Summary
We collect only the personal information we need to provide banking services, meet our legal obligations and keep your account safe. We do not sell your data. You have the right to access, correct and delete your data, subject to legal retention requirements.
1. Who is responsible for your data
The Jahihi entity that holds your account is the data controller for your personal information. Its identity, registration number and data protection regulator are shown at the bottom of this page.
2. What we collect
2.1 Information you give us
- Name, date of birth and contact details.
- National identification number or passport details.
- Address, phone number and email address.
- Employment, income and business information (for loans).
- For trade finance: company registration, licences and beneficial ownership details.
- Any message you send us through the website, app or in branch.
2.2 Information we collect automatically
- Device type, browser and IP address.
- Pages you visit and how long you spend on them.
- Login dates and times.
- Cookies and similar technologies — see our Cookie Policy.
2.3 Information from third parties
- Credit reference bureaux (for loan assessments).
- Identity verification providers.
- Sanctions and politically-exposed-person screening services.
- Other financial institutions, where you have asked us to receive or send funds.
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Open and operate your account | Performance of our contract with you |
| Assess loan and trade finance applications | Contract; legitimate interest |
| Comply with AML, KYC and sanctions laws | Legal obligation |
| Detect and prevent fraud | Legitimate interest; legal obligation |
| Improve our services and website | Legitimate interest |
| Send you service messages (not marketing) | Contract; legal obligation |
| Send you marketing (if you have agreed) | Consent — withdrawable at any time |
4. Who we share it with
We share your data only where necessary:
- Regulators and law enforcement, when required by law or a court order.
- Credit reference bureaux, to assess your creditworthiness and to report on your loan performance.
- Payment networks (mobile money, card schemes) to process your transactions.
- Service providers who help us run the bank (cloud hosting, identity verification, fraud detection) under written contracts that protect your data.
- Correspondent banks, where a trade finance transaction requires it.
We do not sell your personal information to anyone.
5. International transfers
Some of our service providers are located outside the region in which you hold your account. When we transfer your data internationally, we use legal safeguards — standard contractual clauses or an equivalent mechanism — and we ensure the destination provides an adequate level of protection.
6. How long we keep it
We keep your personal information for as long as you are a customer, and afterwards for the period required by financial-services law — typically 7 to 10 years after your account closes. After that, we delete or anonymise it.
7. How we protect it
We use encryption in transit and at rest, multi-factor authentication, strict access controls and continuous monitoring. Our staff are trained on data protection, and we test our systems regularly. See our security page for how you can protect yourself too.
8. Your rights
Under applicable data protection law, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete data where we no longer have a lawful reason to keep it.
- Restrict how we use your data while a dispute is being resolved.
- Object to processing based on legitimate interests.
- Portability — receive your data in a machine-readable format.
- Withdraw consent where processing relies on your consent (for example, marketing).
- Complain to the data protection regulator named at the bottom of this page.
9. Marketing
We send marketing only if you have opted in. Every marketing message includes a one-click unsubscribe, and you can change your preferences at any time in your account settings.
10. Children
Our services are not designed for children under 18. We do not knowingly collect personal data from children. If you believe we have done so, contact us and we will delete it.
11. Changes to this policy
The current version and effective date are shown at the top of this page. Material changes will be communicated to you before they take effect.
12. How to contact us
To exercise any of your rights, or ask a question about this policy, write to our privacy team or email the data-protection officer at the address shown on that page.
Jahihi Uganda is supervised by the Bank of Uganda under licence MDL/2024/1234.
Data protection regulator: Personal Data Protection Office.
Complaints can also be escalated to Bank of Uganda Complaints Desk on +256 414 258 441.
Registered in Uganda as Company No. 80010000123456.
End of Privacy Policy, version 3.0. Questions? Write to our legal team.