Kilele Pesa Ltd ("Kilele Pesa", "we", "us") is a company registered in Kenya. We operate the Kilele Pesa Android application, which helps business owners and workers access loans from licensed lending partners. This notice explains what personal data we collect, why, what we do with it, and the rights you have under the Kenyan Data Protection Act, 2019 ("DPA"). We are the data controller for the processing described here.
1. What we collect
- Identity and contact details — your name, national ID number, phone number, and the business or home address you give us for your application.
- Money messages, on your device — with your permission, the app reads financial transaction SMS (M-Pesa and bank messages) on your phone to understand your income, expenses and repayment behaviour. These messages are processed on your phone and are not uploaded. What leaves your device is a credit summary — numbers such as income estimates and repayment indicators — not the messages themselves. The app does not read contacts or personal messages.
- Your interview answers — what you tell us about your business (for example how money comes in, your trading days, group savings such as a chama or SACCO). We use these to read your record fairly and may cross-check them against the summary above.
- Identity-verification (KYC) data — when you verify your identity, our verification partner captures your ID details and a facial image (biometric data) to confirm you are who you say you are. Biometric data is sensitive personal data and is processed with your explicit consent.
- Loan and repayment data — your applications, offers, the amounts you choose, disbursements and repayments.
- Basic device and technical data — such as device identifiers and app diagnostics needed to run the service securely.
2. Why we use it (and our lawful bases)
- To assess and size a fair loan offer — steps taken at your request before and under a loan agreement (contractual necessity), and our legitimate interest in responsible, affordability-capped lending.
- To verify your identity and prevent fraud — legal obligations (including anti-money-laundering law) and legitimate interests; explicit consent for biometric verification.
- To connect you with lending partners — with your consent and at your request when you submit an application.
- To carry out credit checks — only with your explicit consent, given at the point of application, through authorised channels.
- To service your loan — disbursement, repayment tracking and support (contractual necessity).
- To comply with the law — record-keeping, regulatory reporting and lawful requests from regulators or courts.
We do not use your data for third-party marketing, and we do not sell personal data.
3. Automated assessment — and your right to a human
Kilele Pesa uses automated analysis of your credit summary and interview answers to help size loan offers. In line with section 35 of the DPA:
- you have the right to be told when a decision that significantly affects you was reached by automated means;
- if your application is unsuccessful, you are entitled to a plain- language explanation of the main reasons; and
- you may contest the outcome and request that a person reviews it. Contact us at the address below and a human reviewer with authority to change the decision will consider it afresh.
4. Who we share it with
- Licensed lending partners — when you submit an application, they receive an assessment pack so their credit officers can make you an offer. Sharing is governed by written agreements that limit what partners may do with your data.
- Our identity-verification partner — to perform KYC checks, under a data-processing agreement.
- Payment providers and mobile network operators — to send your money and record repayments (for example M-Pesa).
- Regulators, law enforcement and courts — where the law compels us, including the Office of the Data Protection Commissioner and the Central Bank of Kenya.
- Service providers — such as secure cloud hosting, engaged under written contracts imposing confidentiality and security obligations consistent with section 42 of the DPA.
5. App permissions, honestly
| Permission | Why the app asks |
|---|---|
| SMS (read) | To read financial transaction messages on your device for the on-phone assessment described above. Never contacts, never personal messages, never uploaded. |
| Camera | Used by our identity-verification partner to capture your ID document and selfie during KYC. |
| Approximate location | May be requested by the identity-verification technology as a fraud-prevention signal during verification. Kilele Pesa does not track your movements or keep a history of your location. |
| Biometrics / fingerprint | To let you unlock the app securely on your own device. Your device biometrics never leave your phone. |
6. How long we keep it
- Identity and KYC records — up to seven (7) years after your relationship with us ends, as required by anti-money- laundering law.
- Loan and repayment records — for the duration of the relationship and the period required by applicable credit and banking regulations.
- Consent records — for as long as needed to evidence the consents you gave.
When a retention period ends, data is securely deleted or irreversibly anonymised.
7. Security
We protect personal data with technical and organisational measures appropriate to its sensitivity, including encryption in transit and at rest, role-based access on a need-to-know basis, audit logging of access to assessment data, and regular review of our safeguards. The most privacy-protective measure is structural: the rawest data — your messages — never leaves your phone.
8. Where your data lives
Some of our service providers store data on secure servers outside Kenya. Where personal data is transferred outside Kenya we comply with section 48 of the DPA, ensuring appropriate safeguards are in place before any transfer.
9. Your rights
Under section 26 of the DPA you have the right to:
- be informed of how your data is used (this notice);
- access the personal data we hold about you;
- have inaccurate or misleading data corrected or deleted;
- object to processing, or ask us to restrict it;
- data portability, where technically feasible;
- withdraw a consent you gave (this does not affect processing that happened before withdrawal, and may mean we can no longer provide the service that relied on it); and
- complain to the Office of the Data Protection Commissioner.
To exercise any right, email hello@kilele.money (attention: Data Protection Officer). We will acknowledge your request within seven (7) days and respond substantively within thirty (30) days.
10. Children
Kilele Pesa is for adults aged 18 and over. We do not knowingly process children's personal data.
11. Complaints
If you are unhappy with how we have handled your data, contact us first and we will try to put it right. You may also lodge a complaint with the Office of the Data Protection Commissioner, Kenya — www.odpc.go.ke · info@odpc.go.ke.
12. Changes to this notice
We will update this notice when our practices or the law change, and post the updated version on this page with a new effective date. Material changes will be flagged in the app.
13. Contact
Kilele Pesa Ltd · Nyeri, Kenya
Data Protection Officer:
hello@kilele.money