Absa Bank Tanzania Limited Data Privacy Statement

This Privacy Notice does not apply to the data protection practices of third parties with which we may engage to provide products or services, including their websites or mobile apps. If a third party uses your personal information for its own purposes, it is solely responsible for complying with applicable data protection laws.

When you leave our website or digital platforms and access a third-party site, please be aware that you are subject to that third party’s terms, conditions and privacy policies. We do not review or endorse the content, privacy practices or policies of any external sites, and we are not responsible for how they handle your personal information.

• Consent: You have given clear consent for us to process your personal data for a specific purpose.
• Contract: The processing is necessary for the performance or conclusion of a contract to which you are a party.
• Legal obligation: The processing is necessary as it complies with an obligation imposed by law.
• Legitimate Interest: Processing protects your legitimate interests.
• Public law: The processing is necessary to perform a public law duty by a public body.
• Legitimate interests: The processing is necessary for pursuing the legitimate interests of the responsible party or the legitimate interests of a third party to whom the information is supplied.

We always need a lawful basis for using your personal information. The broad lawful basis for processing your personal information is:

Customers and prospective customers

• Where you, either in your own capacity or acting under a legal mandate for a juristic entity or child, consent to our processing of your information.
• Where we provide a service or product to you, and your personal information is required to be processed for the effective functioning of the product or service (such as the facilitation of payments).
• Where we need to meet our lawful obligations, such as anti-money laundering and fraud detection or tax reporting.
• Where you, Absa or a third party has an evidenced legitimate interest in processing the information (such as where we use analytics to assess the viability of a product offering and understand our customers’ needs). In these cases, we carefully balance the legitimate interest against the importance of respecting your privacy to ensure that there is no negative effect on you.
• Where we design, manage, price and provide you with the products or services in which you may have expressed an interest or for which you have applied (including value-added services), and then communicate with you and keep you informed about these products or services.
• Assessing whether you qualify for credit or for an increase or decrease of your credit limit and conducting credit scoring.
• Delivering your credit or debit card to you at your chosen address, where you have applied for a credit or debit card.
• Meeting your financial services needs by providing you with customised offers, experiences and communications.
• Providing discretionary and administrative financial services.
• Responding to any correspondence with us, including via email or by telephone.
• Identifying you and verifying your physical address, source of funds, income and similar information.
• Assessing your personal financial circumstances and needs before providing advice, products or services to you. In this regard, we may collect your personal information from you in your capacity as our prospective customer.
• Minimising risk and identifying or investigating fraud or other related activities.
• Any purpose related to the prevention of financial crime, including fraud detection and prevention, sanctions screening, adverse media screening, monitoring of anti-money laundering and any financing of terrorist activities.
• Managing our business and identifying potential trends in the market, to ensure that our products are future fit.
• Enforcing our obligations and any contract we have concluded with you, including without limitation the collection of amounts outstanding from you and your provision of security for banking facilities. Enforcement actions may include tracing you through the use of a tracing agent or instituting legal proceedings against you.
• Further processing for historical, statistical or research purposes where the outcomes will not be published in an identifiable format.
• Conducting analytics to better understand you as our customer so that we can tailor our product or service offerings to you, where relevant and applicable.
• Improving our service to you and your experience with us.
• Providing income tax-related information to tax authorities.
• For purposes relating to the sale or transfer of any of our businesses, legal entities or assets as part of corporate transactions.
• Conducting surveys to gauge customers’ satisfaction or to improve our product and service offering.
• Contacting you for marketing purposes regarding products and services, competitions and other promotional products, rewards or value-added services, which we or any of our partners offer, unless you have opted out from, objected to or, where required, not consented to receiving marketing material from us.
• For such other purposes to which you may consent from time to time.
• For purposes of monitoring the use of our electronic systems and platforms by customers.
• Complying with internal and external auditing and reporting requirements, as well as related information requests from regulatory bodies.
• Processing payment instructions (such as debit orders) and instructions received via payment devices (such as debit cards).
• Complying with the requirements of specific local or foreign laws by which we are governed (including codes of conduct, industry agreements and any joint standards, directives, guidelines and rules issued by regulatory bodies from time to time) or complying with any regulations, directives, judgments or court orders, government sanctions or embargoes, reporting requirements under financial transactions legislation, and demands of any supervising authority, regulator, tribunal, enforcement agency or exchange body.    

