Niazime Privacy Policy

Version 2026-10-15 (2026 Regulations edition). This edition applies once Niazime operates under the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026. Under review by counsel against the Data Protection Act 2019.

1. Who controls your data

Niazime is a product of Niazime Limited, an independent Kenyan private company (Company No. PVT-EY1BV5PB), with its registered office at Woodvale Place, Woodvale Grove, Westlands, Nairobi. Niazime Limited is the data controller for the personal information described in this policy.

Niazime Limited is registered with the Office of the Data Protection Commissioner as a data controller, registration 513-0317-76BE (certificate valid from 8 October 2026 to 8 October 2028).

Niazime lends its own money to individuals through the Kopa personal loan. It is applying for registration with the Central Bank of Kenya as a non-deposit taking credit provider under the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026. Niazime does not run a marketplace, does not connect you with other lenders, and does not hold your money in a wallet.

Our Data Protection Officer is George Mukiu Kiio, who can be reached at dpo<at>niazime.com.

2. What we collect, and why

Data	Why we collect it
Phone number, verified by a one-time code	Your account identity; the only channel we use to reach you. Loans are paid to this line, and money is returned to the line that sent it
Full name and date of birth as held in the government identity registry for your National ID number, the bureau's reference for the check, and the bureau's short summary about the ID on that day: whether the card was reported lost, a fraud-risk level (low, medium or high) with its reasons, and counts of recent credit enquiries and mobile loans on the ID	Confirming you are a real, eligible (18+) Kenyan National ID holder, as required for customer due diligence under Kenyan law. The check is made through TransUnion Kenya, a licensed credit reference bureau with access to the registry. Your ID number is used for the check and is not stored; only a one-way hash of it is kept, to stop the same ID being used twice. The bureau's summary is used to protect you and us from identity fraud: a card reported lost or a high fraud-risk level sends your registration to a person for review, never to an automatic refusal. Your sex is not kept
The KES 1 line check: the M-Pesa payment you approve with your own M-Pesa PIN (amount, M-Pesa receipt number, the paying line) and the registered name Safaricom returns with it	Proving that you control the M-Pesa wallet, not only the SIM card, and giving us the name your M-Pesa line is registered to for the name match below. This happens before any paid identity or bureau check. The shilling is sent straight back to the same line at no cost to you; it is not a fee or a deposit, and we keep nothing (section 6)
Whether the name on your ID matches the name your M-Pesa line is registered to (from the statement you upload and the name Safaricom returns with the KES 1 line check)	Confirming that the person on the ID is the person on the phone. We do not take a selfie, video or any biometric data, and we do not use any identity-verification service other than the registry check through TransUnion. If the names differ (for example a line in a family member's name), a person reviews your registration
A summary of your credit reference bureau report (TransUnion: your score, whether you are listed for an unpaid loan, open loans, amount outstanding, the bureau's reference), pulled once at your first loan request, and the phone numbers other credit providers have reported against your ID, kept only as a one-way code and a masked form such as 0712•••345, never readable	Deciding whether to lend. A bureau report on its own never leads to a decline, except where it shows a default or a restructured account. The phone codes let us check that the line we pay is one other credit providers already know as yours, and spot one number being used across several identities; a mismatch is looked at by a person, never an automatic refusal. The report itself is not kept, and the ID number used to pull it is not stored. If the name on the bureau report does not match your verified name, a person reviews the request
Your answer to whether you, a close family member, or a close associate hold or have held a prominent public office	A legal obligation on all lenders under Kenya's anti-money-laundering law (POCAMLA). A "yes" does not disqualify you; it means a person reviews your registration, with closer checks as the law requires
Your M-Pesa statement (the Safaricom PDF covering at least three complete months, with your consent, and the password used once to open it)	Assessing your ability to repay, and detecting patterns like existing debt or gambling activity that affect whether we can lend to you and how much. We run checks to confirm the statement is genuine and unaltered
The same statement summary (no new data)	Showing you, on the Money health screen, a simple picture of your own money habits with tips. Only you see it; it is a guide, not a credit score, and it does not change what we lend you
Your answers to our short questionnaire	Cross-checked against your statement, as a further input to your loan decision
Your loans: amount, term, interest, due date, repayments, and whether a loan is overdue	Running your loan under the loan agreement, sending you reminders, reporting to the credit bureau (section 9), and keeping the accounting and audit records the law requires
M-Pesa payment details for money you send us or we send you: amount, M-Pesa receipt number, the line it came from or went to, the name Safaricom returns with it, and the loan or account number used	Only to pay out your loan, apply your repayments, and send back payments that are not for a loan (and any overpayment). A repayment made from a line other than yours is reviewed, as anti-money-laundering law requires (section 7)
A backup phone line (Airtel), only if you add one, verified by a one-time code	A second way to send you a sign-in code when SMS to your Safaricom line fails, and to approve a change of your main number. We never send money to it and never use it to contact anyone but you. You can remove it in Settings at any time, and it is deleted when you close your account
If you sign up with someone's referral code: which account invited you	Giving that person KES 100 off their next loan once you qualify, and blocking self-referrals. The reward is never paid as cash. They are told only how many people have joined with their code and what discounts they have earned; they are never shown who you are, whether you borrowed, or how you repaid. You can clear the code at sign-up and join without it
Device identifier: a random code the app creates on your phone the first time you use it (not your phone's serial number or IMEI)	Detecting when the same device is used by more than one account, to prevent fraud and one person borrowing under several identities (a device shared with two or more other accounts sends your registration to a person for review); stopping a referral between linked accounts; and asking for your ID number when a long-unused account signs in from a new device
Your email address, read from the header of the M-Pesa statement you upload, or typed by you in Preferences	Sending you a statement of your loans and payments when you ask for it by email, as a password-protected PDF. The password is your ID number, an underscore and the year; you type the ID number when you ask, we check it against the one you verified with, use it once to lock the file, and do not store it. We do not use the address for anything else and never write to it unasked; you can change it in Preferences at any time. Staff can see it
If you turn on signing in with your phone's lock: the public half of a passkey your phone creates	Letting you sign back in with your phone's screen lock and your Niazime PIN, without an SMS code. Whatever you use to unlock your phone (fingerprint, face or screen lock) never leaves your phone and we never receive it; the phone only proves it unlocked the passkey. You can turn it off in Settings, and it is deleted when you close your account
A push-notification address for this phone, only if you turn notifications on	Sending loan reminders and account updates as notifications instead of SMS. You can turn it off in Preferences at any time; we then delete the address and go back to SMS
Complaints you raise with us, by app, email or phone, and our responses	Handling your complaint and keeping the complaints register the Central Bank of Kenya requires

