Privacy Policy - Pride Bank Ltd

1) INTRODUCTION

Your privacy is important to us.
This Privacy and Data Protection Statement explains how Pride Bank Limited (“Pride Bank”, “the Bank”, “we”,
“us”, or “our”) collects, processes, stores, protects and shares personal data.
As a licensed financial institution regulated by the Bank of Uganda (BoU), Pride Bank is committed to
processing personal data lawfully, fairly, transparently and securely in accordance with:

a) The Data Protection and Privacy Act, 2019

b) The Financial Institutions Act

c) The Anti-Money Laundering Act (AMLA)

d) Regulations issued by the Bank of Uganda

e) Other applicable Ugandan laws

This Statement applies to:

a) Customers and prospective customers

b) Guarantors, beneficial owners and authorized signatories

c) Employees and job applicants

d) Agents, contractors and service providers

e) Visitors to our premises

f) Users of our website, mobile applications and digital platforms

This Statement should be read together with our account terms and conditions and product-specific
agreements. Where there is any conflict relating to personal data protection, this Statement shall prevail.

2) DEFINITIONS

“Personal Data” means any information relating to an identified or identifiable natural person as defined
under the Data Protection and Privacy Act, 2019.
“Processing” includes collection, recording, organization, storage, use, disclosure, transmission, erasure or
destruction of personal data.
“You” means any individual whose personal data is processed by Pride Bank.

3) SCOPE AND APPLICATION

This Statement applies to all personal data processed by Pride Bank in the course of its banking and related
operations, whether such processing occurs at our branches, through digital platforms, via third-party service
providers, or through other lawful channels.
It covers personal data processed in connection with:

a) Retail and corporate banking services

b) Credit and lending activities

c) Digital banking platforms

d) Agency banking operations

e) Human resource management

f) Supplier and vendor management

g) Marketing and customer engagement activities

4) COLLECTION OF PERSONAL DATA

A. We collect personal data when you:

a) Open or operate a bank account

b) Apply for a loan or other financial product

c) Execute a guarantee

d) Use mobile banking, internet banking or other digital services

e) Visit our branches or premises (including CCTV surveillance)

f) Contact us via phone, email, or social media

g) Participate in promotions, surveys or competitions

h) Apply for employment

i) Act as a guarantor, next of kin, beneficial owner or authorized signatory

B. We may also collect personal data from:

a) Credit Reference Bureaus licensed by the Bank of Uganda

b) National Identification and Registration Authority (NIRA)

c) Financial Intelligence Authority (FIA)

d) Bank of Uganda and other regulators

e) Fraud prevention agencies

f) Publicly available sources

g) Other financial institutions for lawful verification

We collect only personal data that is necessary and proportionate for legitimate purposes.

5) CATEGORIES OF PERSONAL DATA PROCESSED

We may collect and process the following categories:

A. Identity Information

a) Full name

b) National ID / Passport details

c) Photograph

d) Date of birth

e) Gender

f) Signature

g) Biometric data (where lawful and necessary)

B. Contact Information

a) Phone number

b) Email address

c) Physical and postal address

C. Financial Information

a) Bank account details

b) Transaction history

c) Loan and credit history

d) Income and employment details

e) Tax Identification Number (TIN)

D. Transaction and Usage Data

a) ATM usage

b) Mobile and internet banking logs

c) Device information and IP address

E. CCTV and Premises Data

Video recordings for security and crime prevention

F. Special Categories of Data (Where Applicable)

a) Health information (e.g., insurance-linked services)

b) Biometric data

c) Information required under AML/CFT laws

Special categories of data are processed strictly in accordance with Ugandan law.

6) PURPOSES FOR PROCESSING PERSONAL DATA

Pride Bank processes personal data for legitimate and lawful purposes, including:

a) To establish and maintain customer relationships, including account opening, transaction processing and credit administration.

b) To assess creditworthiness, conduct due diligence and manage financial risk in compliance with prudential and regulatory obligations.

c) To comply with Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) requirements, including customer identification and suspicious transaction reporting.

d) To meet statutory and regulatory obligations imposed by the Bank of Uganda and other competent authorities.

e) To improve service delivery, develop new products, conduct research and perform statistical and analytical assessments.

f) To detect, prevent and investigate fraud, cybercrime and other financial crimes.

g) To communicate service updates, transactional notifications and marketing messages where consent has been provided.

h) To ensure network security, business continuity and operational resilience.

7) LAWFUL BASIS FOR PROCESSING

The Bank processes personal data on one or more of the following lawful bases:

a) The performance of a contractual obligation;

b) Compliance with a legal or regulatory obligation;

c) Legitimate interests pursued by the Bank, provided such interests do not override the rights of the data subject;

d) Consent of the data subject;

e) Protection of vital interests;

f) Public interest obligations applicable to financial institutions

8) DISCLOSURE OF PERSONAL DATA

We may disclose personal data to:

a) Bank of Uganda

b) Financial Intelligence Authority

c) Uganda Revenue Authority

d) Credit Reference Bureaus

e) Law enforcement agencies and courts

f) Payment processors and clearing houses

g) Insurers, auditors and professional advisers

h) Technology vendors and cloud service providers (under binding confidentiality agreements)

All disclosures are made in accordance with Ugandan law. We will obtain your consent before sharing personal
data for direct marketing by third parties.

