Privacy Statement

Premier Bank Kenya Privacy Statement

1. Purpose and scope

Premier Bank Kenya (“PBK” or “We”) is committed to protecting the personal data of all our clients and other data subjects (“You”)

This Privacy Notice (“Notice”) informs you of:

Who we are;
What personal information we collect about you;
How we collect, use, store and share your personal data;
Your privacy and other related rights under the provisions of the Data Protection Act and Regulations; and
How to contact us or the Office of the Data Protection Commissioner (ODPC) if you have a complaint.

We are committed to preserving the privacy of your data so that we can:

deliver services of a high quality to all our clients;
at all times comply with the law and the various regulations that we are subject to;
preserve the confidentiality of your personal data;
meet the expectations of customers/clients; and
protect our reputation.

We advise that you read and understand this Notice as we want to be sure that you are fully cognizant of how and for what purposes your data is being used.

2. Who we are.

Premier Bank Kenya is a commercial bank licensed and regulated by the Central Bank of Kenya. Our Head Office is located at Mihrab Building, Mez1, Ring Road, Kilimani; P.O Box 26219-00100 Nairobi, Kenya.

It is imperative that we mention that in order that we can provide services that satisfactorily exceed your expectations, we need to collect, use, and process or deal with, certain personal information about you. When we do so we are subject to the provisions of the Kenya Data Protection Act, 2019.

This statement will apply where we are acting as a data controller in relation to your personal data, and where we have a supervisory role in relation to how personal data is collected, stored, used and shared. As such, we are responsible as what is described as a ‘data controller’ of that personal information for the purposes of the Act, as we decide how to use that information about you – hence, we are primarily responsible for that data; this may include your name, date of birth, address, contact information, financial information, employment details and device identifiers, including IP addresses.

Do note that the ‘processing’ of your personal data within this context, we refer to using your personal data by collecting it, using it, storing it, communicating it to other people (with your consent or as part of our services to you) or deleting it.

Furthermore, the terms and provisions of this Notice may be changed, updated and amended from time to time. If that happens, during the time when we are providing you with our products and services, we will inform you of those changes.

3. Your personal data

While providing our services, we will collect some information about you, some of which will be termed personal data. Personal data is any information that may be used to identify an individual (natural person).

The personal information we will collect from you include:

Your name and personal details, including your date of birth, your ID number and other identification details;
Your contact details including address, telephone and or mobile number, and email address;
Financial details relating to you, including details of your bank account if money is, or is likely to need to be, sent to you, billing information and debit / credit card details, and your financial history;
Transactional history details (for example, payments you make and receive); and
Proof of income (such as payslips or bank statements) if you provide these when you apply for a particular product.

Do note that any information that we possess about you is collected directly from you through your interactions with our services. This may be through your visits to our various branches and online platforms; contacting us by email, letters, telephone or through our website or social media handles; using our internet and mobile banking services through the MyPremier Mobile and Internet Banking applications.

There are other instances in which we will collect information about you from other sources if need arises. Examples of these sources include;

people appointed to act on your behalf (e.g., advisers, agents, joint account holders, lawyers);
from third parties with whom you have a relationship, including banks, employers, and professional bodies;
credit reference bureaus (who may check their information against other databases – public or private – they have access to);
fraud prevention agencies; and
publicly available sources, such as land and companies’ registries, professional records, and other membership records; online registers or directories.

This information is needed so that we can provide effective and efficient products and services to you. If you do not provide the personal data asked for, we may be delayed or prevented from providing such products and services.

Please note that it is paramount that we try as much as possible to keep your information as accurate and as current as possible. We ask that you keep us informed if any changes occur regarding your personal data during the tenure of your relationship with us.

4. Personal data belonging to children

The Bank provides services and products which are principally aimed at children.

Please note that we do not intentionally process personal data relating to children without the verifiable consent of their parent/s or legal guardian. If we become aware that we have inadvertently collected personal data of a child/minor without verifiable consent, we will take appropriate measures to delete that information as soon as possible.

