1. Purpose

This Data Protection Policy outlines how Mwananchi Credit Limited collects, processes, stores, and protects personal data in compliance with the Data Protection Act 2019 Kenya and regulations issued by the Office of the Data Protection Commissioner Kenya.

The purpose of this policy is to ensure that all personal data handled by the organization is processed lawfully, fairly, and securely.

 2. Scope

This policy applies to:

• All employees, contractors, and agents of Mwananchi Credit
• All personal data processed through our systems, website, and physical operations
• All customers, prospective clients, and third parties whose data we process

 3. Definitions

Personal Data:
Any information relating to an identified or identifiable individual.

Data Subject:
The individual whose data is being processed.

Processing:
Any operation performed on personal data, including collection, storage, use, or deletion.

 4. Principles of Data Protection

Mwananchi Credit adheres to the following principles:

• Lawfulness, fairness, and transparency
• Purpose limitation (data used only for specified purposes)
• Data minimization (only necessary data collected)
• Accuracy (data kept up to date)
• Storage limitation
• Integrity and confidentiality (security)
• Accountability

 5. Types of Data Collected

We process the following categories of personal data:

a) Customer Data

1. Names
2. Phone numbers
3. Email addresses
4. Identification details

b) Financial Data

• Loan application information
• Employment and income data
• Asset-related data (logbook, title deed)

c) Technical Data

• IP addresses
• Device information
• Usage data

 6. Lawful Basis for Processing

Personal data is processed based on:

• Consent of the data subject
• Performance of contractual obligations
• Compliance with legal obligations
• Legitimate interests of the organization

 7. Data Collection Methods

We collect data through:

• Website forms
• Mobile and online platforms
• Physical interactions
• Third-party verification systems

 8. Data Security Measures

We implement appropriate safeguards, including:

• Secure servers and encryption
• Access controls and authentication
• Regular system monitoring
• Staff training on data protection

 9. Data Retention

Personal data is retained only for as long as necessary to:

• Fulfill the purpose for which it was collected
• Meet legal and regulatory requirements
• Resolve disputes

10. Data Sharing

Personal data may be shared with:

• Credit Reference Bureaus
• Regulatory authorities
• Legal and compliance entities
• Service providers

All third parties must comply with strict confidentiality and data protection requirements.

 11. Data Subject Rights

Data subjects have the right to:

• Access their personal data
• Request correction
• Request deletion
• Object to processing
• Withdraw consent

Requests will be handled in accordance with applicable laws.

 12. Data Breach Management

In the event of a data breach:

• The incident will be investigated immediately
• Affected individuals may be notified where required
• The Office of the Data Protection Commissioner will be informed where applicable
• Corrective measures will be implemented

 13. Roles and Responsibilities

Management

• Ensure compliance with data protection laws
• Provide resources for implementation

Employees

• Handle data responsibly
• Follow internal policies and procedures

Data Protection Officer (if applicable)

• Oversee compliance
• Act as point of contact for data protection matters

 14. Training and Awareness

All staff are required to:

• Undergo data protection training
• Understand their responsibilities
• Follow best practices in handling personal data

 15. Monitoring and Compliance

We regularly review our data protection practices to ensure:

• Compliance with legal requirements
• Effectiveness of security measures
• Continuous improvement

 16. Policy Review

This policy will be reviewed periodically to reflect:

• Changes in law
• Technological advancements
• Operational requirements

 17. Contact Information

For any questions regarding these Terms, please contact:

Mwananchi Credit Limited
📧 Email: info@mwananchicredit.com
📞 Phone: 0709 147 000

You may also contact the
Office of the Data Protection Commissioner (ODPC), Kenya.