Privacy Notice
Finhazi provides software and related technology that helps individuals and financial organisations manage financial information and services. We respect the privacy of people who visit our website, use our services, work with our customers or communicate with us.
This Privacy Notice describes the categories of personal information we handle, why we handle it, the parties with whom it may be shared, and the choices and rights available to individuals under applicable law.
At a glance
- Your financial institution remains important: Where a SACCO, cooperative, microfinance institution or other organisation uses Finhazi to serve you, that organisation generally determines why your member and financial records are processed.
- Finhazi has its own responsibilities: We also handle information for our website, customer relationships, account administration and platform security.
- Your rights depend on the context: You may need to contact your financial institution about records it controls; Finhazi can help direct relevant requests.
This notice is not a substitute for the privacy notice of your financial institution or for a separate agreement governing services supplied to an institutional customer.
1. Who we are and scope of this notice
“Finhazi,” “we,” “our” and “us” refer to the Finhazi entity responsible for the relevant service or processing activity. The contracting entity and applicable terms may differ depending on the product and country in which the service is offered.
This notice applies to personal information handled through our public website, our business relationships, and Finhazi-hosted applications and services, to the extent Finhazi determines the purposes and means of processing. Where we process information solely on behalf of an institutional customer, that customer's privacy notice and our agreement with that customer also apply.
Publication check: Identify the relevant legal entity or entities and registered contact details here before publishing this notice.
2. Our role and your institution's role
When we act on behalf of an institution
Financial institutions and other organisations may use Finhazi to manage membership, savings, loans, payments, accounting and related operations. In these circumstances, the institution generally determines the purposes of processing its members' information, while Finhazi processes that information to provide the contracted platform and associated services, subject to applicable law and contractual instructions.
When Finhazi determines its own purposes
Finhazi may separately determine how certain information is used for activities such as responding to enquiries, administering its own customer relationships, maintaining the security of its systems, operating its website and meeting its legal obligations.
The precise allocation of responsibilities depends on the service, contractual arrangements and applicable data protection law.
3. Information we handle
Depending on the services you use and the information provided to us or to your institution, the platform may handle the following categories:
- Identity and contact information: Names, customer or member identifiers, contact details, dates of birth and other registration or verification details.
- Financial and membership records: Savings balances, contributions, shares, loans, repayments, transaction histories, accounting entries and related records maintained by an institution.
- Account and access information: Usernames, roles, permissions, authentication events and security-related records. Passwords and authentication secrets should be handled using appropriate safeguards.
- Technical and usage information: IP addresses, browser and device details, access timestamps, application events, diagnostic records and feature usage.
- Communications: Enquiries, support requests, correspondence and feedback.
- Documents: Files uploaded by users or institutions in connection with supported workflows, which may contain sensitive information.
Not every category is collected for every user. The information handled depends on the features enabled by the institution or the services you choose to use.
4. Where information comes from
Information may be provided directly by you, supplied by an institution that has a relationship with you, generated when you interact with our website or applications, or received from authorised service providers and integrations. Institutions are responsible for ensuring they have an appropriate basis to provide information to Finhazi for the services they use.
5. How and why information is used
Depending on the context, information may be used to:
- Deliver, maintain and support Finhazi services for institutional customers and authorised users.
- Manage accounts, authenticate users, enforce permissions and maintain accurate system records.
- Enable institution-authorised financial workflows, reporting, reconciliation and integrations.
- Detect, investigate and respond to suspected misuse, fraud, security incidents and technical failures.
- Respond to enquiries, provide support and administer commercial relationships.
- Improve the reliability, usability and performance of our services.
- Meet applicable legal, regulatory, recordkeeping and compliance obligations.
- Send marketing communications where permitted, subject to applicable choices and consent requirements.
The legal basis for processing depends on applicable law and the activity. It may include performing a contract, complying with legal obligations, legitimate interests where recognised and appropriate, or consent where required. Where an institution controls the relevant records, it is generally responsible for establishing the lawful basis for its own processing.
6. Payments and third-party financial integrations
Where an institution enables payment, mobile money, banking or other third-party integrations, information necessary to initiate, route, verify, reconcile or investigate a transaction may be exchanged with the relevant provider. Depending on the integration, this may include account or wallet identifiers, phone numbers, transaction amounts, references and transaction statuses.