We encourage parents and guardians to be involved in their children’s online activities and to monitor and supervise their children’s use of our website or services.

In the event you are a child, or if you represent the interests of a child, and you wish to seek further clarification on how we use your data, please reach out to us using the details in the Complaints section, and we will be able to advise further.

5. Sensitive personal data

Sensitive personal data includes details about your race or ethnicity, conscience, belief, sex life, sexual orientation, health and genetic data. Do note that we only process such data where necessary and where it is most relevant.

That said, it is important that you take note that such data will only be used if it is deemed necessary for the public interest, as part of a legal proceeding, or if we have obtained your explicit consent. We ensure that all legal requirements are met in the handling of this information.

6. Purposes for use of your information.

We only collect your personal information for the purposes for which it was collected, or where we have a proper reason for using it.

Such proper reason or legal basis for processing such data include:

Where you have given consent to the use of your personal data for one or more specific purposes. This may include marketing or advertising purposes, for instance. Please note that you may withdraw your consent at any time as set out in this Notice – and withdrawn consent does not affect the legality of data processed prior to such withdrawal;
Where the use is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering a contract;
Where the use is necessary for compliance with a legal obligation that we are subject to, including preventing fraud, money laundering or regulatory obligations;
Where the use is necessary to protect your vital interests or those of another person;
Where the use is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in us. In the case of sensitive personal data, it is in the substantial public interest (e.g., to support you if you are or become a vulnerable customer); and
Where the use is necessary for the purposes of our legitimate interests or those of a third party, except where those interests are overridden by your interests or fundamental rights and freedoms.

As such, it is purely on a legal and lawful purpose that we collect your personal information.

In this context, such purposes include:

to provide and avail our products and services to you;
to prevent fraud and money-laundering, and to verify and confirm your identity before we provide services to you;
to communicate with you;
to protect our business interests or to prevent fraud;
to meet obligations, we have under any laws, rules, and regulations that apply to any of the products and services we provide to you; and
to keep you informed about products and services you hold with us and to send you information about products or services (including those of other companies) which may be of interest to you.

The following table goes a step further in highlighting how your personal data may be utilized and the lawful bases that the purpose for use are founded upon.

