DIGITAL PRIVACY NOTICE

Your privacy and security matter to us. Protecting your privacy is important. Read our Digital Privacy Notice to see how we collect, use, and protect the personal information provided online.

Protecting your privacy and your information is important to us.

This Digital Privacy Notice (“Notice”) applies to users of Cissia Website and Mobile Application (“Online Services”). The terms “we”, “us” or “our” on any website we own or control and, in this Notice, refers to Cissia.  This Notice describes how our Online Services may collect, use, and share information from or about you.

Last Updated: April 1, 2026.

Agreement to Privacy Notice

By viewing our Online Services, you consent to this Notice which includes your consent to disclose and use information about you in the manner detailed in the Notice. Depending upon your relationship with us, you may receive other Cissia privacy notices providing additional details about our privacy practices.

Types of Information We Collect

Through your use of our Online Services, we may collect personal information from you in the following ways:

(a) Personal Information You Provide to Us.

• We may collect personal information from you, such as your first and last name, address, e-mail, telephone number, and social security number when you create an account.
• We will collect the financial and transaction information necessary to provide you with the Services, including account numbers, verification numbers, and transaction and payment history.
• If you provide feedback or contact us via email, we will collect your name and email address, as well as any other content included in the email, in order to send you a reply.
• We also collect other types of personal information that you provide voluntarily, such as any information requested by us if you contact us via email regarding support for the Services.

(b) Personal Information Collected from Third Parties. We may collect certain information from identity verification services and consumer reporting agencies, including credit bureaus, in order to provide some of our Services.

(c) Personal Information Collected Via Technology. We and our service providers may automatically log information about you, your computer or mobile device, and your interaction over time with our Services, our communications and other online services, such as:

• Device data, such as your computer or mobile device operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers, language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state, county or geographic area.
• Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access.
• Cookies, which are text files that websites store on a visitor’s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, and helping us understand user activity and patterns.
• Local storage technologies, like HTML5 and Flash, that provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.
• Location Information. We periodically collect, transmit and use geolocation information for enabled feature(s) that prevent fraudulent card use and sends alerts, but only if the End User expressly authorizes collection of such information. Geolocation information can be monitored on a continuous basis in the background, only while the Solution is being used, or not at all depending on the End User’s selection. The End User can change his/her/their location permissions at any time in their device settings.
• Device Permissions may be required to use specific functionality within the mobile app such as location, camera or contacts. Prompts to allow access to specific device features are presented for acceptance prior to use the specific service. For example, use of location permissions may be required for use of the ATM location; while use of camera functions may be required for use of Mobile Deposit. Removal of permission acceptance may result in the specific service being removed or unusable.

How We Collect, Use and Protect Personal Information

Cissia may collect personally identifiable information in the course of our business operations and interactions with you. We strive to protect the confidentiality and security of personal information in our possession, custody or control by: (i) limiting access to personal information and (ii) maintaining reasonable administrative, technical and physical safeguards to protect against the loss, misuse or unlawful disclosure of personally identifiable information.

How We Use Your Information

(a) General Use. In general, we use your personal information collected through your use of our Online Services to respond to your requests as submitted through the Online Services, to provide you the Services you request, and to help serve you better. We use your personal information, in connection with the App, in the following ways:

• facilitate the creation of, secure and maintain your account(s);
• identify you as a legitimate user in our platform;
• provide improved administration of our Online Services;
• provide the Services you request;
• improve the quality of experience when you interact with our Online Services;
• send you administrative e-mail notifications, such as security or support and maintenance advisories; and
• send promotional materials related to our Online Services.

(b) Compliance and protection. We may use your personal information to:

• comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities;
• protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);
• audit our internal processes for compliance with legal and contractual requirements and internal policies;
• enforce the terms and conditions that govern our Service; and
• prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

(c) Creation of Non-Identifiable Data. Our Mobile App may create de-identified information records from personal information by excluding certain information (such as your name) that makes the information personally identifiable to you. We may use this information in a form that does not personally identify you to analyze request patterns and usage patterns to enhance our products and services. We reserve the right to use and disclose non-identifiable information to third parties in our discretion.

We may also use any of the information we collect through the Online Services or elsewhere for any of these purposes or for analyzing usage statistics and trends.

If you provide us with personal information in connection with products or services that we provide to you primarily for personal, family or business use, we will not sell, license, transmit or disclose this information outside of Cissia unless: (1) you expressly authorize us to do so, (2) it is needed to allow our service providers to provide services for us, (3) it is needed to provide our products or services to you, (4) it is otherwise required or permitted by law.

Disclosure of Your Personal Information

We disclose your personal information collected through your use of our Online Services as described below.

(a) In Accordance with Our Other Privacy Policy. Other than as described in this Privacy Notice in connection with our Mobile App, this Notice does not apply to the processing of your information by us or third parties with whom we share information.

(b) Third-Party Service Providers. We may share your personal information with third party or affiliated service providers that perform services for or on behalf of us in providing the App, for the purposes described in this Privacy Policy, including: to provide you with the Services; to conduct quality assurance testing; to facilitate the creation of accounts; to optimize the performance of our Online Services; to provide technical support; and/or to provide other services through our Mobile App.

 (c) Authorities and Others. Regardless of any choices you make regarding your personal information, our Mobile App may disclose your personal information to law enforcement, government authorities, and private parties, for the compliance and protection services described above.

(d) If Cissia is involved in a merger, acquisition or asset sale, your personal data may be transferred. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.