3. Our legal basis for using your data

We use your data only where the Data Protection Act 2019 allows it:

Your consent, for your M-Pesa statement, a backup phone line, push notifications, passkey sign-in and an email address you type in. You can withdraw it at any time; we may then be unable to assess a new loan.
Our contract with you, to run your account and your loans: paying out, applying repayments, returning money, reminders and statements.
Legal obligations, including customer due diligence and record keeping under POCAMLA and the Prevention of Terrorism Act 2012, credit bureau reporting under the Credit Reference Bureau Regulations 2020, complaints handling and reporting under the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026, and tax and accounting records.
[TO CONFIRM (counsel): legitimate interests for fraud checks (device identifier, bureau phone codes), and the lawful basis for each row in section 2.]

4. What we don't collect

We do not access your phone's call logs, SMS, contacts or photos, and we do not collect your device's IMEI. We do not take a selfie, video or any biometric data. Our assessment of your ability to repay is based on the M-Pesa statement you choose to provide, your own answers and your credit report, not on scanning your device.

We contact only you about your loan. We never contact your family, friends or employer.

5. What we do with your M-Pesa statement specifically

Your statement is used once to extract the signals described above. The statement file itself is stored on an encrypted volume and is automatically deleted after 90 days; the signals we derived from it (not the statement itself) are kept as part of your scoring history. The password you provide to open the file is used at the moment of upload and is never stored or logged.

