Privacy Policy

LoanFlow ("we", "our", or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform, website, and related services. Please read this policy carefully. By using LoanFlow, you consent to the practices described herein.

• Personal identification data (name, ID/Passport number, date of birth, KRA PIN)
• Contact details (phone number, email address, physical address)
• Financial information (bank account details, M-Pesa transaction history, credit history)
• Employment and income details for loan underwriting
• Device and usage data when accessing our platform
• Communication records between you and LoanFlow

• Process and underwrite loan applications
• Verify your identity through IPRS and other government databases
• Perform credit risk assessments and credit scoring
• Facilitate disbursements and repayments via M-Pesa and bank transfers
• Report loan performance to Credit Reference Bureaus (CRBs)
• Comply with legal and regulatory obligations under Kenyan law
• Send service notifications, payment reminders, and marketing communications (with consent)

• We do not sell your personal data to third parties
• We share data with CRBs as required by the Banking Act and Central Bank of Kenya regulations
• We share data with payment processors (Safaricom M-Pesa, banks) to facilitate transactions
• We may share data with government agencies when required by law
• We engage third-party service providers bound by data protection agreements

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Our infrastructure is hosted in ISO 27001-certified data centers
• Access to personal data is restricted to authorised personnel only
• We conduct regular security audits and penetration testing
• Multi-factor authentication is enforced for all administrative access

• Right to be informed about how your data is collected and used
• Right to access your personal data held by LoanFlow
• Right to request correction of inaccurate or incomplete data
• Right to deletion of your data (subject to legal retention requirements)
• Right to restrict processing of your data
• Right to data portability in a structured, machine-readable format
• Right to object to processing for direct marketing purposes