subscribe to any of our online services, Short Message Service (SMS), email or social media sites;

k) Respond to or participate in a survey, marketing promotion, prize competition or special offer.

We may also collect your information from other organizations including credit-reference bureaus, fraud prevention agencies, government agencies and business directories;

a) When you engage our insurance services or as a result of your relationship with one or more of our staff and clients;

b) When we require Personal Data from you in order to fulfil a statutory or contractual requirement, or where such information is necessary to enter into a contract or is otherwise an obligation, we will inform you and indicate the consequences of failing to do so;

c) When you make an application or engage with KCB Foundation as a beneficiary in any of our programmes.

d) When you engage our KCB Capital for investment and capital raising needs.

These examples are non-exhaustive, which is reflective of the varied nature of the Personal Data we may collect.

2.1. What Information is collected?

From individuals who are our customers and prospective customers, or are representatives of customers and prospective customers, we may collect Personal Data that includes but is not limited to the following:

2.1.1. Your identity information, including your title, name, photograph, marital status, nationality, occupation, residence, address, location, phone number, identity document type and number, date of birth, age, gender, your email, Facebook and Twitter address.

2.1.2. Name of your employer, terms of employment and if on contract, expiry of the contract.

2.1.3. Your estimated monthly income levels.

2.1.4. If you are a student, your college or university and graduation date.

2.1.5. Your signature specimen.

2.1.6. Your credit or debit-card information, information about your bank account numbers and or other banking information.

2.1.7. Your transaction information when you use our electronic and digital platforms, branches, our agents and/or merchants.

2.1.8. Your preferences for particular products and services, based on information provided by you or from your use of our network or third-party products and services.

2.1.9. Family details, age, profiling information such as level of education, bank account status, income brackets, etc. collected as part of surveys conducted by us and our agents on behalf of KCB

2.1.10. Your contact with us, such as when you: call us or interact with us through social media, email (we may record your conversations, social media or other interactions with us), register your biometric information such as your voice, fingerprints etc, when you visit our branches.

2.1.11. Relevant information as required by Know Your Client and/or Anti Money Laundering regulations and as part of our client intake procedures. This may possibly include evidence of source of funds, at the outset of and possibly from time to time throughout our relationship with clients, which we may request and/or obtain from third party sources. The sources for such verification may include documentation, which we request from you or through the use of online or public sources or both.

2.1.12. We use Closed Circuit Television (CCTV) surveillance recordings. CCTV Devices are installed at strategic locations to provide a safe and secure environment in all our branches, KCB premises and ATMs as a part of our commitment to security and crime prevention.

2.1.13. We maintain a register of visitors in which we collect and keep your personal data such as names, company/institution details, telephone number, vehicle registration details, National ID number and device serial number and model (where you visit our premises with your personal devices e.g laptops). This information is collected for health, safety and security purposes.

2.1.14. We collect and retain your personal data (name, telephone number, and vehicle registration details) when you request for a parking space in any of our KCB premises. We use the data you provide to ensure effective car park management, health and safety compliance, for security purposes and inventory management. Your motor vehicle or its contents while on KCB premises shall be at your own risk and KCB shall have no responsibility for loss or damage of your motor vehicle and/or its contents.

2.1.15. When you use KCB WIFI for guest and visitors, we collect email IDs and will provide user name and password. We record the device address and also log traffic information in the form of sites visited, duration and date sent/received.

2.1.16. Information you provide to us for the purposes of attending meetings and events.

2.1.17. We may use your medical information to manage our services and products to you e.g. when you use our services designed for persons with disabilities.

2.1.18. Where you use our voice recognition platform or fingerprint recognition we may collect and process your biometrics.

2.1.19. We collect your Personal Data when you visit us for purposes of accident and incident reporting. KCB will collect personal data from the injured party or person suffering from ill health, such as, Name, Address, Age, next of kin, details of the incident to include any relevant medical history. The data is collected as KCB has a legal duty to document workplace incidents/accidents and to report certain types of accidents, injuries and dangerous occurrences arising out of its work activity to the relevant enforcing authority. Incidents and accidents will be investigated to establish what lessons can be learned to prevent such incidents/accidents reoccurring including introduction of additional safeguards, procedures, information instruction and training, or any combination of these. Monitoring is undertaken but on an anonymized basis. The information is also retained in the event of any claims for damages.

2.1.20. When you visit our website, we collect your ID-type information: cookie ID, mobile ID, IP address which is used for real-time processing in order to generate a visitor ID.

