KwachaPlus Privacy Policy

KwachaPlus ("we", "us", "the App") is operated by KwachaPlus Financial Solutions Ltd ("the Operator"), with offices at Plot 23, Independence Avenue, Lusaka, Zambia. This policy explains what personal information we collect when you use the KwachaPlus mobile app, why we collect it, who we share it with, and the rights you have over it.

This policy is written to comply with the Zambia Data Protection Act, 2021 and Google Play's Data Safety requirements.

1. Who is the data controller?

KwachaPlus is a marketplace that connects borrowers to licensed lenders ("Lenders"). When you sign up, you choose a Lender to apply with. From that point, both KwachaPlus and your chosen Lender may act as independent data controllers of your personal information for their respective activities:

• KwachaPlus controls how the app collects, transmits, stores, and displays your data.
• Your chosen Lender controls how your information is used to assess, approve, disburse, service, and collect your loan.

The Lender's name and contact details are displayed inside the app under Browse lenders and on the loan records associated with your account.

2. What we collect

We only collect what we need to operate the app, verify your identity, support loan applications, and help your chosen Lender service your account.

2.1 Information you give us directly

• Name, including name information retrieved for verification purposes through Flowmatic as described in section 4
• Phone number, which is used as your login identifier and to contact you
• National Registration Card (NRC) number
• Photos of your NRC, including front and back images, where required for identity verification
• Password, which is stored in hashed form so that we cannot read it in plain text
• Additional documents you choose to upload, such as payslips, agreements, or supporting records
• Optional profile information you choose to provide, such as address, gender, province, employment information, next-of-kin details, and business details
• Loan application information, including requested amount, selected lender, selected product, repayment term, collateral details, and supporting notes

2.2 Information collected automatically when you use the app

• Login and access timestamps, such as your last sign-in time, for security and account administration
• Device push-notification token so we can deliver reminders and account notifications
• App version, operating system version, and device model for support, troubleshooting, and service reliability
• Loan application, repayment, and transaction history, including dates, amounts, and statuses

2.3 Information we do not collect for lending features

• Your contact list
• Your precise or background location
• Your browsing history outside the app
• Biometric data

3. How we use your information

Purpose	Data used
Verify your identity (KYC)	Name, phone number, NRC number, NRC photos, supporting verification data
Process and submit your loan application to the Lender you choose	Profile data, NRC data, application data, supporting documents
Match you with the Lender you selected	Name, phone number, NRC information, selected product and lender details
Send account and loan notifications	Phone number, push token, account status and loan events
Communicate with you about your account	Phone number and account context
Display loan balances, schedules, statements, and repayment progress	Loan data, repayment records, transaction history
Detect, investigate, and prevent fraud or misuse	NRC information, phone number, login activity, application history
Comply with legal and regulatory obligations	Any information reasonably required for compliance, audit, or lawful disclosure

We do not sell your personal data. We do not use your data for advertising.

4. Third parties we share data with

KwachaPlus uses a limited number of service providers and counterparties to operate the app. We share the minimum information reasonably required for each purpose.

Service	What we send them	Why
Your chosen Lender	Application data, identity data, contact details, loan data, and supporting documents	The Lender is the entity that assesses, approves, disburses, and services your loan
Flowmatic (flowmatic.solutions)	Your phone number and mobile money provider name	To retrieve your registered name for KYC verification
OneSignal	Push notification token and notification payload	To deliver push notifications to your device
Firebase by Google (Storage)	NRC photos and any documents you upload	Secure storage of documents and supporting files
UltraMSG	Phone number and message content	To deliver account-related messages where used by your Lender
NRC OCR service operated by KwachaPlus	NRC image data	To read identity details from the document and compare them during verification
Credit Reference Bureau, where applicable	NRC information and repayment history	For lawful credit reporting and related compliance activities handled by the Lender
Regulatory authorities, courts, and law enforcement	Information required by applicable law or lawful order	To comply with legal and regulatory obligations

We do not share your personal data with advertising networks, social media platforms, or unrelated third-party marketers.

5. Permissions the app requests on your phone

We request only the permissions needed to operate the app and support lending-related features:

• Camera — to take photos of your NRC or other supporting documents during signup or loan application.
• Notifications — to send loan updates, approvals, reminders, and account-related alerts.
• Internet access — to communicate securely with our servers and service providers.

On supported devices, you may also choose files or images manually through your device's system picker when uploading documents. KwachaPlus does not request access to your contact list, your location, or broad media-library permissions for lending features.

You can revoke permissions at any time in your device settings. If you revoke camera or notification permissions, some features may be limited.

6. How we protect your information

• Encryption in transit — communication between the app and our systems uses HTTPS and TLS.
• Secure storage — your password is stored as a one-way hash and your mobile session credentials are stored using secure device storage where supported.
• Document protection — documents uploaded through the app are stored using protected cloud storage controls.
• Access controls — only authorised staff of your chosen Lender and restricted KwachaPlus support personnel may access your information for legitimate business purposes.
• Audit and monitoring — significant account and workflow events may be logged for security, support, and compliance purposes.

No method of storage or transmission is perfectly secure, but we apply reasonable technical and organisational safeguards and respond to incidents in accordance with applicable law.

7. How long we keep your data

• While your account is active — we retain the information needed to operate your account and support your selected Lender relationship.
• After account closure or inactivity — loan and supporting records may be retained for at least seven (7) years after the relevant loan is settled, or longer if required by applicable law, regulation, dispute handling, or audit obligations.
• Push notification tokens — may be removed when you sign out, disable notifications, or stop using the app, subject to technical limitations of third-party messaging services.
• Marketing-only data — not applicable, because we do not use your personal data for marketing campaigns.

When retention is no longer required, data is deleted, anonymised, or securely archived in line with our legal obligations.

8. Your rights

Under the Zambia Data Protection Act, 2021, and subject to lawful limitations, you may have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your data, subject to retention obligations
• Object to or restrict certain processing in appropriate circumstances
• Request a portable copy of certain personal data
• Lodge a complaint with the Data Protection Commissioner of Zambia

To exercise any of these rights, contact us using the details in section 11. We aim to respond within 30 days, subject to legal and operational requirements.

9. Children

KwachaPlus is intended only for users aged 18 years or older. We do not knowingly collect personal data from minors for lending services. If you believe a minor has registered, contact us and we will investigate and take appropriate action.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we may notify you in the app or by other appropriate means, and we will update the "Last updated" date at the top of this page.

11. Contact us

For privacy questions, data requests, or complaints, contact:

• Email: privacy@kwachaplus.com
• Phone: +260 97 712 3456
• Postal address: Plot 23, Independence Avenue, Lusaka, Zambia
• Regulatory complaints: If you are not satisfied with our response, you may contact the Data Protection Commissioner of Zambia.

---