Employees and prospective employees

Where you are an employee of Absa, we collect your personal information to comply with applicable employment laws. Continuous monitoring of employee conduct is essential for ensuring that we uphold our ethical and legal obligations as a responsible corporate citizen.

Where you have applied for employment at Absa, we perform applicant screening and background checks, and such screening may include social media screening and screening relating to any information about you obtained from publicly available sources such as search engine results.

Where you are a student, graduate or employment seeker, we will process your personal information only for socioeconomic development purposes, to assist you with job placements through Absa’s designated youth employment agencies, for entrepreneurial upliftment purposes, for skills development and to comply with our applicable legal obligations.

Where you are an Absa employee (including contractors), we create an employment record of you on our system to facilitate continuous monitoring during your employment with us.

As part of our responsibilities in the financial services sector, we may need to report certain employee conduct to relevant authorities or industry databases. This could include cases of dishonesty, misconduct or regulatory breaches. These reports help maintain the industry’s integrity and allow other organisations to check suitability before hiring. Where applicable, such reporting will be carried out in accordance with relevant laws, regulations and guidance, and you will be informed, where required.

Where you are an Absa director, we create a record of you as a director on our internal systems and update your personal information on government databases (such as the Companies Registry and regulators) as required.

Where you have been identified as a next of kin by an employee or customer, we create a record of you on our system.

Third parties

Where you are a supplier or third party to Absa, we process your personal information for due diligence, risk assessment, administrative and payment purposes. Your responsibilities as a third-party provider to Absa are outlined in our contract and in the Absa Third-party Control Obligations (available on our external website).

In all circumstances, we will not process your special personal information unless:

• You have consented to our processing thereof (in circumstances where we are legally obliged to obtain your consent); or
• It is necessary to exercise or defend a right or obligation in law; or
• It is necessary to comply with an international legal obligation of public interest; or
• It is for certain historical, research or statistical purposes that would not adversely affect your privacy; or
• You have deliberately made your personal information public.

There are some personal information fields that you must fill in or provide for us to provide you with your chosen product or service, to fulfil a legal obligation or to perform an obligation in terms of an agreement with you.

Such mandatory information or fields will be indicated to you, for example, by an asterisk on the respective forms or electronic channels. If we do not receive the necessary personal information, we will be unable to continue with your application, to perform our obligations under applicable law or any relevant contract we have or are attempting to enter with you, or to provide the chosen product or service. In such cases, we may have to decline to provide you with the product or services and you will be notified accordingly. If you are already a customer, employee or third party of Absa and we ask you for this information and you do not provide it, we may have to suspend the provision of the product or service for a period of time or, as the case may be, even terminate our relationship with you.

Any information you provide must be accurate and complete and you must notify us of any changes to your personal information.

There may be instances where we will process your personal information through a secure automated tool (without any human intervention used in the decision-making process) or perform profiling and make decisions based on such profiling, which may affect you significantly (for example, the automatic non-approval of a personal loan for which you may have applied through any of our online channels, or the automatic non-approval of an application for employment or engagement as a supplier).

If you are unhappy about the outcome of such a decision or would like further information on how such outcome was reached, please contact:

• Your local Customer Service centre (for customers);
• Your resourcing consultant (for job applicants);
• The people partner for your business (for employees);
• Your supplier relationship manager (for suppliers); or
• Absa’s Company Secretary (for directors of Absa-owned companies).

