KATYO
Privacy notice
Last updated 14 Oct 2026
In short: we collect only what we need to run your membership, savings and loans. We encrypt sensitive details, we never sell your data, and you can download, correct or ask us to delete your data at any time from the Privacy page in your account.
1. Who we are
Kibisem Alliance & Transformative Youth Organization (KATYO), a Community Based Organization registered under the Community Groups Registration Act, No. 30 of 2022, P.O. Box 54-30311, Nandi Hills. We are the data controller for the personal data described here. Contact our data protection officer at info@katyo.co.ke or 0725 452 305.
2. What we collect
- Identity: your name, national ID or passport number, date of birth, gender, and disability status if you choose to tell us.
- Contact: phone number, email (optional), county, sub county and ward, next of kin.
- Membership: your groups, roles, membership type and approvals.
- Money: contributions, savings, shares, loans, fines, welfare claims and M-Pesa confirmation codes.
- Security: sign in times, device type and a scrambled form of your IP address.
- Photos, only if you give consent on the registration form.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Running your membership, savings, loans and group records | Contract with you |
| Keeping financial records and preventing fraud | Legal obligation and legitimate interest |
| Sending receipts, reminders and security alerts | Contract |
| News about programs and events | Your consent (you can withdraw it at any time) |
| Photos at events for publicity | Your consent |
4. Who can see your data
Officials of your own group see what they need for their role (for example the treasurer sees your payments; the secretary sees your name and phone, not your ID number). KATYO staff see records only to support you. We share data with service providers who help us run the platform (hosting, database, SMS, email, Safaricom M-Pesa), under contracts that protect it, and with regulators only when the law requires it. Partners and donors only ever see totals, never your personal details, unless you agree.
5. Where your data is kept
Our database is hosted by Supabase in the European Union (Ireland) and the website by Vercel. Transfers outside Kenya are protected by contracts and the safeguards in sections 48 to 50 of the Data Protection Act, 2019.
6. How long we keep it
Financial records: 7 years after the transaction. Membership and KYC records: while you are a member and for the period the law requires after you leave. Security logs: 1 year. Then we delete or anonymise the data.
7. How we protect it
Encryption of ID numbers and other sensitive details, strong password hashing, two step sign in for officials, records that cannot be quietly edited, and a log of everyone who views your records, which you can see yourself.
8. Your rights
You can ask to see, download, correct or delete your data, object to or restrict how we use it, and withdraw consent. Most of this you can do yourself on the Privacy page. Some records must be kept by law even after you leave; we will tell you when that applies.
9. Cookies
We use only the cookies needed to sign you in and remember your language. See the cookie notice.
10. Children
Members must be 18 or older. Youth programs for under 18s require a parent or guardian's consent.
11. Automated decisions
No loan or approval is decided by a computer. Any score or suggestion is advice for the officials, who always decide.
12. Complaints
Talk to us first at info@katyo.co.ke. You can also complain to the Office of the Data Protection Commissioner (ODPC), www.odpc.go.ke.