How We Use Cookies and Other Data Collection Tools

Cookies, Web Beacons and Pixel Tags. To better serve you and to provide more effective Online Services, we use “Cookies” as part of our interaction with the device you are using. Cookies are small text files that a website’s server places on your computer or other device. In addition to Cookies, we may use other devices for tracking online activity, including web beacons and pixel tags. Web beacons and pixel tags are small strings of software code that represent a graphic image on a website, or in email that is used to monitor the user’s behavior.

These data collection tools provide a means for sites that you visit to track browsing activities conducted with the device you are using, your language preference, and your relationship with the site owner. This includes information such as pages and content viewed, time and duration of visits, search queries entered into search engines, and whether a computer user clicked on an advertisement. Cookies make the personalization of your Online Services experience possible and can also be used to retain data related to a particular browser, such as items in online shopping carts. We use these data collection tools to determine whether you have previously visited our website, the location from which you are visiting our website, and for several administrative purposes (for example, to store your preferences for certain kinds of information), website traffic reporting, unique visitor counts, advertising/auditing/reporting, and for personalization of a website. The data collection tools may be used in connection with some Online Services and email messages to measure the effectiveness of our communications and/or the success of our marketing campaigns, to compile statistics about usage and response rates, to personalize/tailor your experience while engaging with us online and offline, for fraud detection and prevention, for security purposes, for advertising, and to assist us in resolving account holders’ questions regarding use of our Online Services.

You can refuse to accept these Cookies, and most devices and browsers offer their own privacy settings for Cookies. You may manage your Cookie settings for each device and browser you use. However, if you do not accept these Cookies, you may experience some inconvenience in your use of our Online Services and some online products and services. For example, we will not be able to recognize your device and you may need to answer a challenge question each time you log on. You also may not receive tailored advertising or other offers from us that may be relevant to your interests and needs. Web beacons and pixel tags are dependent on Cookies, so when web beacons and pixel tags are blocked on your browser, the Cookies will not be created by consequence.

You should visit the “Help” section of your browser for how to manage your Cookie settings, or follow the links below:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

Children’s Privacy

We recognize that protecting children’s identities and privacy online is important and that the responsibility to do so resides with both the business and the parents. We do not knowingly solicit data from children under the age of 18, and we do not knowingly market through our Website to such children. If a child under 18 submits personal information to us through our Mobile App and we learn that the personal information is the information of a child under 18, we will endeavor to delete such information as soon as possible. We comply with the requirements of the Data Protection Act (2019) which prohibits processing children’s personal data without parental consent.

Working with Other Companies

From time to time, Cissia may establish a relationship with other companies and vendors to collect and analyze data and provide you with additional value and new products we may not offer ourselves. When permitted or required by law, we may share information with third parties for purposes including response to legal processes. In these circumstances, we will treat the information you provide us in the same manner described in our Privacy Notice.

Cissia offers access to other websites either using hyperlinks or through “co-branded” sites in which both Cissia and the other company share the same URL, domain name or pages within a domain name on the Internet. In some cases, the other site will also collect information from you. This information may include, but is not limited to, name, address, SSN, account numbers and date of birth. Prior to providing any information to any third party, review their privacy policy to determine the extent to which they may disclose your information.

Making Sure Your Information is Accurate

It is important for us to have your most accurate and up-to-date contact information. If any of your contact information has changed, please call or write us at the proper telephone number or address located within our Contact Centre. You may also call or write to us at the telephone number or mailing address located on your account statements or other records as indicated.

Security of Online Communications

We protect the information you provide us online in several ways. Cissia Mobile App leverages multiple layers of security, including password protection and the SSL (Secure Sockets Layer) communication protocol, which employs 256-bit encryption to ensure information is passed to Cissia without being intercepted by third parties. As always, we strongly encourage you to assist us in that effort by not sharing your Cissia User ID, Password and/or Passcode with anyone. For more information about Online Services security, please visit our Resources Hub.

Aggregation Websites

Please use caution when using aggregation websites. Aggregation websites offer the ability to access all your financial account information on one website. To do this, an aggregation provider may request access to your User IDs and Passcodes. You should use caution and ensure that the aggregator company has appropriate policies and practices to protect the privacy and security of any information you provide or to which they are gaining access. We are not responsible for the use or disclosure of any Personal Information accessed by any other company or person to whom you provide your User ID and Passcode.

All transactions initiated by an aggregation website, using access information you provide are considered to be authorized by you, whether or not you were aware of the specific transaction. If you decide to revoke the authority you have given to an aggregation website, we strongly recommend that you change your User ID and Passcode to ensure that the aggregation website cannot continue to access your account.

Changes to this Digital Privacy Notice

This Notice shall be reviewed periodically as it is subject to changes from time to time. When a change has been made, we will post the revised Notice on this page with a new “Last Updated” date at the top or bottom of the page. All changes will become effective when posted unless indicated otherwise.

Your continued use of any of our Online Services following the posting of a revised version of this Digital Privacy Notice will constitute your acceptance of the revised Notice. If you do not agree with the revised Digital Privacy Notice, do not use any of our Online Services.

Contact Us

If you have any questions or complaints about this Privacy Policy or our Mobile App’s data collection or processing practices, or if you want to report any security violations, please contact us by phone at +254-719818881-CISSIA, by email at support@cissia.com or by contacting Cissia Group Holdings Limited at Cissia Towers, Third Ngong Ave, Upper Hill, Nairobi – Kenya.

This Digital Privacy Notice was updated on: April 1, 2026.