2.1.21. Information that you provide to us and/or Correspondent banks as part of the provision of Services to you, which depends on the nature of your engagement.

2.1.22. We may collect details of a minor which include name, date of birth, birth certificate number, relationship with the applicant and any other information relevant for the provision of our products and services. We will only process such data where parental or legal guardian consent has been given. We will also ensure that the processing of such data will be done in a manner that protects and advances the rights and best interests of the child.

2.2. Related Legal Entities

Corporate entities and clients form part of our client base. These legal entities are not data subjects (i.e., natural persons to whom Personal Data relates). However, as part of our engagement with these clients, we may receive Personal Data about individuals which may include but is not limited to: full names, birth certificate number, national identity card number or passport number; personal identification number (PIN), nationality, date of birth, postal and business address, residential address, telephone number and email address, occupation or profession, nature of ownership or control of the company, number of shares in the company.
These examples are non-exhaustive, which is reflective of the varied nature of the Personal Data.

2.3. Mailing lists

We also collect information to enable us improve the customers experience and market our products and/or services, which may be of interest to you. For this purpose, we collect:

Name and contact details.

Other business information, such as job title and the company you work for.

Products and/or services that interest you.

Additional information may be collected, such as events you attend and if you provide it to us.

3. Use of Personal Data

This privacy statement aims to give you complete and transparent information on how KCB processes your personal data. We are committed to ensure that your Personal Data is processed in a way that is compatible with the specified, explicit, and legitimate purpose of collection.

Where personal data relates to a minor, we will process the personal data only where parental or legal guardian consent has been given. The processing of such data will be done in a manner that protects and advances the rights and best interests of the child.

We may use personal data provided to us for any of the following purposes but not limited to:

3.1. Verifying your identity information through publicly available and/or restricted government databases to comply with applicable Know Your Customer (KYC) requirements.

3.2. Assessing the purpose and nature of your business or principal activity, your financial status and the capacity in which you are entering into the business relationship with us

3.3. Creating a record of you on our system to verify your identity, provide you with the products and/or services you have applied for from us or from third parties on our ecommerce platforms.

3.4. Communicate with and keep you informed about the products and/or services you have applied for.

3.5 Verification of age and consent where the personal data relates to a minor.

3.6. Identifying you and verifying your physical address.

3.7. Identifying your source of income and similar information.

3.8. Assessing your personal financial circumstances and needs before providing advice to you.

3.9. Responding to any of your queries or concerns, we may record or monitor telephone calls between us so that we can check instructions and make sure that we are meeting our service standards.

3.10. Carrying out credit checks and credit scoring.

3.11. To perform our obligations under a contractual arrangement with you.

3.12. Fraud prevention, detection and investigation.

3.13. Any purpose related to the prevention of financial crime, including sanctions screening, monitoring of anti-money laundering and any financing of terrorist activities

3.14. Further processing for historical, statistical or research, survey and other scientific or business purposes where the outcomes will not be published in an identifiable format.

3.15 Provide aggregated data (which do not contain any information which may identify you as an individual) to third parties for research and scientific purpose.

3.16. In business practices including to quality control, training and ensuring effective systems operations.

3.17. To understand how you use our products and services for purposes of developing or improving products and services.

3.18. Administer any of our Websites.

3.19. To comply with any legal, governmental, or regulatory requirement or for use by our lawyers in connection with any legal proceedings.

3.20. For purposes relating to the assignment, sale, or transfer of any of our businesses, legal entities or assets, in whole or in part, as part of corporate transactions.

3.21. Keeping you informed generally about new products and services and contacting you with offers or promotions based on how you use our or third-party products and services unless you opt out of receiving such marketing messages (you may contact KCB at any time to opt out of receiving marketing messages).

3.22. Where you have applied for employment at KCB, we perform applicant screening and background checks.

3.23. Where you are a KCB employee (including contracted workers), we create an employment record of you on our system to facilitate continuous monitoring during your employment with us.

3.24. Where you are a member of the board of KCB, we create a record of you as a director on our system.

3.25. Where you are a supplier to KCB, we process your Personal Data for due diligence, risk assessment, administrative and payment purposes.

3.26. For security purposes when accessing any KCB buildings/premises; and

3.27. Where you attend an event sponsored by KCB, we will be taking photos or videos of the event. These images or videos will be used by us to share news about the event, and may be used in press releases, printed publicly, and published on our website.

