Privacy Policy

Last Updated: January 05, 2026 | Effective Date: January 05, 2026

Welcome to Mpangosmart ("we," "our," or "us"). We are committed to protecting your personal and financial information with the highest standards of security and transparency. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application and services.

1 Information We Collect

We collect information necessary to provide our loan services, verify your identity, assess creditworthiness, and prevent fraud. This includes:

1.1 Personal Identification Information

• Full legal name and alias/maiden name if applicable
• Government-issued ID number (National ID, Passport, Driver's License)
• Date of birth and gender
• Photograph

1.2 Contact & Demographic Information

• Phone number (verified via OTP)
• Email address
• Physical address and proof of residence
• Country of residence and nationality

1.3 Financial Information

• Employment details: employer name, position, income level

1.4 Device & Technical Information

• Device identifiers: Device model and device ID
• Device specifications: operating system version
• Network information: IP address, mobile network
• App usage data: feature usage, session duration

1.5 Permissions We Request

Permission	Purpose	Required/Optional
Storage/Photos	To upload identification documents	Required
Location (Approximate)	For regulatory compliance purposes	Optional
Phone State	For app functionality	Required

2 How We Use Your Information

We process your personal data based on the following legal grounds:

Purpose of Processing	Legal Basis	Data Categories Used
Loan Application Processing To evaluate your eligibility and process your loan	Performance of Contract	Personal, Financial, Contact
Identity Verification To confirm your identity	Legal Obligation & Legitimate Interest	Personal, Documents
Credit Risk Assessment To determine loan terms and interest rates	Legitimate Interest & Consent	Financial, Transaction History
Customer Support To respond to your inquiries and provide assistance	Performance of Contract	Contact, Application Data
Security To protect our platform and users	Legitimate Interest	Device, Network, Usage Data
Regulatory Compliance To meet legal and reporting obligations	Legal Obligation	All relevant categories
Service Improvement To enhance our app and services	Legitimate Interest	Anonymized Usage Data

3 Data Security & Encryption

We implement robust security measures to protect your data:

• End-to-End Encryption: All data transmission uses HTTPS/TLS 1.2+ encryption
• Data Encryption at Rest: Sensitive data is encrypted using AES-256 encryption
• Access Controls: Strict role-based access control and authentication mechanisms
• Regular Security Audits: Periodic vulnerability assessments
• Secure Development: Adherence to security standards in app development
• Employee Training: Regular data protection training for all staff

4 Data Retention Periods

We retain your personal data only as long as necessary:

Data Type	Retention Period	Reason for Retention
Active Account Data	Duration of account activity + 7 years	Service provision and legal requirements
Loan Application Data	7 years after final settlement	Financial regulations and dispute resolution
Transaction Records	10 years	Tax and financial audit requirements
Inactive Account Data	2 years after inactivity	User reactivation possibility

After retention periods expire, data is either anonymized for statistical purposes or securely destroyed using industry-standard methods.

5 Your Rights & Choices

You have the following rights regarding your personal data:

5.1 Data Subject Rights

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit processing of your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw previously given consent at any time

5.2 How to Exercise Your Rights

To exercise any of these rights, please contact our Data Protection Officer using the contact information below. We will respond within 30 days as required by law.

5.3 Consent Withdrawal Consequences

Note that withdrawing consent for essential processing (like identity verification) may result in inability to use our loan services.

6 International Data Transfers

All your data is stored and processed within our secure local servers. We do not transfer your personal data internationally.

7 Cookies & Tracking Technologies

Our app uses essential cookies and similar technologies:

• Session Cookies: For app functionality and user authentication
• Security Tokens: To maintain secure sessions
• Analytics Cookies: To understand app usage patterns (anonymized)
• Preference Cookies: To remember your settings and preferences

You can manage cookie preferences through your device settings, though disabling essential cookies may affect app functionality.

8 Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately for deletion.

9 Policy Updates & Notifications

We may update this Privacy Policy periodically. When we make material changes:

• We will notify you via in-app notifications or email 30 days before changes take effect
• We will update the "Last Updated" date at the top of this policy
• Your continued use of our services after changes constitutes acceptance of the updated policy

10 Complaints & Supervisory Authority

If you have concerns about our data handling practices, you have the right to lodge a complaint:

1. First, contact us: Use the contact details below to resolve the issue directly
2. Regulatory Authority: If unsatisfied, you may contact your local data protection authority