Legal/Lawful	Basis Purpose
Consent	Some of the services provided based on your consent include; ➢ Keeping in touch with you about your account and providing you with information regarding our relationship with you. ➢ Updating you about the services we offer, including information about new products, promotions and rewards, and other services we have that may interest you. ➢ Utilizing your biometric information for our due diligence checks, such as fraud and money laundering checks and or authenticating and verifying your identity.
Performance of contractual obligations	Our contractual obligations may include; ➢ Keeping you updated about your account and other related information involving our relationship with you. ➢ Responding to your complaints, comments, and reviews about our services. ➢ Handling enquiries, providing statements and providing you with further information you request from us regarding the products or services you have with us. ➢ Complying with specific banking product requirements e.g., loans, securities, accounts and deposits. ➢ Exercising rights that we have under any agreement we have with you, including collecting and or receiving debts, handling securities and debentures, providing support in the execution of transactions.
Legal Obligations	➢ Completing our contractual obligations owed to you by managing your account with us; providing services to you; communicating to you regarding your account and other related information regarding your relationship with us; handling enquiries and complaints and other requests you may have. ➢ Detecting, investigating, preventing, and prosecuting criminal activities. This includes fraud and anti-money laundering checks, checks for other crimes, and identity checks. ➢ Sharing your information with other institutions such as the relevant regulatory agencies, law enforcement, tax authorities, fraud prevention agencies and credit reference bureaus. ➢ Conducting technical assessments such as system tests as well as profile analysis, including behavioural scoring, and creditworthiness scoring. ➢ Recording your image on our CCTV surveillance systems when you visit our premises across our locations – head office, branches network and ATMs.
Legitimate Interest	These include; ➢ Assisting in opening and managing your accounts and maintaining our relationship with you – We are able to fulfil our legitimate interest of protecting our business interests as well as our customers’ interests ➢ Updating you about the products and services we offer you as our customer, as well as information about products, services, rewards, offers, promotions and contests (including those from other companies) that may interest you – it’s in our legitimate interest to share information with you about products or services that may be relevant and beneficial to you. You can always opt-out from any marketing messages we send out as set out in this Notice ➢ Sharing your information with relevant credit reference bureaus, fraud prevention agencies – it’s in our legitimate interest to carry out certain creditworthiness assessments so that we can make responsible business decisions. We need to make sure that we only provide certain products and services to individuals if they are appropriate and to manage the services we provide effectively, for instance, in cases wherewe suspect potential payment difficulties. ➢ Sharing your information with relevant regulatory agencies, tax authorities, law enforcement agencies – it’s in our legitimate interest to help prevent and detect criminal activities including fraud and money laundering, and to cooperate with lawful requests from government agencies; ➢ Sharing your information with other third parties such as our partners and service providers – it’s in our legitimate interest to use other service providers to provide some services for us and or on our behalf; ➢ Conducting assessments, testing, analysis (including credit and behaviour scoring) and market research, where we produce reports and statistics to enhance our offerings and maintain a competitive edge while ensuring a high level of customer satisfaction. When conducting analysis, we may merge the information we possess with information obtained from outside sources. – our legitimate interests are to continually improve and innovate our operations, including the development of new systems, products and services to achieve high levels of customer satisfaction. Most important to note is, the resulting information we produce and share will not identify you as an individual and cannot be attributed to you; ➢ Handling enquiries and complaints – it’s is well within our legitimate interests to make sure that complaints are investigated, resolved and prevented from reoccurring and ensure you receive the best customer experience; ➢ Evaluating, developing and improving our services to you – it’s in our legitimate interest to constantly assess, enhance, or upgrade our offerings and the user experiences on our platforms to ensure high levels of service to our customers; ➢ Asserting and defending a legal claim – We have a legitimate interest in protecting the Bank from financial loss and potential legal liability arising from the fallout. ➢ Collecting any debts you owe to us – it’s in our legitimate interest to ensure the efficient and effective management of our business operations, including protecting and recovering owed debts and safeguarding our assets; ➢ Recording your image on our CCTV surveillance system when you visit out premises across our head office, branch network and ATMs – it’s in our legitimate interest to prevent criminal activity, protect our business and comply with various laws and regulations; ➢ Monitoring, recording and analysing any communications between you and us, including phone calls – it’s in our legitimate interest to verify your instructions to us, in order to avoid and uncover fraud and other criminal activities (including identity theft), to analyse, evaluate and enhance our services to customers and for training purposes, to enhance the services we offer to our customers and to secure our business interests; ➢ Protecting our business interests and developing our business strategies – it’s in our legitimate interest to ensure the success and growth of the Bank, by safeguarding its assets, managing its resources efficiently and effectively, and planning for its future development. This involves analysing market trends, customer needs and preferences, and other factors that could impact the business and making informed decisions about the direction of the company. By doing so, the Bank can remain competitive and provide a high level of service to its customers.

7. How your personal information is stored

We will securely keep your personal data at all times.

We will ideally retain your information for a period of seven (7) years, during which we will implement security measures to protect your personal data from being lost, misused, or accessed without permission. We may hold your personal information for longer depending on the nature of your data and the purpose for which it was collected. Some of the instances include legal hold – a process that the Bank uses to preserve all forms of relevant information when litigation is reasonably anticipated. This would then require us to keep records for an undefined period.

Our retention of your personal information enables PBK to comply with its regulatory obligations. Your personal information will only be accessible to those individuals with a valid need to access it, and appropriate measures will be taken to maintain confidentiality during processing.

When it is no longer necessary to retain your personal data, we will securely delete or anonymize it.

