Niazime Privacy Policy

Version 2026-09-24. Reviewed by counsel against the Data Protection Act 2019.

1. Who controls your data

Niazime is a product of Niazime Limited, an independent Kenyan company, which is the data controller for the personal information described in this policy. [Insert ODPC registration number once issued.]

2. What we collect, and why

Data	Why we collect it
Phone number, verified by a one-time code	Your account identity; the only channel we use to reach you
Full name, date of birth, Kenyan National ID number, and a photo reference	Confirming you are a real, eligible (18+) Kenyan National ID holder, via the government identity registry, as required for KYC under Kenyan law
A liveness/selfie verification result (a pass/fail score, not the video itself)	Confirming the person registering matches the identity document, and is a live person rather than a photo or recording. This is biometric data: we ask for your explicit consent, by a separate tick, immediately before the check, and record when you gave it. Without it the check does not run and you cannot borrow or lend
Your answer to whether you, a close family member, or a close associate hold or have held a prominent public office	A legal obligation on all lenders under Kenya's anti-money-laundering law (POCAMLA). A "yes" does not disqualify you; it means a person reviews your registration
Your M-Pesa statement (with your consent, and the password used once to open it)	Assessing your ability to repay, and detecting patterns like existing debt or gambling activity that affect what we can lend you
Your answers to our short questionnaire	Cross-checked against your statement, as a further input to your score
Device identifier	Detecting when the same device is used by more than one account, which affects who can lend to whom
Your transaction history on Niazime (deposits, loans, repayments, withdrawals)	Operating your account, and required accounting/audit records
M-Pesa transaction references (receipt numbers) for your deposits, disbursements, and withdrawals	Correctly crediting your account and reconciling with Safaricom
Your email address — read from the header of the M-Pesa statement you upload, or typed by you in Preferences	Sending you your account statement when you ask for it by email. We do not use it for anything else and never write to it unasked; you can change it in Preferences at any time. Staff can see it
A push-notification address for this phone, only if you turn notifications on	Sending loan reminders and account updates as notifications instead of SMS. You can turn it off in Preferences at any time; we then delete the address and go back to SMS

3. What we don't collect

We do not access your phone's call logs, SMS logs, or contacts, and we do not collect your device's IMEI. Our assessment of your ability to repay is based on the M-Pesa statement you choose to provide and your own answers, not on scanning your device.

4. What we do with your M-Pesa statement specifically

Your statement is used once to extract the signals described above. The statement file itself is stored on an encrypted volume and is automatically deleted after 90 days; the signals we derived from it (not the statement itself) are kept as part of your scoring history. The password you provide to open the file is used at the moment of upload and is never stored or logged.

5. Who we share your data with

Safaricom/Daraja, to process deposits, disbursements, and withdrawals.
Your phone's push-notification service (Google or Apple), which carries notifications to your phone if you turn them on. It sees that a message was sent, not who you are; the message text is encrypted to your phone.
Our identity verification provider, to confirm your identity document and liveness check.
KRA, where we withhold tax on a lender's interest earnings, as required by law.
The Central Bank of Kenya, the Office of the Data Protection Commissioner, and law enforcement, where we are legally required to disclose information to them.
The Unclaimed Financial Assets Authority, if a wallet balance stays unclaimed for the period the Unclaimed Financial Assets Act sets: your name, identity number, phone number and the balance, so that you or your estate can claim it there. We tell you by SMS first (Terms, section 3.2).
The personal representative of your estate, on proof of death and of their appointment: your statement, your data export and the balance due to the estate, and nothing more (Terms, section 3.3).
A collections partner, only if we engage one for an unpaid loan, and only the information necessary for that purpose.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

6. How long we keep your data

Statement files: 90 days, then deleted (section 4).
Account and transaction records: for as long as your account is active, and afterward for the period Kenyan financial and tax law requires us to keep such records.
KYC verification results: for as long as required to demonstrate compliance with anti-money-laundering and KYC obligations.
Dormant accounts (no sign-in or transaction for 12 months): kept, not deleted, because the balance and any loan records are yours; we send reminders to your registered number. The retention rules above apply from closure, not from dormancy.

7. Your rights

Under the Data Protection Act 2019, you have the right to:

know what personal data we hold about you: Preferences → Your data in the app lists every consent you have given, when, and how to change it;
request a copy of it: Your data → Download my data gives you everything we hold as one file, immediately, as often as you like;
request correction of inaccurate data;
request deletion of data we are not legally required to keep. You can do this yourself from Preferences → Close my account in the app, once you have no loan running and your wallet is empty. We then delete your statements, your questionnaire answers, your device records, your PIN and your preferences immediately, and log you out everywhere. If you never borrowed or lent, we also delete your name, date of birth and ID reference and release your phone number. If you did borrow or lend, anti-money-laundering law requires us to keep your identity record and transaction history for seven years after the account closes; we keep nothing beyond that, and the closed account cannot be used to log in;
object to certain uses of your data;
lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe we have mishandled your data.

To exercise any of these rights, or to raise a concern about how we handle your data, contact our Data Protection Officer at dpo@niazime.com. If you are not satisfied with our response, you may lodge a complaint directly with the Office of the Data Protection Commissioner, at info@odpc.go.ke or via www.odpc.go.ke.

8. Security

We encrypt data in transit and at rest on our servers. Application logs are automatically stripped of phone numbers, ID numbers, and one-time codes before they are stored, so that even our own operational logs do not carry this information in readable form. Access to systems holding customer data is limited to authorized personnel, and administrative actions that change a customer's score, limit, or verification status are automatically logged with who made the change and what changed.

9. Children

Niazime is not available to anyone under 18. We do not knowingly collect data from minors. If we learn that a registered account belongs to someone under 18, we will close it.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by SMS or in-app notice before they take effect.

11. Contact

Our Data Protection Officer can be reached at dpo@niazime.com for any question about this policy or your personal data.