Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Natal Tech Company Limited ("Natal Tech", "we", "us", or "our") collects, uses, stores, protects, discloses, and otherwise processes personal information in connection with the RocketPesa - Easy Cash Loan mobile application ("RocketPesa" or the "App"), package name p.rocketpesa, and related RocketPesa services and website.

Natal Tech Company Limited is the developer and operator of RocketPesa - Easy Cash Loan and is the primary organization responsible for the processing of personal information described in this Privacy Policy, except where another organization acts as an independent data controller under applicable law.

RocketPesa is intended for eligible adults in Kenya. The App provides or facilitates personal loan services, including account registration, identity and eligibility checks, loan applications, loan disbursement, repayment, customer support, fraud prevention, and related financial services. This Privacy Policy should be read together with the applicable RocketPesa Terms and Conditions and any notices presented to you in the App.

By using RocketPesa, you acknowledge the data practices described in this Privacy Policy. Where applicable law requires consent for a particular processing activity, we will request that consent separately or through an appropriate in-App notice.

2. Information We Collect

The information we collect depends on how you use RocketPesa, the services you request, legal and regulatory requirements, and the information needed to assess and service a loan.

2.1 Information you provide directly

• Account and contact information, such as your name, mobile phone number, email address (if provided), and login or account credentials.
• Identity and KYC information, such as date of birth, nationality, national identification number or passport number, and other information reasonably required to verify your identity and comply with applicable Know Your Customer (KYC), anti-fraud, anti-money-laundering, or financial-services requirements.
• Identity documents or images that you actively choose to submit through a user-initiated camera or document-selection flow, if such verification is required. RocketPesa does not require broad access to your photo library for this purpose.
• Loan application information, such as requested loan amount, repayment information, occupation or employment details, income or affordability information, residence information, and other details you enter when applying for or managing a loan.
• Payment and repayment information that you provide or authorize us to receive in connection with disbursement or repayment.
• Reference or emergency-contact information that you intentionally type into RocketPesa, if such a feature is offered. RocketPesa does not request the Android READ_CONTACTS permission and does not access or upload your device address book.
• Customer-support communications, complaints, requests, survey responses, and other information you send to us by email, WhatsApp, in-App support, telephone, or other support channels.

2.2 Information received from financial, identity, and credit partners

Where permitted by law and, where required, with your authorization or consent, we may receive information from third parties that help us provide, verify, fund, service, or protect the RocketPesa services, including:

• Mobile money and payment providers: information needed to confirm an account, process disbursements or repayments, confirm transaction status, and reconcile payments.
• Licensed credit reference bureaus (CRBs): credit reports, credit history, credit score or similar creditworthiness information, where access is legally permitted.
• Identity verification and KYC service providers: identity-verification results, document-verification results, fraud indicators, and related compliance information.
• Service providers assisting with fraud prevention, cybersecurity, payment processing, collections, or other permitted financial-services functions.

We do not obtain data from these sources for unrelated advertising purposes.

2.3 Device, technical, security, and usage information

When you use RocketPesa, we may collect limited technical and operational information needed to operate, secure, troubleshoot, and improve the App. This may include:

• Device model, operating system version, App version, language, time zone, and network type.
• Internet Protocol (IP) address, session information, request timestamps, and server or application logs.
• App-scoped or resettable identifiers where permitted by platform rules and applicable law, and security signals used to detect account abuse, automated attacks, fraud, or unauthorized access.
• Crash reports, performance diagnostics, error logs, and feature-usage events that help us maintain the App and resolve technical problems.

RocketPesa does not request the Android QUERY_ALL_PACKAGES permission and does not collect a broad list of applications installed on your device.

2.4 Website information

If you visit the RocketPesa website, our servers may receive basic technical logs such as IP address, browser or device type, referring page, pages visited, and access time. If cookies or similar technologies are used, they will be used for website operation, security, preferences, analytics, or other purposes disclosed on the website, subject to applicable law.

