Privacy Policy & Data Protection (Uganda Data Protection Act 2019)

At TFast FinCore and TFast Digital Agency (Bulenga, Kampala, Uganda), we protect personal data and institutional confidentiality in accordance with the Uganda Data Protection and Privacy Act, 2019.

1. Data Controller vs. Data Processor Roles

• Installed SACCO & Financial Systems: Each SACCO or financial institution operating an installed copy of TFast FinCore is the Data Controller of its members' KYC, savings, share, and loan records. TFast Digital Agency acts strictly as the Data Processor (providing setup, hosting, automated backups, and technical support under a written Data Processing Agreement).
• Website & Sales Inquiries: When you contact TFast Digital Agency directly via tfastdigital.com, fincore.tfastdigital.com, or info@tfastdigital.com, TFast Digital Agency acts as the Data Controller for your business contact details.
• Public Demo Notice: The public evaluation demo at fincore.tfastdigital.com resets every night at 02:00 AM EAT and is shared by evaluators. Never enter real member National IDs or real personal data into the public demo.

2. Categories of Personal Data Processed

In production deployments, the operating institution collects and processes:

• Identity & KYC Data: Full name, National Identification Number (NIN), gender, photograph, and next-of-kin details.
• Contact Details: Mobile phone numbers, physical address (District, City/Municipality, Address), and email address.
• Financial & Transaction Records: Savings account balances, shareholdings, loan applications, collateral records, and repayment statements.
• Security & Audit Logs: Login timestamps, IP addresses, and staff approval trails for security and auditability.

3. Data Security, Hosting & Subprocessors

• Transport & Password Encryption: All traffic uses a Secure HTTPS connection, and passwords are hashed using salted bcrypt hashing.
• Role-Based Access Control: Granular permissions separate Administrators, Branch Staff/Loan Officers, and Customer Members.
• Direct Payment Gateways: Online payments run through each SACCO's own PesaPal or Flutterwave merchant account, and notifications use the institution's configured SMS/email gateway.
• Automated Backups & Data Return: Managed installations include daily automated database backups and full Excel/CSV and SQL data return upon contract exit.

4. Data Subject Rights (Uganda Data Protection Act 2019)

Under the Uganda Data Protection and Privacy Act, 2019, individuals have the right to:

• Request Access: Obtain copies of their personal data and account statements.
• Request Correction: Have inaccurate or incomplete KYC or contact records corrected.
• Object to Direct Marketing: Opt out of non-essential promotional messages.
• Data Deletion / Return: Request deletion of personal data where statutory financial retention periods no longer apply.

Note for SACCO Members: To update your membership, phone number, or account records, please contact your SACCO branch office directly, as your SACCO is the Data Controller of your account.

5. Privacy & Data Protection Contact

For privacy inquiries regarding TFast Digital Agency, contact our Data Protection Lead at info@tfastdigital.com (Bulenga, Kampala, Uganda).