These providers may process information under their own legal obligations and privacy notices. Finhazi's role in a transaction depends on the specific integration and contractual arrangement. Using Finhazi software does not, by itself, mean that Finhazi is the institution holding your funds or the provider executing the payment.
7. Sharing and disclosure
Information may be disclosed, where necessary and authorised, to:
- The institution responsible for your account and its authorised staff or service providers.
- Hosting, infrastructure, communications, security, support and other vendors helping us provide services.
- Banking, payment and mobile money providers involved in enabled transactions or integrations.
- Professional advisers, auditors and insurers where appropriate.
- Regulators, law enforcement agencies, courts or other authorities when disclosure is required or permitted by law.
- Successors or relevant parties in a lawful corporate transaction, subject to applicable safeguards.
We do not treat access to financial records as unrestricted. Access should be limited to authorised purposes and subject to appropriate confidentiality and security measures.
8. International processing and transfers
Finhazi and its service providers may operate across jurisdictions. Where personal information is transferred or accessed across borders, we seek to apply the safeguards required by applicable law and our agreements with customers. The countries involved and applicable transfer mechanisms depend on the services and infrastructure actually used.
Publication check: Confirm hosting and support locations and any legally required transfer disclosures or mechanisms before publication.
9. Retention, export and deletion
We retain personal information for as long as reasonably necessary for the relevant service, contractual purpose, security need or legal obligation. Different categories of information may be subject to different retention requirements.
Where an institution controls member and financial records, retention, export, archival access and deletion are governed by its instructions, applicable law and the relevant customer agreement. Termination of a subscription does not necessarily require immediate deletion of records that must be retained for legal, audit or regulatory purposes.
When information is no longer required, it may be deleted or anonymised in accordance with applicable requirements and documented retention procedures. Backup copies may be subject to separate, limited retention cycles.
10. Information security
We use administrative, technical and organisational safeguards designed to protect information against unauthorised access, alteration, disclosure and loss. Depending on the system and context, these may include access controls, authentication, logging, monitoring, backup processes and incident-response procedures.
No internet-connected service can be guaranteed completely secure. We assess security incidents and make notifications to affected customers, individuals or authorities where required by applicable law or contractual obligations.
12. Your privacy rights and choices
Subject to applicable law and any relevant exceptions, you may have rights to request access to personal information, correction of inaccurate information, deletion, restriction or objection to certain processing, portability, withdrawal of consent, or review of certain automated decisions.
If your request concerns financial or membership records managed by a SACCO, cooperative, microfinance institution or other Finhazi customer, please contact that institution first. It is generally best placed to verify your identity and decide how to respond. We can assist our customers with requests as required by our agreements and applicable law.
If your request concerns information Finhazi controls directly, contact us using the details below. We may need to verify your identity before acting on a request. You may also have the right to complain to a relevant data protection authority.
You may unsubscribe from Finhazi marketing emails using the instructions included in those communications.
13. Automated processing and decision-making
Finhazi software may support calculations, eligibility rules, risk indicators, fraud checks or other automated workflows configured or used by institutions. The institution may be responsible for determining whether and how those outputs affect its members.
If a service involves solely automated decisions with legal or similarly significant effects, additional disclosures and safeguards may be required under applicable law. Such practices should be described specifically where they are actually used.
14. Children's information
Our public website and direct services are not intended to be used independently by children where doing so is prohibited by applicable law. However, an institution may lawfully maintain information relating to minors, dependants or youth accounts using the platform. In those cases, the institution is responsible for appropriate notices, authorisations and safeguards, and Finhazi handles the information according to the applicable service arrangement and law.
15. Changes to this notice
We may update this Privacy Notice to reflect changes in our services, processing activities or legal requirements. We will publish the revised notice on our website and, where required, provide additional notice of material changes. The effective date should be updated whenever a revised notice takes effect.
Effective date: 18 November 2025
16. Contact us
For questions about this notice or requests concerning information Finhazi controls, contact us at connect@finhazi.com.
For requests about records maintained by your financial institution, please contact that institution directly. If you are unsure who is responsible, explain your relationship with the institution in your message so we can help direct your enquiry.
Publication check: Add the applicable legal entity, business address and any designated privacy contact or data protection officer details required by law.