“VCB,” “We,” “our,” “ours,” and “us,” means Victoria Commercial Bank PLC.
“Personal data” or “personal information” means: Information about you or information that identifies you as a unique individual.
“Processing” collectively means handling, collecting, using, altering, merging, linking, organizing, disseminating, storing, protecting, retrieving, disclosing, erasing, archiving, destroying, or disposing of your personal information.
References to “You” means:
• Customer: the person who subscribes to, uses, or purchases any of our products and services or accesses our websites and includes any person who accesses any of the products and services you have subscribed to.
• Any vendor/partner/contractor/Business counterparties who has signed an agreement with us.
• Any visitor that is a person (including contractors/subcontractors or any third parties) who gains access to any VCB premises.
• Any person in contractual capacity with VCB in relation to such data protection obligations including staff.
• Any supplier who has been contracted by VCB and executed a Supplier contract.

To preserve the confidentiality of all information you provide to VCB, we maintain the following privacy principles:
• VCB collects personal information that we believe to be relevant and required to understand your financial needs and to conduct our business.
• We collect and process your personal information solely for the purpose of providing financial services and complying with legal and regulatory requirements.
• VCB shall use personal information to provide you with better customer services and products. All VCB staff and all third parties with permitted access to your information are specifically required to observe our confidentiality obligations.
• VCB may pass your personal information to other agents, as permitted by law.
• VCB may be required from time to time to disclose your personal information to Governmental or judicial bodies or agencies or our regulators, but we will only do so under proper authority.

The bank will only collect personal data about you insofar as is necessary to achieve the purposes set out in this privacy statement. We collect your personal information with your knowledge and consent with the exception to cases where prior consent cannot be obtained for real reasons and the processing of the data is permitted by law.

VCB uses the collected data for various purposes:
• Processing products and services that you have requested for.
• Responding to any of your queries or concerns. Verifying your identity information through publicly available and/or restricted government databases to comply with applicable regulatory requirements.
• Carrying out credit checks and credit scoring.
• Keeping you informed generally about new products and services and contacting you with offers or promotions based on how you use our products and services unless you opt out of receiving such marketing messages (you may contact VCB at any time to opt out of receiving marketing messages).
• To comply with any legal, governmental, or regulatory requirement or for use by our lawyers in connection with any legal proceedings.
• To notify you about changes to our product and service.
• To allow you to participate in interactive features of our Service when you choose to do so.
• To gather analysis or valuable information so that we can improve our Services.
• Any other legitimate reasons.

Usage Data is defined as “data collected automatically either generated using the Service or from the Service infrastructure itself (for example, the duration of a page visit).
We may also collect information that your browser sends whenever you visit our Service or when you access the Service by or through a mobile device (“Usage Data”).
This Usage Data may include information such as your computer’s Internet Protocol address (e.g., IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
When you access the Service by or through a mobile device, this Usage Data may include information such as the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers and other diagnostic data.

We may use and store information about your location if you give us permission to do so (“Location Data”). We use this data to provide features of our Service, to improve and customize our Service.
You can enable or disable location services when you use our Service at any time, through your device settings.

We may use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities on our website. This information is used to improve our website, analyze trends, and deliver personalized content. You can control the use of cookies through your browser settings, but please note that disabling cookies may affect certain features or functionality of the Website.

The Bank may, from time to time, share your personal data with third parties. Such disclosures will be done in accordance with the law and, where necessary, with your consent.
Below are some of the circumstances under which your personal data may be shared:
• The Government (and Government Agencies): Your personal data may be shared with law enforcement agencies, revenue collection agencies and other regulatory bodies where such disclosure is mandated by the law.
• Credit Rating Bureaus: Your credit information may be shared with licensed Credit Rating Bureaus.
• Other Financial Institutions: Your personal data may be shared with other financial institutions for the purposes of performing certain transactions in which you are involved.
• Court Orders: Your personal data may be shared in the event that a court order is obtained requiring that such information be shared.
• Acquisition of the Bank: Your personal data shall be disclosed within the context of a merger or acquisition of the Bank. Such disclosure will be done under strict security measures to ensure that information is not moved unnecessarily.
• Service Providers: Your personal information may be disclosed to our service providers where necessary to provide certain services to you or to protect the legitimate interests of the Bank (including in the enforcement of a legal claim).
• Any other instances where the bank needs to fulfil legal and regulatory obligations.

We may use your personal information to contact you for market research or to provide you with information about other services we may think would be of interest to you. You may be required to opt-in or give any other form of explicit consent before receiving marketing messages from us. We respect your right to control your personal data depending on which of our products you use. Therefore, at a minimum, we will always give you the opportunity to opt-out of receiving such direct marketing or market research communications. You may exercise this right to opt-out at any time.