4. Sensitive Data

We may collect Personal Data about you (this includes details about your race, health status, ethnic social origin, conscience, religious belief, genetic data, biometric data, property details, marital status, family details including details of your children, parents, spouse or spouses, sex or sexual orientation and biometric data). We will rely on any of the legal basis provided in clause 6 below for such collection.

5. Transfer of Personal Data

KCB may transfer your Personal Data for the purpose of effecting/implementing, administering, and securing any product or service that you have applied for or for other purpose set out in this privacy statement. We also share data to comply with regulatory requirements and to protect the rights and property of KCB and its customers.

We may transfer or disclose the personal data we collect to regulatory, fiscal or supervisory authority, correspondent banks on transaction enquiries, third party contractors, subcontractors, and/or their subsidiaries and affiliates who provides support to KCB in providing its products or services. The third-party providers may use their own third-party subcontractors that have access to personal data (sub-processors). It is our policy to use only third-party providers that are bound to maintain appropriate levels of security and confidentiality to process Personal Data only as instructed by KCB and to flow those same obligations down to their sub-processors.

5.1 Cross-border transfers
From time to time we may need to transfer your Personal Data outside the country where you are located. These incudes countries that do not have laws that provide specific protection to your personal data.
Where we send your information outside the country, we will ensure that there is proof of adequate data protection safeguards in the recipient country or consent from you on transfer of your Personal Data.

5.2 Other Disclosures
We may disclose your Personal Data where required by law, to enforce other agreements, or to protect the rights, property, or safety of our business, our clients, customers or employees.
KCB may disclose, respond, advise, exchange and communicate personal data and/or information in our possession relating to you outside KCB whether such personal data and/or information is obtained after you cease to a customer or during the continuance of the relationship or before such relationship was in contemplation, provided that such Personal Data is treated in confidence by the recipient. The following are instances where disclosure may take place:

5.2.1. For considering any application the customer may make.

5.2.2. To verify the customer’s identity.

5.2.3. In the management and operation of the account/s with us including making credit assessments and decisions.

5.2.4. For crime and fraud prevention, and debt recovery (including tracing the Customer if the Bank do not have up-to-date details).

5.2.5. For assessment and statistical analysis for Bank business.

5.2.6. To manage Bank relationship with the Customer (including any marketing and market research the Customer agrees to; the Customer should inform the Bank should the Customer change their mind about receiving marketing information or participating in market research.

5.2.7. In order to comply with applicable laws and any other requests that the bank may make from time to time.

5.2.8. To licensed credit reference bureaus, credit reference agents or any other financial institution, only for credit information on the Customer or any Authorized Person and the Customer agrees that such information may be used by other financial institutions in assessing credit applications and for debt tracing.

5.2.9. To the Bank’s lawyers, valuers, survey agencies, research agencies, insurers, auditors, software developers, professional advisors, sub-contractors or any persons acting as agents of the Bank, to the extent that they comply with their contractual obligations.

5.2.10. To any person who may assume the Bank’s rights within the confines of the law.

5.2.11. To credit card companies and financial institutions in connection with credit card enquiries or use of the ATM card.

5.2.12. To Payee Corporations, in connection with the payment of bills.

5.2.13. To any actual or potential assignee or transferee in relation to agreed terms and conditions.

5.2.14. To any, court or other judicial bodies in any judicial proceeding, tribunal, statutory body, or authority (including any tax authorities in any jurisdiction), whether governmental or quasi-governmental.

5.2.15. To any regulatory, fiscal or supervisory authority, any local or international law enforcement agencies, governmental agencies so as to assist in the prevention, detection, investigation or prosecution of criminal activities and law enforcement agencies where demand for any Personal Data is within the law.

5.2.16. To the Bank’s subsidiaries, affiliates, the Bank’s branches, representative offices and their respective staff (together and individually).

5.2.17. To any trustee, custodian, fund managers, issuers of securities, withholding agents, custodians or sub-custodians, depositaries, clearing houses, counterparties in connection with the services the Bank provides.

5.2.18. To any actual or potential participant or sub-participant relating to any of the Bank’s obligations or assignee, novatee or transferee.

5.2.19. To any trader or merchant, or other party accepting the use of the ATM card, credit/ debit card and their agents or contractors in respect of transactions using the ATMs/ debit/credit card of other banks or financial or non-financial institutions.

5.2.20. To any person who stands as guarantor or surety for the customer’s liability or is jointly or jointly and severally liable with the customer.