Privacy matters to us, and we want you to be familiar with your rights under the legislation and to know how you can exercise them in your interactions with the bank. You have the right to:

• To be informed: With this Privacy notice, we inform you about what we do with your personal data.
• Access your personal data: you have the right to check whether we hold personal data about you, and you can ask us for a copy of such data and information on how we have used it.
• Correct your personal data: if your personal details have changed, or you believe we have incorrect or out-of-date information about you can ask us to update it.
• Request deletion of your personal data - you can ask us to delete your personal data. However, we may need certain personal details to provide our products and services to you.
• Restrict or object to processing - you can ask us to stop using your data or change how we use it. However, we may need certain personal details to engage with you or provide our products and services to you.
• Object to automated decision making - you have the right to reject or request for a review of a decision made solely based on an automated process if it negatively impacts you.
• Data portability: you can ask us to provide your personal data to another organisation in a format that can easily be read by machines.
• Complaint: you can log your complaints in relation to our processing of your personal data through the contact details below. and, if your complaints have not been handled to your satisfaction, you can contact the Personal Data Protection Commission (PDPC).
• Not to provide consent or to change or to withdraw consent provided: we may from time to time ask for your consent to process your personal data. You can choose not to provide such consent or let us know at any time if you change your mind about the consent already provided. However, we may not be able to provide our products and services or engage with you without certain personal data.
• Withdraw from direct marketing: you can withdraw your consent and tell us to stop sending you direct marketing at any time.
• We will respond to requests to exercise your personal data rights in line with applicable laws. We will ask you to verify your identity before processing your request.

• We will not retain any personal information for longer than is necessary to achieve the purpose of such collection.
• We will retain your personal information for as long as it is legally required and where we have a defined purpose to retain it. Thereafter we will destroy it, deidentify it or anonymise it.

To the extent that local legislation permits, you have the following rights regarding your personal information:

• The right to request us to confirm whether any personal information is held about you and to access your personal information that we have on record.
• The right to ask us to correct or delete any of your personal information (if applicable in your jurisdiction) that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
• You can ask us to delete or destroy your personal information that we are no longer authorised to retain. Our records are subject to regulatory retention periods, which means that we may not be able to delete or destroy your personal information immediately on request.
• You can also object on reasonable grounds to our processing of your personal information. However, the result of such a request may be that we have to suspend the provision of products and/or services for a period of time or even terminate our relationship with you.
• The right to withdraw consent at any time, where you have previously consented to the processing of your personal information, by providing us with notice to that effect.
• The right to be notified that your personal information is being collected and processed by us. This Privacy Notice seeks to give effect to this right.
• The right to be notified in any situation where we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person (e.g. data breach or security compromise).
• The right not to be subject to a decision based solely on the automated processing of your personal information that is intended to provide a profile about you, where we have not complied with the requirements under applicable law and/or our commitments in paragraph 11 above.
• If you have a complaint relating to the protection of your personal information, including the way in which it has been collected or processed by us, please contact us using the local contact details listed in paragraph below.
• If you have not had your complaint dealt with satisfactorily in accordance with our internal dispute resolution process, you may lodge a complaint directly with Personal Data Protection Commission (PDPC). 

In order to meet customer expectations and improve the services offered on our website, we employ the use of cookies. By accessing Absa’s website, you agreed to use cookies in agreement with our Cookies policy available on the bank’s website. 

We will only transfer your personal data to third parties in another country in any one or more of the following circumstances:

• Where your personal information will be adequately protected under the other country’s laws or an agreement with the third-party recipient
• Where the transfer is necessary to enter into, or perform, under a contract with you or a contract with a third party that is in your interes
• Where you have consented to the transfer; and/or;
• Where it is not reasonably practical to obtain the customer’s consent, but the transfer is in your interest. This transfer will happen within the requirements and safeguards of applicable laws or privacy rules that are binding to Absa. Where possible, the party processing your personal data in another country will agree to apply the same level of protection as available by law in Tanzania, or if the other country’s laws provide better protection, the other country’s laws would be agreed to and applied.