Privacy Policy

1. Data controller

The data controller is Westlip Credit Limited, which carries out its activities in accordance with the legislation of the Republic of Kenya.

2. Personal data that we process

The Company may process the following categories of personal data:

• first and last name;
• date of birth;
• phone number;
• email address;
• ID number;
• address of residence;
• employment and income information (where necessary);
• company data (for business clients);
• other information voluntarily provided by the user when submitting an application or through forms on the website.

The Company does not process special categories of personal data (sensitive data), except in cases expressly provided for by law.

The provision of personal data is voluntary; however, without it, processing of the application or provision of services may be impossible.

3. Purposes of processing personal data

Personal data is processed for the following purposes:

• processing loan applications;
• assessment of the client's creditworthiness;
• conclusion and performance of agreements;
• communication with users;
• compliance with legislative requirements;
• fraud prevention and security.

4. Legal basis for processing

Personal data is processed on the basis of:

• consent of the data subject;
• necessity for the performance of a contract or the taking of steps prior to its conclusion;
• performance of the Company's legal obligations;
• the Company's legitimate interests, including fraud prevention and risk management.

5. Retention of personal data

Personal data is stored for no longer than is necessary to achieve the purposes of processing, or for the periods established by the legislation of the Republic of Kenya.

6. Transfer of personal data to third parties

The Company may transfer personal data to:

• credit bureaus (CRB) for the purposes of creditworthiness assessment and the performance of obligations;
• providers of technical services (hosting, data processing, communication services);
• public authorities — in cases provided for by law.

Transfer is carried out in compliance with the requirements of personal data protection legislation.

7. Rights of data subjects

The user has the right to:

• access to their personal data;
• rectification of inaccurate data;
• erasure of data (in cases provided for by law);
• restriction of processing;
• withdrawal of consent;
• submit a complaint to the competent data protection authority in the Republic of Kenya.

8. Measures for the protection of personal data

The Company applies organizational and technical measures to protect personal data from unauthorized access, loss, alteration, or disclosure.

9. Contact regarding personal data

For matters related to the processing of personal data, the user may contact the Company using the contact details specified on the website.