Privacy notice

Privacy notice

This notice explains how SonkoLend Ltd handles personal data as a data controller under the Data Protection Act, 2019.

What we collect

Only what the loan process needs. We do not read your phone contacts, messages or location.

• Your phone number, which is your login and where SMS codes and reminders go.
• Your name and national ID number, and a selfie for an identity and liveness check.
• Your M-Pesa statement, only if you upload one to support an application.
• Your loan history with SonkoLend: applications, approvals, payments, days past due.
• For chama officers: the chama's registration documents, officers' names and the pledge account details.
• Technical records of sign-ins and actions, kept for security and audit.

What we use it for

• Verifying who you are and that you are a member of your chama.
• Assessing and pricing your application, and producing your disclosure and agreement.
• Disbursing to and collecting from your M-Pesa, and sending receipts and reminders.
• Meeting legal obligations, including credit reporting after the notice process described on your rights page.
• Keeping the platform secure and investigating complaints.

Who we share it with

We never sell personal data. It is shared only with:

• Your chama's officers: your loan requests, status and days past due, so they can approve and follow up.
• Identity-verification and SMS providers, to run the checks and deliver messages.
• Safaricom (M-Pesa), to send and receive payments.
• A credit reference bureau, only after the 30-day notice process, and regulators or courts where the law requires.

Your rights

Under the Act you can:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is wrong.
• Ask us to delete data we are not required by law to keep; loan records must be retained for the statutory period.
• Complain to us, and to the Office of the Data Protection Commissioner.

How long we keep it

Loan and payment records are kept for the period financial regulation requires after a loan closes. Uploaded statements are deleted on a fixed schedule after the application they supported is decided. Identity-check images are not retained beyond the check.

How we protect it

Personal data is encrypted at rest with managed keys, access is limited by role and logged, and identity documents are redacted from our logs.

Contact and requests

Questions about this notice or your data: Contact. Signed-in members can make data requests directly from their privacy page. Sign in.

This page is reviewed with our legal advisers; the version you see is the one in force.