5.2.21. To any receiver appointed by us.

5.2.22. If the Bank has a right or duty to disclose or is permitted or compelled to do so by law.

5.2.23. For purposes of exercising any power, remedy, right, authority or discretion relevant to the agreed terms and conditions or the security following the occurrence of an event of default, to any other person or third party as well.

5.2.24. Where the Bank has a public duty to disclose.

6. Legal basis for the processing of personal data

KCB will process your Personal Data as permitted by the applicable data protection law and its internal policies:

For the performance of a product/service contract which you are party to.

Where processing is necessary for the purposes of legitimate business interests pursued by KCB or by a third party within the confines of the law.

For the establishment, exercise or defense of a legal claim.

Compliance with a mandatory legal obligation to which it is subject.

With your consent.

Public interest.

To protect your vital interest or the vital interests of any person.

7. Direct Marketing

From time to time, we may also use your Personal Data to contact you for market research or to provide you with information about other services we think would be of interest to you. You may be required to opt-in or give any other form of explicit consent before receiving marketing messages from us. We respect your right to control your personal data depending on which of our products you use. Therefore, at a minimum, we will always give you the opportunity to opt-out of receiving such direct marketing or market research communications. You may exercise this right to opt-out at any time.

Not all promotional emails and SMS can be controlled via the opt-out option. You may contact us at any time to opt out of receiving marketing messages through our Contact Centre on 0800750002 or 0800780071, or by writing to us on email: [email protected]

8. Retention of Personal Data

KCB will retain your personal data only for as long as is necessary to achieve the purpose for which they were collected. We may retain your personal data and/or information for a period of up to seven (7) years or as may be required by law and maintains specific records management and retention policies and procedures, so that personal data are deleted after a reasonable time according to the following retention criteria:

Where we have an ongoing relationship with you.

To comply with a legal obligation to which it is subject.

Where retention is advisable to safeguard our legal position.

9. Your rights

You have the right (in the circumstances and under the conditions, and subject to the exceptions, set out in applicable law to:

a. Be informed that we are collecting personal data about you;

b. Request access to your Personal Data that we have on record. This right entitles you to know whether KCB holds personal data of you and, if so, obtain information on and a copy of the personal data.

c. Request KCB to rectify any of your personal data that is incorrect or incomplete.

d. Object to and withdraw your consent to processing of your personal data. This right entitles you to request that KCB no longer processes your personal data. The withdrawal of your consent shall not affect the lawfulness of processing based on prior consent before its withdrawal. We may also continue to process your Personal Data if we have a legitimate or legal reason to do so.

e. Request the erasure of your personal data. This right entitles you to request the erasure of your personal data, including where such personal data would no longer be necessary to achieve the purposes.

f. Request the restriction of the processing of your personal data: This right entitles you to request that KCB only processes your personal data in limited circumstances, including with your consent.
Request portability of your personal data. This right entitles you to receive a copy (in a structured, commonly used, and machine-readable format) of personal data that you have provided to KCB, or request KCB to transmit such personal data to another data controller in an electronic format.

10. The Use of Cookies

We may store some information (using "cookies") on your computer when you visit our Websites. This enables us to recognize you during subsequent visits. The type of information gathered is non-personal (such as: the Internet Protocol (IP) address of your computer, the date and time of your visit, which pages you browsed and whether the pages have been delivered successfully. We use cookies for storing and honoring your preferences and settings, enabling you to sign in, providing interest-based advertising, combating fraud, analyzing how our products perform, and fulfilling other legitimate purposes.

We may also use this data in aggregate form to develop customized services - tailored to your individual interests and needs. Should you choose to do so, it is possible (depending on the browser you are using), to be prompted before accepting any cookies, or to prevent your browser from accepting any cookies at all. For more information read Cookie Policy.

11. Contact Us

To enable us serve you better, we may need to request specific information from you to confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
Please contact our Data Protection Officer if you:

i. have any questions or concerns about how KCB processes your personal data or

ii. want to exercise any of your rights in relation to your personal data, through:
KCB Bank Tanzania Limited
Harambee Plaza
P. O. Box 840
Dar es salaam, Tanzania
Tel: 0800750002 / 0800780071
Mobile: +255 753 626 215
Email:[email protected]
www.kcbbank.com

12. Amendments to this Statement

KCB reserves the right to amend or modify this privacy statement from time to time and your continued use of our products and services constitutes your agreement to be bound by the terms of any such amendment or variation. You can access the most current version of the privacy statement from www.kcbbank.co.tz and Any amendment or modification to this statement will take effect from the date of notification on the KCB website.