Last Updated: September 2026
Kitabu Yetu is committed to protecting the privacy and security of the personal information entrusted to us by community groups, members, organizations, partners, and other users of our services.
This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, when we may share it, how long we retain it, and the rights available to individuals whose personal information we process.
By using the Kitabu Yetu Platform, you acknowledge that you have read and understood this Privacy Policy.
1. Introduction and Policy Statement
Kitabu Yetu is a digital platform that helps community groups and organizations manage their members, financial records, meetings, payments, communications, fundraising activities, and related administration.
Our services may involve processing personal and financial information belonging to members of community groups, group officials, organization staff, donors, partners, and other individuals.
We recognize that personal information is an important part of an individual's identity and privacy. We therefore aim to process personal information responsibly, transparently, securely, and only for legitimate purposes.
Our handling of personal information is guided by applicable laws and regulations of the Republic of Kenya, including the Data Protection Act, 2019, together with applicable regulations, guidance, and other legal requirements relating to privacy and data protection.
We will not use personal information for purposes that are incompatible with the purposes described in this Privacy Policy unless permitted or required by law or otherwise authorized by the relevant individual.
2. Scope of This Privacy Policy
This Privacy Policy applies to personal information processed through Kitabu Yetu products and services, including:
- the Kitabu Yetu website;
- web and mobile applications, where applicable;
- Bookkeeper;
- Chama Reminder;
- Fundraise / Changi$ha;
- Enterprise services;
- customer-support channels;
- communications services;
- payment-related functionality; and
- other Kitabu Yetu services that reference this Privacy Policy.
It applies to information relating to individuals who interact with Kitabu Yetu, including:
- group members;
- group officials;
- organization staff;
- donors and programme participants;
- customers;
- prospective customers;
- platform users;
- service providers and partners; and
- individuals whose information is legitimately submitted by an authorized customer or organization.
3. Your Privacy Rights
Subject to applicable law, you may have rights concerning your personal information, including the right:
- to be informed about how your information is being used;
- to request access to personal information we hold about you;
- to request correction of inaccurate, incomplete, or misleading information;
- to object to certain processing of your information;
- to request deletion of personal information where legally applicable;
- to request restriction of certain processing;
- to request portability of information where applicable;
- to withdraw consent where processing is based on consent; and
- to lodge a complaint with the relevant data-protection authority where you believe your rights have been infringed.
Some rights may be subject to lawful limitations, including legal, contractual, security, accounting, or record-keeping requirements.
4. Information We Collect
The information we collect depends on how you use Kitabu Yetu and the services provided to you.
4.1 Account Information
When creating or using a Kitabu Yetu account, we may collect information such as:
- full name;
- email address;
- telephone number;
- username;
- account credentials;
- role within a group or organization;
- organization information;
- group information; and
- other information necessary to establish and manage your account.
4.2 Member and Group Information
Where Kitabu Yetu is used by a community group, authorized group officials may enter information relating to members.
This may include:
- member name;
- membership number;
- telephone number;
- email address;
- membership status;
- role or office held;
- registration information;
- contribution history;
- savings information;
- shares;
- loans and repayments;
- welfare records;
- fines or penalties;
- meeting participation;
- dividends;
- financial statements; and
- other information required to administer the group.
The amount and type of information collected will depend on the group's constitution, configuration, selected Kitabu Yetu product, and services being used.
5. Financial and Transaction Information
Kitabu Yetu may process financial information required to provide group-management and payment-related services.
This may include:
- contribution amounts;
- savings;
- shares;
- loan balances;
- loan repayments;
- welfare contributions;
- fines;
- payment references;
- transaction dates;
- payment status;
- account or membership references;
- mobile-money transaction information;
- payment-provider information; and
- financial reports generated through the Platform.
Where payments are processed through a third-party payment provider, the provider may independently process certain payment information under its own privacy policy and terms.
Where technically and operationally possible, Kitabu Yetu will avoid unnecessarily storing sensitive payment credentials such as complete card security information.
6. Identification Information
Depending on the service being used, Kitabu Yetu or an authorized group or organization may require identification information to establish, verify, or maintain an account or membership record.
This may include information such as:
- national identification information;
- passport information;
- identification references;
- date of birth;
- photograph; or
- other information required for a legitimate and lawful purpose.
