ElShadai
Privacy notice
Last updated [date]
Who we are
[Company legal name] ("ElShadai", "we") provides loans to individuals and small businesses. We are the data controller for the personal data described here. Contact our data protection officer at [email] or [postal address].
What we collect
When you apply for a loan we collect your name, national ID number, phone number, address, employment and income; your guarantor's name and phone number; documents you give us (such as your ID, M-Pesa statements and payslips); and records of the loans, repayments and messages between us.
Why we use it
To check your identity and ability to repay, decide on and manage your loan, send you the money, collect repayments, send you reminders and notices by SMS, and meet our legal and regulatory obligations. We use it because you consented when applying, because it's needed for our loan agreement with you, and where the law requires us to.
Who can see it
Only ElShadai staff who need it for their work, and each person's access is limited and logged. We share data with service providers that help us run the service (hosting, SMS and email delivery, payments such as M-Pesa) under agreements that protect it, and with authorities or credit reference bureaus where the law requires or allows. [List any credit reference bureaus you report to.]
How long we keep it
While your loan is active and for [7] years after it is fully repaid or closed, to meet financial record-keeping obligations. Applications that don't go ahead are kept for [period]. After that the data is deleted or anonymised.
Your rights
Under the Data Protection Act 2019 you can ask to see the data we hold about you, have it corrected or deleted, object to or restrict its use, and withdraw consent (this doesn't affect a loan already given). Contact [email]. You can also complain to the Office of the Data Protection Commissioner (ODPC), www.odpc.go.ke.
Keeping it safe
Data is stored on secured servers, staff sign in with individual accounts, documents are only available to authorised staff, and access to personal data is recorded.