Privacy Notice

This Privacy Notice is issued by Fiinovate Technologies Ltd (“the Company”, “we”, “us” or “our”) pursuant to the Data Protection Act, No. 24 of 2019 (“the Act”) and the Data Protection (General) Regulations, 2021. It explains how we collect, use, store, disclose and otherwise process Personal Data in connection with the Account, the App, and any service or product we supply from time to time.

1. Purpose and scope

1.1 This Notice covers Personal Data processed for the App, Account registration, identity verification, payments, communications, and any other Service.

1.2 Certain Services may process additional data (for example device permissions, automated assessment, or credit information). Those uses are described below as features of certain Services, not as the whole of this Notice.

2. Definitions

Terms defined in the Act have the same meaning here. In particular: Personal Data, processing, Data Controller, data subject, and consent have the meanings in section 2 of the Act. Services or Products means any service or product the Company supplies from time to time. Customer means the registered account holder.

3. Identity of the Data Controller

3.1 The Data Controller is Fiinovate Technologies Ltd, Airport North Road, Embakasi, Nairobi, Kenya; P.O. Box 4618 – 30200 Kitale, Kenya.

3.2 Contact for privacy and rights requests: the support telephone and email published in the App or on the Company’s communications.

4. Categories of Personal Data collected

Depending on the Service, we may process:

• Identity and contact data (name, national identity particulars, date of birth, phone, email, address)
• Identification images and photographs where a Service requires verification
• Information you provide for a Service (including declared employment or income where requested)
• Payment and wallet references, transaction metadata, and Account activity
• Device identifiers, IP address, and user-agent information
• Consent, acceptance, and preference records
• Where a Service requires it: message or call-log features (for example for assessment or one-time codes), credit-assessment data, and repayment history

5. Sources

We obtain Personal Data from you, from your device where you grant permissions, from payment providers, from public registries, and — where a credit Service applies — from licensed Credit Reference Bureaux.

6. Purposes and lawful bases (section 30)

We process Personal Data where at least one lawful basis under section 30 of the Act applies, including:

• Performance of a contract — to open and operate the Account and to supply a Service you request
• Consent — for marketing, optional device permissions, and other optional processing
• Legal obligation — where Kenyan law requires retention or disclosure
• Legitimate interests — security, fraud prevention, and orderly operation of the Service, balanced against your rights

7. Automated processing

7.1 Some Services may use automated assessment. An automated score or indication is not by itself a decision that you must receive that Service.

7.2 You may contact support about an assessment. Human review may apply where the Company so decides or where required.

8. Sensitive and biometric-adjacent data

Where a Service needs photographs or identity images, we process them only as necessary for verification, with appropriate access controls, and on a lawful basis under the Act (including explicit consent where required).

9. Recipients

We may disclose Personal Data to staff on a need-to-know basis; hosting, SMS, and email vendors acting on our instructions; payment processors; professional advisers; courts and regulators; and licensed Credit Reference Bureaux only for a credit Service. We do not sell Personal Data. We do not contact phone-book or call-log third parties for collections.

10. Transfers outside Kenya (sections 48–49)

Personal Data may be transferred outside Kenya where necessary for hosting or support. Where the destination has not been determined to have appropriate data protection laws, we use contractual and technical safeguards consistent with the Act and the Regulations.

11. Retention

We retain Personal Data only as long as needed for the purposes collected. Unless a shorter or longer period is required by law or contract, the default business retention period is five (5) years from the end of the relationship or last Service. Retention may be extended for legal claims or statutory record-keeping.

12. Security and breach (section 43)

We implement appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss. In the event of a Personal Data breach likely to result in a real risk of harm, we will notify the Office of the Data Protection Commissioner and, where required, affected data subjects, in accordance with section 43 of the Act.

13. Marketing

Marketing by electronic means is sent only with consent or another lawful basis, with a simple opt-out. Opting out of marketing does not affect transactional Service messages.

14. Rights of the data subject

Subject to the Act and the Regulations, you have rights to be informed, to access, to object, to correction, to deletion in appropriate cases, to withdraw consent where processing is based on consent, and related rights. Submit rights requests via the Company’s support channels. We may verify identity before acting.

15. Complaints to the ODPC

You may lodge a complaint with the Office of the Data Protection Commissioner. You are encouraged to contact us first so we can try to resolve the matter.

16. Children

Our Services are directed to persons aged eighteen (18) and above. We do not knowingly collect Personal Data from children for Account registration.

17. Changes and governing law

17.1 We may update this Notice. The version and effective date appear at the top. Material changes will be published or notified by reasonable means.

17.2 This Notice is governed by the laws of Kenya, including the Data Protection Act, 2019.