Identification information should only be submitted where the submitting person or organization has an appropriate lawful basis and authority to provide it.
7. Contact Information
We may collect contact information such as:
- telephone number;
- email address;
- postal address;
- physical or residential address where necessary; and
- other communication details.
This information may be used to provide services, send notifications, respond to support requests, administer accounts, and communicate important service information.
8. Technical and Usage Information
When you access Kitabu Yetu, we may automatically collect certain technical information.
This may include:
- IP address;
- browser type;
- device type;
- operating system;
- approximate technical location information where necessary for service operation;
- access times;
- pages or services accessed;
- application activity;
- error logs;
- security events; and
- other technical information generated through use of the Platform.
We may use cookies and similar technologies to maintain sessions, improve usability, understand Platform performance, and support security.
9. Authentication and Security Information
Kitabu Yetu may use authentication mechanisms such as passwords, verification codes, OTPs, session identifiers, or other security technologies.
Where OTP or verification information is processed, it will be used for the specific security or authentication purpose for which it was generated.
Authentication credentials and security information will not be used for unrelated purposes.
Users should never share OTPs, passwords, or authentication codes with another person, including someone claiming to be a Kitabu Yetu representative.
10. Information Provided Through Customer Support
When you contact Kitabu Yetu support, we may collect information necessary to identify your account and resolve your issue.
This may include:
- your name;
- account information;
- group or organization;
- membership number;
- transaction reference;
- contact information;
- description of the problem;
- relevant screenshots or documents; and
- other information voluntarily provided during the support interaction.
We use this information to investigate and resolve your request and improve our services.
11. How We Use Your Information
We may use personal information for legitimate purposes including:
- creating and administering accounts;
- providing Kitabu Yetu products and services;
- maintaining group and member records;
- processing and reconciling supported transactions;
- providing financial and administrative reports;
- managing group meetings and activities;
- sending requested SMS and email communications;
- providing reminders and notifications;
- supporting fundraising activities;
- administering organization programmes;
- providing customer support;
- verifying account information;
- preventing fraud and misuse;
- protecting the security of the Platform;
- monitoring Platform performance;
- troubleshooting technical problems;
- improving our products and services;
- maintaining audit and operational records;
- complying with legal and regulatory obligations; and
- communicating important information about the services.
Where permitted by law and appropriate to the relationship, we may also use business contact information to communicate relevant information about Kitabu Yetu products, services, programmes, or events.
You may have the ability to opt out of certain marketing communications.
12. Legal Basis for Processing
We will process personal information only where there is a lawful basis for doing so.
Depending on the circumstances, this may include:
Consent
Where required, we may obtain your consent before collecting or using certain personal information.
You may withdraw consent where the processing is based on consent, subject to legal or contractual limitations.
Contract
We may process information where it is necessary to provide a service you have requested or to perform obligations under an agreement.
Legal Obligation
We may process information where required to comply with applicable law, regulatory requirements, court orders, or other lawful obligations.
Legitimate Interests
Where permitted by law, we may process information where necessary for legitimate operational interests, including security, fraud prevention, service improvement, customer support, and administration, while considering applicable privacy rights.
13. Groups and Organizations Using Kitabu Yetu
Kitabu Yetu is designed to allow groups and organizations to manage information relating to their members and beneficiaries.
In many circumstances, a group or organization may determine why certain member information needs to be collected and how it is used for its own administrative purposes.
Kitabu Yetu may process that information on behalf of the relevant group or organization to provide the services.
Groups and organizations using Kitabu Yetu are responsible for:
- collecting information lawfully;
- providing appropriate notices to their members;
- obtaining consent where required;
- ensuring that administrators are authorized;
- using member information appropriately; and
- complying with applicable data-protection requirements.
Where required, Kitabu Yetu may enter into additional data-processing arrangements with organizations or enterprise customers.
14. Who May Receive Your Information
We may disclose or provide access to personal information where necessary and lawful.
Recipients may include:
Your Group or Organization
Authorized administrators and officers may access information necessary to perform their responsibilities within Kitabu Yetu.
Access is controlled according to user roles and permissions.
Authorized Organization Users
Where an organization manages groups or programmes through Kitabu Yetu, authorized organization personnel may access information relevant to the groups or programmes they are responsible for.
