Loan-app data rights in Kenya: requests and complaints
A loan-app permission, a company’s stored record and the amount you owe are different things. Identify the company handling your information, say exactly what needs checking, and keep a dated copy of the request. This guide helps a Kenyan borrower separate a privacy problem from a dispute about loan charges, without assuming that deleting an app deletes the company’s records.
Credizen practical analysis
Separate device permissions from stored information
Before granting access, read the app’s privacy notice and identify the legal company, the information it requests, the stated purpose and its privacy contact. A familiar app name or a link in a message does not prove which company will receive your data. Save the notice and the date you saw it before making a decision.
Changing a phone permission controls that device setting. Do not assume it retrieves information already sent, removes another company’s copy or closes your credit account. Ask the named company what it holds and which request channel to use. If the app asks for contacts, photos or messages, ask why that particular access is needed rather than granting everything to reach the next screen.
What ODPC says you can ask about
ODPC lists rights to be informed about how personal data will be used, access data held by a controller or processor, object to processing, and seek correction or deletion of false or misleading information. Its principles also require data to be relevant to the stated purpose and not kept longer than necessary.
Match the request to the problem. “Show me the information held about my account” is an access request; “this employer is wrong” asks for a correction. A general demand to delete every record gives the company less information about the specific error you need resolved. Ask for its written response and explanation of any information it says it must keep.
Write a request that can be investigated
Use a private, verified channel and include a safe account reference, the incorrect field, the accurate replacement and a relevant supporting document if needed. An example is: “My account record still names my previous employer. Please explain which record is used, correct this field and tell me whether it has been shared with another recipient.” This is a writing example, not a finding about any lender.
Ask what identification is genuinely required for that request and how it will be protected. Do not send an OTP, account password, phone-contact export or another person’s identity document. Redact unrelated transactions before sharing evidence, while retaining an unchanged copy privately in case the receiving authority needs it later.
Keep a small, dated evidence file
Save the privacy notice, permission screen, relevant message or call details, the request you sent, proof of delivery and the reply. Note which company or number contacted you and what happened to your information. If someone else received a message, record that fact with their cooperation; avoid republishing the message and their phone number publicly.
Make a short chronology instead of sending an unlabelled folder of screenshots: date, event, company, affected information and requested remedy. Separate what you saw from what you suspect. For example, a collection message sent to a relative is an observed event; how the sender obtained the number may still need investigation.
Use ODPC’s official route for a data complaint
ODPC’s FAQ directs people wishing to complain to its official website or complaint@odpc.go.ke. The FAQ identifies a complaint channel; it does not promise that every complaint will result in deletion, compensation or a particular decision.
Check the current instructions on the official site before submitting. Explain the personal-data issue, identify the respondent as accurately as possible and attach the relevant chronology and correspondence. Include the result you want, such as access to the record, correction of an error or investigation of an alleged disclosure. Do not treat the complaint as proof that wrongdoing has already been established.
Handle payment and account security separately
If the dispute is about a fee, balance or repayment, ask for the contract, transaction history and calculation as a separate account enquiry. A privacy request is not a repayment plan. Continue checking contractual due dates and obtain specific advice if you cannot pay; do not assume a pending data complaint suspends a payment obligation.
If a message asks you to pay to a changed number or to reveal a security code, verify it through the company’s previously established channel before acting. Preserve the message. Provider links below are background reading, not evidence that a particular app is licensed, safe or suitable for your circumstances.
Questions borrowers ask
Does uninstalling the loan app delete my data?
Do not rely on uninstalling as a request to the company. Ask the identified data handler what it retains and use its verified channel to request access or correction as appropriate.
Can I ask for a false employer or contact detail to be corrected?
ODPC lists correction and deletion of false or misleading personal data among data-subject rights. Identify the particular record and explain what is wrong when making the request.
Will an ODPC complaint cancel the loan?
This guide makes no such promise. Keep the privacy issue, any disputed loan calculation and an agreement about payment as separate matters requiring their own evidence and responses.