6. The KES 1 line check

Before we run any paid identity or bureau check, we send an M-Pesa payment prompt for KES 1 to your phone. You approve it with your own M-Pesa PIN. We process the payment and the registered name Safaricom returns with it to confirm that you control the M-Pesa wallet and that the name on it matches the name on your ID. We then send the shilling straight back to the same line by M-Pesa, at no cost to you. It is not a fee or a deposit, and nothing is kept.

7. Payments and returning money

Niazime holds no customer money and has no wallet. We process payment data only to:

pay your loan by M-Pesa straight to your own registered line;
apply repayments you make to our M-Pesa Pay Bill against your loan number, or through the M-Pesa prompt in the app;
send back, free, to the line that paid it, any payment that has no loan to go to, and any overpayment.

A repayment made from a line other than your own is reviewed by a person, as anti-money-laundering law requires.

8. How we decide on a loan

Your loan decision is based on your M-Pesa statement, your questionnaire answers and your TransUnion credit report. If we decline you, we tell you the reasons and offer a review by a person within 14 days. Any change a member of staff makes in your favour (for example to your limit or your verification status) needs a second approver or waits 24 hours, and is reported.

9. Credit bureau reporting

We report your Niazime loans to TransUnion Kenya, a licensed credit reference bureau, monthly, as the law requires. Reports include positive information (loans repaid) as well as negative information. Before we list you as a negative record we give you at least 30 days' notice. We never make a negative listing where KES 1,000 or less is outstanding. Once you pay, we update the bureau.

10. Who we share your data with

Safaricom (M-Pesa), to run the KES 1 line check, pay out loans, receive repayments through our Pay Bill and the in-app M-Pesa prompt, and send money back to you.
TransUnion Kenya (Credit Reference Bureau Africa Limited), a licensed credit reference bureau, which (a) confirms your identity document number against the government identity registry and returns your registered name, date of birth and sex, (b) provides your credit report when you apply for your first loan, and (c) receives our reports on your loans (section 9). It receives your name and document number. TransUnion processes this in Kenya; no identity data leaves the country for this check.
Our hosting provider (Amazon Web Services), whose data centre in Cape Town, South Africa, runs the Niazime app, stores its data and holds its encrypted backups (section 11).
Our email provider (Zoho Mail), which carries the statements you ask for by email, and our own mailboxes. The statement is a password-protected PDF, so the mail system never holds a readable copy of it.
Our SMS and voice provider (Africa's Talking), which delivers our text messages and, when you ask for it, the phone call that reads out your sign-in code. It receives your phone number and the message; it keeps no other data about you for us.
Our security monitoring provider (LimaCharlie), which watches our systems for attacks and misuse. It receives technical records from our servers (server names, IP addresses, commands run and running programs), not your customer records, and holds them in the United Kingdom (Google Cloud, London).
Your phone's push-notification service (Google or Apple), which carries notifications to your phone if you turn them on. It sees that a message was sent, not who you are; the message text is encrypted to your phone.
The Central Bank of Kenya, where the law requires: we report to the Bank as the Regulations require (regulation 66), the Bank may inspect our records, including loan and complaint records, and the Bank receives your complaint details if you escalate a complaint to it.
The Financial Reporting Centre, where anti-money-laundering law requires us to report a transaction.
The Office of the Data Protection Commissioner and law enforcement, where we are legally required to disclose information to them.
The personal representative of your estate, on proof of death and of their appointment: your statement, your data export and any amount due to or from the estate, and nothing more (section 3.3 of the Terms).
A collections partner, only if we engage one for an unpaid loan, and only the information necessary for that purpose. A collections partner may contact only you, never your family, friends or employer.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

11. Transfers outside Kenya

The Niazime app and its data, including encrypted backups, are hosted by Amazon Web Services in its Cape Town, South Africa region. This is a transfer of your data outside Kenya: it is encrypted in transit and at rest, held under a contract that limits the provider to hosting it for us, and only authorised Niazime staff can open it. Your identity check through TransUnion is processed in Kenya. Our server's security monitoring (LimaCharlie) sends technical records about the server itself, not your customer records, to the United Kingdom; a server log line can include a phone number or account reference, so we treat it as a transfer too and hold it under the same contractual limits.