Service Providers
We may use third-party providers to support our services, including providers of:
- cloud hosting;
- databases;
- payment processing;
- mobile-money services;
- SMS delivery;
- email delivery;
- authentication;
- analytics;
- customer support;
- security;
- infrastructure; and
- other technology services.
Such providers will only receive information necessary for the services they provide and will be subject to appropriate contractual, technical, or organizational safeguards where required.
Legal and Regulatory Authorities
We may disclose personal information where required or permitted by law, including in response to:
- court orders;
- lawful requests from authorities;
- regulatory requirements;
- investigations;
- fraud prevention; or
- protection of legal rights and safety.
15. We Do Not Sell Personal Information
Kitabu Yetu does not sell or rent personal information to third parties.
We may, however, use aggregated, anonymized, or otherwise appropriately de-identified information for legitimate purposes such as service analytics, research, reporting, and product improvement where permitted by applicable law.
Such information should not reasonably identify an individual.
16. Marketing and Communications
Kitabu Yetu may send service communications that are necessary to operate your account or provide requested services.
These may include:
- payment notifications;
- contribution reminders;
- meeting reminders;
- security alerts;
- account notifications;
- service updates;
- support communications; and
- other operational messages.
Where we send promotional or marketing communications, we will provide appropriate mechanisms for opting out where required.
Opting out of marketing communications does not necessarily stop essential service or security communications.
17. SMS and Email Communications
If you or an authorized group or organization uses Kitabu Yetu communication services, we may process telephone numbers and email addresses to deliver requested communications.
For example, Chama Reminder may be used to send:
- meeting reminders;
- contribution reminders;
- payment notifications;
- birthday or member messages;
- campaign communications; and
- other group-approved notifications.
The group or organization requesting the communication is responsible for ensuring that it has the appropriate authority and lawful basis to send the communication.
18. Payment Information and Third-Party Payment Providers
Kitabu Yetu may integrate with payment providers to facilitate supported transactions.
Depending on the payment method, relevant information may be transmitted to the applicable provider.
Payment providers may independently process information under their own terms and privacy policies.
Kitabu Yetu does not control the privacy practices of independent third-party providers and users should review their applicable policies where relevant.
19. Data Security
We implement reasonable technical and organizational measures designed to protect personal information.
These measures may include:
- access controls;
- role-based permissions;
- authentication mechanisms;
- encryption where appropriate;
- secure hosting infrastructure;
- audit logging;
- monitoring;
- backup and recovery controls;
- security testing;
- vulnerability management; and
- internal security procedures.
Access to personal information is limited according to operational requirements and authorized roles.
No online system can be guaranteed to be completely secure. We therefore encourage users to maintain strong passwords, protect their authentication credentials, and report suspected security incidents promptly.
20. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.
Retention periods may depend on:
- the type of information;
- the nature of the service;
- contractual obligations;
- financial and accounting requirements;
- legal obligations;
- dispute resolution;
- security requirements;
- fraud prevention; and
- legitimate business or operational requirements.
Group financial records may need to be retained for longer periods to preserve accounting history, audit trails, transaction integrity, and organizational records.
When information is no longer required, we may securely delete, anonymize, or otherwise dispose of it in accordance with applicable requirements.
21. Access to Your Personal Information
You may request access to personal information that Kitabu Yetu holds about you, subject to applicable law.
Where appropriate, we may first verify your identity before fulfilling an access request.
For information maintained by a group or organization, you may also need to contact the relevant group or organization where it is the party responsible for the underlying record.
22. Correction of Personal Information
You may request correction of personal information that is inaccurate, incomplete, or misleading.
Where you can update information directly through the Platform, you may do so using the relevant account or profile functionality.
Where information is maintained by an authorized group or organization, correction may require the group's or organization's authorized administrator to update the underlying record.
We may retain an audit history of changes to financial or administrative records where necessary to maintain accountability and transaction integrity.
23. Deletion of Personal Information
You may request deletion of personal information where permitted by applicable law.
A deletion request may not always result in immediate or complete deletion.
For example, information may need to be retained where:
- required by law;
- necessary for financial or accounting records;
- required for fraud prevention;
- necessary to establish or defend legal claims;
- required to preserve transaction history;
- necessary for security; or
- otherwise permitted or required by law.