8. Your legal rights

The Kenya Data Protection Act offers you, the data subject, several rights in relation to the personal data that we hold. These rights are afforded to you without charge and only by virtue as you are having the status of a data subject.

As holders of your information, we are bound to respond to your requests within reasonable time limits.

These include:

Right to access – this encompasses the right to seek confirmation as to whether your personal data is being processed, and, where that is the case, access to that personal data and various other information, including the purpose for the processing, with whom the data is shared, and for how long the data will be retained.
Right to data portability – this right allows you to ask us to give you or a third party an electronic copy of the personal data you have given us.
Right to rectification – this right provides you with the prerogative to ask us to correct personal data we hold.
Right to restriction of processing – this right allows you to restrict how we use your personal data.
Right of erasure – this provides you with the opportunity to ask us to delete personal data.
Right to object – you have the right to object to ways we are using your personal data.
Right to object to any automated decision-making – This right has been elaborated further in the ‘Automated decision-making’ section below.
Right to withdraw any permission you have previously given to allow us to use your information – This is elaborated in the ‘Withdrawal of Consent’ section below.

Your ability to exercise these rights may be influenced by several factors. In some cases, we may not be able to accede to your request due to a valid reason; or if the specific right is not applicable to the information which we possess concerning you.

9. Sharing your information

We will from time to time share your information with third parties.

We will always ensure that those with whom it is shared with process it in an appropriate manner and take all necessary measures to protect it. In doing so we will impose contractual obligations on all such parties to ensure that your personal data is kept secure. We will only ever allow others to handle your personal data if we are satisfied that their measures to protect your personal data are satisfactory.

Such parties and instances in which we may share your personal information include.

9.1. PBK’s branch network and subsidiaries – PBK aims to provide quality services to its customers. By sharing your information, we can provide services which you have requested. Purposes for sharing information include marketing purposes, for internal reporting on its customers within its branch network.

9.2. Government institutions/regulators (e.g., KRA, EACC, CBK, FRC) and fraud prevention agencies – We may share information with them to help fulfil their lawful duties such as criminal investigations, or prevention of crime.

9.3. Credit Reference Bureau (CRB) – Our purpose for sharing your information with CRB is for due diligence purposes such as identity and background checks while making decisions about your ability to obtain credit.

9.4. Insurance providers – We may share personal data with insurance providers including underwriters, brokers, introducers, claims handlers and other such associated third parties to enable us to provide services requested.

9.5. Representatives/advisers – We may be obligated to share personal data with your representatives/advisers (such as accountants, lawyers, and other professional advisers) who you have authorised to represent you, or any other person you have told us is authorised to give instructions, or use the account, products, or services, on your behalf (such as under a power of attorney).

9.6. Third party payers – We may share your name with anyone paying money into your account to confirm payment is being made to the right account.

9.7. Payment-processing service providers – We may share personal data with payment-processing companies and other businesses that assist us in processing your payments, as well as financial institutions that are members of the payment schemes (e.g., Visa) or involved in making payouts for specific types of payment.

9.8. Our service providers and agents (including their subcontractors) – We may share personal data with our service providers. For instance, where we pass your details to someone who will print your statements or deliver a debit/credit cards/cheque book.

10. Transfer of data outside Kenya

We may from time to time be required to transfer your personal information outside Kenya to meet our legal and or contractual obligations.

In the event your personal information is required to be transferred outside Kenya, we are bound by the Kenya Data Protection Act to ensure that the organisations to which we transfer your information adequately provide a reasonable, if not equivalent level of protection to your information as we do.

Any contract that we form with any such organizations will spell out conditions they need to meet to adequately protect the information they receive.

11. Automated decision making

We implement automated decision-making processes using your personal information tailored towards specific situations. Some of these situations work towards fulfilling legal or contractual obligations, as well as preventing occurrence of a crime.

Such situations may include:

When we are making decisions on what services are suitable to you based on your customer portfolio; or whether to offer you credit, based on an assessment of your credit history.
When conducting financial crime checks.

