- Who this notice applies to
This notice applies to customers, prospective customers, website visitors, mobile app users, guarantors, joint account holders, authorised representatives, suppliers, service providers, and any other individuals whose personal data we process in connection with our banking and related services.
- Personal data we collect
We may collect personal data directly from you, from your use of our website, mobile applications, forms, branches, call centres, and other digital or physical channels, and from third parties where lawful and reasonable.
The personal data we may collect includes your name, date of birth, national identity details, contact details, address, occupation, biometric information where applicable, account and transaction details, financial information, credit information, employment information, and any other information needed to provide our services or comply with the law.
- Why we collect it
We process your personal data for the following purposes:
- To open, verify, administer, and maintain your account or relationship with us.
- To process transactions, payments, transfers, and instructions you give us.
- To provide products and services you request and to respond to your enquiries and complaints.
- To conduct credit assessment, risk management, fraud detection, investigations, monitoring, and recovery activities.
- To comply with legal, regulatory, tax, audit, reporting, and anti-money laundering obligations.
- To improve our products, services, systems, security, and customer experience.
- To carry out research, analytics, market analysis, and service development.
- To send marketing communications where permitted by law and, where required, with your consent.
- For automated decision-making for activities such as credit scoring and fraud detection. You have the right to request human intervention, express your point of view, and contest any such decisions.
- Lawful bases for processing
We process your personal data only where we have a lawful basis to do so. Depending on the purpose, we rely on one or more of the following bases:
- Contract performance: where processing is necessary to enter into or perform our contract with you, including account opening, service delivery, transaction processing, and customer support.
- Legal obligation: where processing is necessary to comply with applicable laws, regulations, regulatory directives, lawful requests, and record-keeping obligations.
- Legitimate interests: where processing is necessary for our legitimate business interests, such as fraud prevention, system security, service improvement, analytics, internal administration, and risk management, provided your rights and freedoms do not override those interests.
- Consent: where we rely on your consent for a specific purpose, such as certain marketing communications or optional cookies, and you may withdraw that consent at any time where the law allows.
Where you do not provide information that is required by law or necessary for a contract or service, we may be unable to offer the relevant product or service, or to continue the relationship.
- Sources of data
We may obtain your personal data:
- directly from you;
- through our digital and physical service channels;
- from employers, agents, referees, or authorised representatives;
- from credit reference agencies, debt collectors, payment providers, and fraud prevention services;
- from government agencies, regulators, courts, and law enforcement;
- from service providers, business partners, and public sources where lawful.
Where you provide personal data about another person, you should only do so where you have authority or where the law permits it.
- When we share data
We may share your personal data with:
- regulators, courts, law enforcement agencies, tax authorities, and other public bodies where required or permitted by law;
- credit reference agencies and debt collection agencies;
- payment systems, card schemes, banks, and other financial institutions involved in a transaction;
- service providers, contractors, auditors, advisers, technology providers, and other trusted partners who support our operations;
- co-branding, loyalty, and commercial partners where relevant to the service you use;
- any group company or affiliated entity where this is necessary for administration, compliance, risk management, or service delivery.
We require third parties who process personal data for us to protect it and use it only for authorised purposes.
- Cross-border transfers
We may transfer your personal data outside Uganda where this is necessary to provide services, use service providers, support our operations, or comply with law. Where we do so, we will take reasonable steps to ensure the receiving country or recipient provides an adequate level of protection for your personal data.
These safeguards may include:
- contractual data protection obligations;
- confidentiality and security requirements;
- technical and organisational safeguards;
- access restrictions;
- restrictions on onward transfer; and
- any other measures required by applicable law.
We will only transfer personal data where the transfer is lawful and where appropriate safeguards are in place to protect your rights and your personal data.
- Retention
We keep personal data only for as long as necessary for the purposes for which it was collected, for the period required by law or regulation, and for legitimate business, audit, dispute resolution, and compliance purposes. When personal data is no longer required, we will delete, destroy, anonymise, or archive it securely in line with our retention procedures.
- Security
We use reasonable technical, administrative, and physical safeguards to protect personal data against unauthorised access, loss, misuse, alteration, destruction, or disclosure. Access to personal data is limited to authorised personnel and service providers who need it for legitimate business purposes.
- Cookies and online tracking
Our website and digital channels may use cookies and similar technologies to make them work properly, remember your preferences, improve performance, analyse usage, and support relevant marketing where permitted. Strictly necessary cookies are required for the operation of the website, while optional cookies may be controlled through your browser settings or any cookie tool we provide.
You may disable cookies through your browser, but some parts of the website or digital services may not function properly if you do so.
- Marketing
We may send you service updates, product information, and marketing communications where permitted by law. Where consent is required, we will seek it before sending electronic marketing messages, and you may opt out at any time by following the unsubscribe instructions in the communication or by contacting us through our official channels.
- Your rights
Subject to applicable law, you may have the right to:
- access your personal data;
- correct inaccurate or incomplete personal data;
- object to or restrict certain processing;
- request deletion where lawful;
- withdraw consent where processing is based on consent;
- object to direct marketing;
- receive information about how your data is processed;
- complain to the Personal Data Protection Office where you believe your rights have been violated.
We may ask for proof of identity before responding to requests in order to protect your privacy.
- Complaints and contact
If you have any questions, requests, or complaints about this notice or our processing of your personal data, please contact our Data Protection Officer:
Data Protection Officer
Housing Finance Bank
Plot 4, Wampewo Avenue, Kololo
P.O. Box 1539, Kampala, Uganda
Email: [email protected]
Revised in September 2026.
If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Office in accordance with applicable law.
- Changes to this notice
We may update this Privacy Notice from time to time to reflect changes in our services, legal obligations, or privacy practices. The latest version will be made available on our website.