Where deletion is not legally or operationally possible, we may explain the applicable reason and restrict processing where appropriate.
24. Data Portability
Where applicable, you may request a copy of certain personal information in a structured and commonly usable format.
For group and organizational records, the availability and scope of export may depend on the relevant product, subscription, contractual arrangement, and applicable law.
25. Data Breaches and Security Incidents
If Kitabu Yetu becomes aware of a personal-data breach requiring notification under applicable law, we will take appropriate steps to investigate, contain, mitigate, and report the incident as required.
Where legally required, affected individuals and relevant authorities will be notified within the applicable statutory requirements.
26. Cookies and Similar Technologies
Kitabu Yetu may use cookies and similar technologies to:
- keep users signed in;
- maintain secure sessions;
- remember preferences;
- improve website functionality;
- understand Platform performance;
- identify technical problems; and
- improve user experience.
Where applicable, you may control certain cookie settings through your browser or device.
Disabling certain cookies may affect Platform functionality.
27. Children's Privacy
Kitabu Yetu is primarily intended for use by adults and community organizations.
Where personal information relating to a minor is collected or processed through a group, organization, programme, or other legitimate activity, the relevant organization is responsible for ensuring that the processing complies with applicable legal requirements and that appropriate authorization is obtained where required.
Kitabu Yetu will process such information only for legitimate and authorized purposes.
28. International Data Transfers and Third-Party Infrastructure
Kitabu Yetu may use technology and service providers whose infrastructure or personnel may be located outside Kenya.
Where personal information is transferred outside Kenya, we will apply appropriate safeguards and comply with applicable requirements governing cross-border transfers of personal information.
Third-party providers may include cloud infrastructure, communications, payment, security, analytics, and other technology providers necessary to operate the Platform.
29. Your Responsibilities
You are responsible for protecting the privacy of other individuals whose information you submit to Kitabu Yetu.
If you are a group official, organization administrator, or other authorized user, you should:
- only collect information necessary for legitimate purposes;
- ensure members are appropriately informed;
- obtain required permissions or consent;
- protect account credentials;
- restrict access to authorized persons;
- avoid downloading or sharing member information unnecessarily; and
- promptly report suspected unauthorized access or data breaches.
You must not use Kitabu Yetu to collect, disclose, or process personal information unlawfully.
30. Privacy and Third-Party Links
Kitabu Yetu may contain links or integrations to third-party websites and services.
This Privacy Policy does not govern the privacy practices of those independent services.
You should review the privacy policies applicable to third-party services before providing them with personal information.
31. Customer Care and Privacy Requests
If you have questions about this Privacy Policy, believe your personal information has been handled improperly, or wish to exercise a privacy right, you may contact Kitabu Yetu.
Email: info@kitabuyetu.co.ke
When submitting a privacy request, please provide enough information for us to understand and verify your request.
We may request additional information to verify your identity before providing access to personal information or processing certain requests.
32. Data Protection Contact
For privacy and data-protection matters, Kitabu Yetu may designate an appropriate person or team responsible for handling data-protection requests.
Where a Data Protection Officer or equivalent contact is formally appointed, the relevant contact details will be published through the Kitabu Yetu website and applicable privacy notices.
33. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- changes to our products and services;
- changes in applicable law;
- changes in technology;
- changes in our data-processing practices;
- security developments; or
- improvements in privacy practices.
When we make material changes, we will take reasonable steps to notify affected users where required.
The latest version will be published through the appropriate Kitabu Yetu channels.
The "Last Updated" date at the beginning of this Privacy Policy indicates when the policy was most recently revised.
34. Governing Law
This Privacy Policy is governed by the applicable laws of the Republic of Kenya, including the Data Protection Act, 2019 and applicable regulations.
Any dispute concerning the processing of personal information will be addressed in accordance with applicable Kenyan law.
35. Contact Information
Kitabu Yetu
Website: kitabuyetu.co.ke Privacy & Support: info@kitabuyetu.co.ke
Kitabu Yetu is committed to helping community groups and organizations digitize their records while respecting the privacy, security, and rights of the people whose information they entrust to the Platform.
© 2026 Kitabu Yetu. All rights reserved.