Privacy (Kenya)

What we collect

When you use Credizen to compare loans in Kenya, we may collect the following categories of personal and non-personal data:

• Loan comparison preferences — requested loan amount, preferred repayment term, loan purpose, and any filters you apply when comparing lenders.
• Contact details — name, email address, and phone number, only if you voluntarily submit them through a contact or inquiry form.
• Analytics data — page views, pages visited, time on site, device type, browser, operating system, screen resolution, and referrer (the website or search engine that brought you to Credizen).
• Cookies — small text files stored on your device to maintain your session and remember your preferences. See the Cookies and tracking section below for full details.

Why we collect it

We process your data for the following purposes, each with a lawful basis under the Data Protection Act, 2019:

• Generate loan comparisons — to display personalised results that match the amount, term, and criteria you select.
• Route requests — to direct you to the correct lender website when you click "Apply" or "Visit lender".
• Improve matching — to refine our comparison algorithms and ensure the most relevant lenders appear for your situation.
• Analytics and service improvement — to understand how visitors use Credizen so we can improve navigation, page speed, and content quality.
• Comply with legal obligations — to meet record-keeping and reporting requirements under Kenyan law, including the Data Protection Act, 2019 and any directives from the Office of the Data Protection Commissioner (ODPC).

Your rights under the Data Protection Act 2019

Kenya's Data Protection Act, 2019 (DPA) grants you the following rights in relation to your personal data. You may exercise any of these rights at any time by contacting us.

• Right to be informed — you have the right to be told what personal data we collect, why we collect it, and how it is processed.
• Right to access — you may request a copy of all personal data we hold about you, free of charge.
• Right to rectification — if any personal data we hold is inaccurate or incomplete, you have the right to request its correction.
• Right to deletion — also known as the "right to be forgotten", you may request that we erase your personal data where there is no compelling reason for its continued processing.
• Right to restrict processing — you may ask us to limit how we use your data in certain circumstances, for example while a complaint is being investigated.
• Right to data portability — you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another data controller.
• Right to object — you may object to the processing of your personal data for purposes such as analytics or marketing at any time.
• Right not to be subject to automated decision-making — you have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects on you.

To exercise any of these rights, please email dpo@credizen.net or use our contact page. We will respond within 30 days of receiving your request.

Data we share

Credizen is a comparison service, not a lender. When you click "Apply" or "Visit lender", we redirect you to the lender's own website. We do not share any of your personal data with lenders unless you explicitly submit a form on their site after being redirected.

We do not sell, rent, or trade your personal data to any third party. Analytics data we collect is anonymised and cannot be used to identify you individually. We may share anonymised, aggregated statistics with partners solely for the purpose of improving our service.

Data retention

We retain your data only for as long as necessary to fulfil the purposes described in this policy:

• Loan comparison data (preferences and search criteria) — retained for 12 months from the date of your last comparison, then permanently deleted.
• Analytics data — anonymised and retained for 24 months, after which it is permanently deleted.
• Contact form submissions — retained for 36 months to allow us to follow up on queries and comply with record-keeping obligations, then permanently deleted.

You may request early deletion of your data at any time by exercising your right to deletion (see above).

Cookies and tracking

Credizen uses a limited number of cookies to ensure the site functions correctly and to understand how visitors use the service:

• Essential cookies — required for basic site functionality such as maintaining your session and remembering your preferences. These cookies cannot be disabled.
• Analytics cookies — privacy-respecting analytics cookies that help us measure page views, session duration, and popular content. These cookies do not track you across other websites and do not store personally identifiable information.
• No third-party advertising cookies — Credizen does not use any third-party advertising or remarketing cookies. We do not serve ads and we do not allow ad networks to place cookies on our site.

You can manage cookie preferences through your browser settings at any time. Disabling essential cookies may affect site functionality.

Data safety and official guidance

We take the security of your personal data seriously. All data transmitted between your browser and Credizen is encrypted using TLS (Transport Layer Security). We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction.

Our data processing practices are guided by the Data Protection Act, 2019 (DPA) and the regulations issued by the Office of the Data Protection Commissioner (ODPC). In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we are obligated to notify the ODPC within 72 hours of becoming aware of the breach, and to inform affected individuals without undue delay.

For official guidance on personal data protection in Kenya, visit the Office of the Data Protection Commissioner (ODPC).

How to lodge a complaint

If you believe your personal data has been mishandled or your rights under the Data Protection Act, 2019 have been violated, we encourage you to resolve the matter with us first:

• Contact Credizen directly — email dpo@credizen.net or use our contact page. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
• Escalate to the ODPC — if you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner at odpc.go.ke or by emailing info@odpc.go.ke.

Contact

If you have any questions about this privacy policy or wish to exercise your data protection rights, you can reach us through the following channels:

• General enquiries — use our contact page.
• Data Protection Officer — for all privacy and data protection matters, email dpo@credizen.net.