You have the right to access, update, correct, or delete your personal information. You may also opt-out of receiving promotional emails or newsletters by following the unsubscribe instructions provided in those communications. Please contact us using the information provided below to exercise your rights or for any privacy-related inquiries.

Subject to legal and contractual exceptions, you have rights under data protection laws in accordance with the applicable laws within Kenya and any other foreign laws. Your data protection and privacy rights are listed below:
• The right to access, update or to delete the information we have on you. Whenever made possible, you can access, update or request deletion of your Personal Data directly within your account settings section. If you are unable to perform these actions yourself, please contact us to assist you.
• The right of rectification: You have the right to have your information rectified if that information is inaccurate or incomplete.
• The right to object: You have the right to object to our processing of your Personal Data.
• The right of restriction: You have the right to request that we restrict the processing of your personal information.
• The right to data portability: You have the right to be provided with a copy of the information we have on you in a structured, machine-readable, and commonly used format.
• The right to withdraw consent: You also have the right to withdraw your consent at any time where VCB relied on your consent to process your personal information.

You have the right to complain to the Data Protection Commissioner about our collection and use of your Personal Data if we are in breach of the above rights.

• Business Transaction
We may disclose your Data if we are involved in a merger, acquisition, or asset sale. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy statement.

• Disclosure for Law Enforcement
We may also disclose your Data if required to do so by law or in response to valid requests by authorized public authorities (e.g., a court or authorised government agencies etc).

• Legal Requirements
VCB may disclose your Personal Data in the good faith belief that such action is necessary to:
1. To comply with a legal obligation.
2. To protect and defend the rights or property of VCB.
3. To prevent or investigate possible wrongdoing in connection with a Service offered.
4. To protect the personal safety of users of the Service or the public; and
5. To protect against legal liability.

The Bank may transfer your personal information for the purpose of effecting/implementing, administering, and securing any product or service that you have applied for or for other purpose set out in this privacy statement.
At VCB, we understand the importance of protecting your personal information. In the event that your information, including Personal Data, needs to be transferred to a location outside of your state, province, or country, we ensure that appropriate measures are in place to safeguard the security of your data. If you choose to provide your information to us, and you are located outside of Kenya, please be aware that your information, including Personal Data, may be transferred to Kenya, and processed there. By consenting to this Privacy Statement and /or submitting your information, you agree to this transfer. VCB is committed to ensuring that your personal information is treated securely and in accordance with this Privacy Statement. We only transfer your Personal Data to countries with adequate controls in place to protect the security of your information.

At VCB, the protection of your personal information is of utmost importance. We maintain rigorous security measures to protect your data against unauthorized access, alteration, or disclosure. While we implement commercially reasonable security measures to safeguard your data, no method of transmission over the Internet or electronic storage is completely secure. Our valued customers are obligated to take an active role in ensuring the security of their personal information. To avoid unauthorized access to your account, it is vital to keep your User ID and password confidential and not share it with anyone. Additionally, we require our customers to immediately inform us in the event of any suspected or confirmed the security breach, such as the disclosure of your User ID and password to a third party, loss, or theft.
In the event that you think and or know your User ID and/or password has been disclosed to a third party, is lost, or stolen and unauthorized transactions may have been conducted, you are responsible to inform us immediately.

VCB will retain your personal data only for as long as is necessary mandated by law to achieve the purpose for which they were collected. The following retention criteria is used:
• Where we have an ongoing relationship with you.
• To comply with a legal obligation to which it is subject.
• Where retention is advisable to safeguard or improve the Bank’s legal position.
We will normally destroy or erase data after statutory timelines lapse. However, we may retain your information, or information relating to your account after you cease to be a customer for longer than this, provided it is necessary for a legal, regulatory, fraud prevention or other legitimate business purpose.

Our website may contain links to third-party websites or services that are not operated or controlled by us. We are not responsible for the privacy practices or content of these third-party websites. We encourage you to review the privacy statements of those websites before providing any personal information.

The bank reserves the right to amend or modify this statement at any time. If the bank amends this statement, you can access the most current version of the privacy statement through our website. Any amendment or modification to this statement will take effect from the date of notification on the VCB website and your continued use of the Website after such changes constitutes your consent to the revised privacy statement.

We may communicate with you via electronic mail (e-mail), post, phone, text, and other digital methods. We will never ask you for any of your password(s). When you contact us through any of our communication channels including visiting a local branch or calling the telephone banking service, we will verify your identity by asking you a number of questions based on information known to us about you and the transactions on your account. We may record your calls for training, quality and security purposes.

If you have any clarifications and feedback about this Privacy statement, please contact us as below:
Data Protection Officer,
Email: dpo@vicbank.com
Address: Mezzanine Floor, Victoria Towers, Kilimanjaro Avenue, Upper hill, Nairobi Kenya.