12. How long we keep your data

Statement files: 90 days, then deleted (section 5).
Account, loan and payment records: for as long as your account is active, and afterward for the period Kenyan financial and tax law requires us to keep such records.
Customer due diligence results, including the KES 1 line check: for as long as required to demonstrate compliance with anti-money-laundering and KYC obligations.
Complaints: kept in the complaints register with your account record. [TO CONFIRM (GK, counsel): retention period for the complaints register; nothing deletes complaints today.]
Dormant accounts (no sign-in or transaction for 12 months): not deleted for dormancy alone, so you can sign in again; we hold no money for you. The retention rules above apply from closure, not from dormancy.

13. Your rights

Under the Data Protection Act 2019, you have the right to:

know what personal data we hold about you: Settings → Your data in the app lists every consent you have given, when, and how to change it;
request a copy of it: Your data → Download my data gives you everything we hold as one file, immediately, as often as you like;
request correction of inaccurate data;
not be subject to a decision based only on automated processing: if we decline you, you can ask for a review by a person within 14 days (section 8);
request deletion of data we are not legally required to keep. You can do this yourself from Settings → Your data → Close my account in the app, once you have no loan running. We then delete your statements, your questionnaire answers, your device records, your PIN, your passkeys and your preferences immediately, and log you out everywhere. If you never borrowed, we also delete your name, date of birth and ID reference and release your phone number [TO CONFIRM (counsel): must the KES 1 line check record be kept under anti-money-laundering law where you never borrowed? The app currently treats a completed line check as a transaction and keeps the identity record]. If you did borrow, anti-money-laundering law requires us to keep your identity record and transaction history for seven years after the account closes; we keep nothing beyond that, and the closed account cannot be used to log in;
withdraw your consent, and object to certain uses of your data;
lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe we have mishandled your data.

To exercise any of these rights, or to raise a concern about how we handle your data, contact our Data Protection Officer at dpo<at>niazime.com. If you are not satisfied with our response, you may lodge a complaint directly with the Office of the Data Protection Commissioner, at info@odpc.go.ke or via www.odpc.go.ke.

14. Complaints about your loan or our service

You can complain in the app (Help & complaints), by email to info<at>niazime.com, or by phone on +254 738 631 213. We give you a reference number immediately and acknowledge your complaint in writing within 7 days. If you complain by phone or in person and it is not resolved straight away, we confirm it in writing within 48 hours. We send you our resolution, with reasons, within 30 days. If you are not satisfied, you can escalate your complaint to the Central Bank of Kenya (www.centralbank.go.ke). We keep a register of complaints as the Regulations require.

15. Security

We encrypt data in transit and at rest on our servers and in our backups. Application logs are automatically stripped of phone numbers, ID numbers, and one-time codes before they are stored, so that even our own operational logs do not carry this information in readable form. Access to systems holding customer data is limited to authorized personnel, and administrative actions that change a customer's score, limit, or verification status are automatically logged with who made the change and what changed.

Your account is protected by your app PIN. One-time codes expire in 5 minutes, allow 3 tries, are rate-limited and are watched for misuse. Three wrong ID numbers at the credit check lock that step for an hour. Our systems are monitored for attacks and misuse.

16. Children

Niazime is not available to anyone under 18. We do not knowingly collect data from minors. If we learn that a registered account belongs to someone under 18, we will close it.

17. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by SMS or in-app notice before they take effect.

18. Contact

Our Data Protection Officer can be reached at dpo<at>niazime.com for any question about this policy or your personal data. You can also write to Niazime Limited, Woodvale Place, Woodvale Grove, Westlands, Nairobi (P.O. Box 65 - 90302, Kathonzweni), email info<at>niazime.com, or call +254 738 631 213. Website: www.niazime.com.