THIRD PARTIES

We ask third-party service providers to agree to our privacy policies if they need access to any Personal
Information to carry out their services.
We will not disclose your personal information to external organizations that are not our service providers,
unless you gave us your consent, or unless we may do so by law, or if it is necessary for the conclusion or
performance of our agreement with you.

9) INTERNATIONAL DATA TRANSFERS

Where personal data is transferred outside Uganda (e.g., cloud service providers), we ensure appropriate
safeguards are implemented in accordance with the Data Protection and Privacy Act, 2019, including:

a) Contractual data protection clauses

b) Adequate security controls

c) Regulatory compliance assessments

10) DATA RETENTION

We retain personal data:

a) As required under the Financial Institutions Act

b) As required under Anti-Money Laundering laws (minimum 10 years or as prescribed)

c) As required under tax and accounting laws

d) For as long as necessary to fulfill contractual obligations e) For dispute resolution, investigations or litigation

Anonymized data may be retained indefinitely for statistical and research purposes.

11) SECURITY AND SAFEGUARDS

We implement appropriate technical and organizational safeguards including:

a) Role-based access controls

b) Encryption technologies

c) Firewalls and intrusion detection systems

d) Secure IT architecture

e) Physical security controls

f) Staff confidentiality agreements

g) Regular compliance audits and risk assessments

Employees and service providers are subject to strict confidentiality and data protection obligations.

12) COOKIES, WEBSITE TECHNOLOGY AND SOCIAL MEDIA

a) Cookies and website technology: We use cookies and similar technologies to enhance functionality, analyze usage trends, improve user experience, and strengthen security. You may disable cookies in your browser settings; however, some features may not function properly.

b) Website and mobile analytics: We automatically process limited technical data such as device type, browser, IP address, and usage statistics. Data is aggregated and does not identify individuals across other websites.

c) Social media engagement: We operate designated channels and accounts on social media to inform, engage, and assist customers. Comments, posts, and messages may be monitored to improve services. Private messages are only accessible to authorized Bank personnel.

d) Important: Social media sites are not appropriate for discussing personal banking products. Any personal information shared on these sites may be processed by the platform owner outside Uganda.

13) MONITORING AND RECORDING

We may monitor and record:

a) Telephone conversations

b) Electronic communications

c) Digital banking activity

d) CCTV footage

This is done for compliance, training, fraud prevention and security purposes.

14) MARKETING COMMUNICATIONS

Where you have provided consent, we may use your personal data to inform you about products, services, and
offers from Pride Bank or selected partners via email, SMS, mobile applications, or social media. You may optin to receive such marketing communications and may opt-out at any time without affecting mandatory servicerelated communications.
You can opt-out through:

a) Customer service channels

b) Email unsubscribe links

c) Written request

Opting out does not affect mandatory service-related communications. Marketing communications may also
be used for compliance, training, fraud prevention, security, and risk management purposes.

15) MINORS

We do not knowingly process personal data of persons under 18 years without consent of a parent or legal
guardian, except where permitted by law.

16) RIGHTS OF DATA SUBJECTS

Subject to legal limitations, you have the right to:

a) Be informed about the collection of your personal data

b) Access your personal data

c) Request correction of inaccurate data

d) Request erasure (where legally permissible)

e) Object to certain processing

f) Withdraw consent

g) Request data portability (where applicable)

h) Challenge automated decision-making

i) Lodge a complaint with the Personal Data Protection Office (PDPO) and Bank of Uganda - Financial Consumer Protection Unit

Requests may be submitted to the Data Protection Officer and may require identity verification.

17) DATA BREACH MANAGEMENT

In the event of a personal data breach likely to result in risk to individuals’ rights and freedoms, we shall:

a) Notify the Personal Data Protection Office (PDPO)

b) Notify affected individuals where required

c) Implement remedial and corrective measures

d) Review controls to prevent recurrence

18) GOVERNANCE AND ACCOUNTABILITY

The Board of Directors retains oversight of data protection governance. Senior Management is responsible for
implementing systems, controls, and policies to ensure compliance.

The Data Protection Officer (DPO) provides advisory oversight, monitors compliance, liaises with regulators,
and handles data subject requests and complaints.

This Statement may be reviewed and updated periodically. The latest version will be published on our website
and supersede previous versions. Nothing in this Statement limits statutory rights of data subjects under
applicable law.

19) AMENDMENTS

This Privacy and Data Protection Statement may be amended from time to time to reflect changes in law,
regulatory requirements or operational practices. The most current version shall be published on the Bank’s
website and shall take effect upon publication.

20) QUERIES AND COMPLAINTS

If you have any queries or complaints about privacy, please contact the Data Protection Officer/Head Risk
Management.

Mr. Edward Mutyaba
Head Risk Management
Bukoto, Victoria Office Park, Plot 6 – 9 Okot Close, Block B
P.O BOX 7566, Kampala Uganda
TEL: +256-200505230

ForeX