Further, we analyse and process your personal information and reconcile it to various factors based on your customer portfolio which helps us provide personalized experience of services unique to you as our valued customer; We refer to this as profiling. This helps us provide incentives such as personalized offers and recommendations for a better experience utilizing our services.

We have indicated that you have rights regarding automated decision making which has been indicated in the ‘Your legal rights’ section in this Notice. Our contact information has been indicated in the Complaints section below in case you may need further clarification on this.

12. Face Data and Biometric Information

Premier Connect – Premier Bank Kenya

Our application, Premier Connect, operated by Premier Bank Kenya, uses facial data solely to verify the identity of customers by comparing their live facial image with the image on a government-issued identification document. This functionality is powered by the Regula Document Reader SDK, which operates entirely on the user’s device.

We provide full transparency on our handling of face data as follows:

a.) Face Data Retention

We do not retain or permanently store any face data. All face data is processed in real time and is immediately discarded upon completion of the verification process.

b.) Reason for Using Face Data

Face data is used exclusively to perform customer identity verification to comply with legal and regulatory requirements, including Know Your Customer (KYC) and anti-fraud obligations.

c.) Length of Time Face Data is Stored

Face data is only used temporarily during the active verification session. It is not stored after the session ends. Therefore, there is no retention period. We never store face data indefinitely.

d.) Third Parties We Share Face Data With

We do not share, disclose, or transmit face data to any third party. All face matching is conducted locally on the device.

Reasons for Sharing Face Data with Third Parties

Not applicable. We do not share any face data with third parties.

Third Party Face Data Storage and Practices

Not applicable. No third party receives access, or store any face data from our application.

Premier Bank Kenya is committed to protecting your privacy and safeguarding any sensitive information collected through Premier Connect.

How We Share Information with Other Parties

We share your personal data in the following ways:

With Third-Party Service Providers: Contracted by Premier Bank Kenya for operations like transaction processing, fraud prevention, and marketing. They can only use your data for services to us.
With Third Parties for Money Transfers: Your name is shared to confirm recipient identity in the mobile application.
During Capital Raising or Sale Processes: To prospective buyers, we may disclose your personal data including KYC and usage data.
With Law Enforcement and Government Officials: Only upon legal requests like subpoenas or when necessary for legal compliance, reporting illegal activities, or investigating our Terms violations.

We promise not to sell or transfer your data for third-party promotional purposes without explicit consent.

13. Withdrawal of consent

You have the right to withdraw your consent for the processing of your personal data at any time.

To do so, please contact us using the details provided in the ’Complaints’ section below.

Please note that withdrawing your consent does not affect the lawfulness of any processing that was carried out before you withdrew your consent. Further, in some cases, we may be required to continue processing your personal data despite your withdrawal of consent, for example, where we have a legal obligation to do so. The details regarding this have been reflected in the table drawn in the ‘Purposes for use of your information’ section.

14. Cookies

We employ the use of cookies and similar technologies across our websites, applications and e-mails. Cookies are small text files that are stored on your computer or mobile device when you visit a website or use an application. These cookies are then recognized by the website or app upon subsequent visits.

We use cookies as a means of information gathering and mainly aimed at curating your online experience by remembering your preferences, and letting you efficiently navigate between pages; and above everything else, improving your whole online experience.

We have implemented a cookie policy on our websites and applications which provides additional information about cookies, how and where we use them, and how you can control your preferences.

15. Complaints

Should you have any complaints or queries about anything relating to the privacy of your personal data, or any other data protection issues, please let us know through:

Address: Premier Bank Kenya, Mihrab Building, Mez1, Ring Road, Kilimani;

P.O Box 26219-00100.

Phone: 0202843000/0725843000

Email: dpo@premierbank.ke

Additionally, you also have the right to make a complaint at any time to the ODPC, which is the supervisory authority for data protection issues in the Republic of Kenya. You may lodge a complaint with the ODPC through: https://www.odpc.go.ke/file-lodge-a-complaint/