3. Device Permissions and Data We Do Not Access

• We do not access, upload, or scan your device contact list or address book.
• We do not collect a broad inventory of applications installed on your device.
• Contact or reference information is processed only when you intentionally type or submit it through the App, if such a feature is offered.
• If RocketPesa asks you to submit an identity document, selfie, or other file, the App should use a user-initiated method such as the camera, document picker, or photo picker rather than scanning unrelated files on your device.

4. How We Use Personal Information

We use personal information only for legitimate and disclosed purposes connected with RocketPesa and applicable legal obligations. These purposes may include:

• Creating, authenticating, and administering your RocketPesa account.
• Verifying your identity, age, eligibility, and information provided in your application.
• Assessing affordability, creditworthiness, fraud risk, and loan eligibility.
• Making, communicating, and administering loan offers and decisions, including loan limits and repayment terms where applicable.
• Disbursing loans and processing, confirming, reconciling, or collecting repayments.
• Maintaining account, transaction, and loan records.
• Detecting, investigating, preventing, and responding to fraud, account abuse, identity theft, cybersecurity incidents, and other unlawful activity.
• Complying with KYC, anti-money-laundering, credit-reporting, tax, accounting, consumer-protection, regulatory, court, and law-enforcement obligations, where applicable.
• Providing customer service, responding to requests, resolving complaints and disputes, and communicating important service or account notices.
• Maintaining, debugging, securing, and improving RocketPesa and related systems.
• Sending marketing communications only where permitted by law and, when consent is required, only after obtaining that consent. You may opt out of promotional communications using the available unsubscribe or contact method.

5. Credit Assessment and Automated Decision-Making

RocketPesa may use automated or semi-automated tools to assist with identity verification, fraud detection, affordability checks, credit-risk assessment, loan eligibility, loan limits, and other lending decisions. Depending on the service, an automated assessment may affect whether a loan is offered and the terms that are made available.

The data used for these assessments may include information you provide in your application, repayment and account history, permitted mobile-money or payment information, information from licensed credit reference bureaus, KYC results, and limited technical or security signals.

RocketPesa does not use your device contact list or a broad installed-app list as credit-scoring inputs.

Where applicable law gives you a right to information about, object to, or request human review of a decision based solely on automated processing that significantly affects you, you may contact us using the details in Section 17.

6. How We Share Personal Information

We may disclose personal information only where necessary for the purposes described in this Privacy Policy, where you direct us to do so, or where disclosure is required or permitted by law. The recipients may include:

• Mobile money operators, banks, payment processors, and payment-service providers that support loan disbursement and repayment.
• Licensed credit reference bureaus and other legally authorized credit-reporting entities, where permitted by law, including for credit assessment and reporting of repayment performance or default.
• Identity verification, KYC, anti-fraud, cybersecurity, cloud hosting, communications, analytics, customer-support, and other service providers that process data on our behalf and under contractual or legal obligations.
• Lawyers, auditors, insurers, accountants, and other professional advisers where reasonably necessary.
• Regulators, supervisory authorities, courts, law-enforcement agencies, government bodies, or other parties where disclosure is required by law, legal process, regulatory request, or to protect rights, safety, and security.
• A buyer, investor, lender, successor, or other relevant party in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

We do not sell or rent personal information for third-party advertising. Service providers are permitted to use personal information only for the services they provide to us or as otherwise permitted by applicable law.

7. Legal Bases and Permissions for Processing

Depending on the processing activity and applicable law, we process personal information on one or more of the following bases:

• Performance of a contract or steps requested by you before entering into a contract, such as opening an account, evaluating a loan request, disbursing funds, and processing repayments.
• Compliance with legal or regulatory obligations, including KYC, anti-fraud, anti-money-laundering, financial reporting, credit reporting, and lawful regulatory requests.
• Our legitimate interests in operating and securing RocketPesa, preventing fraud, managing risk, improving services, and protecting legal rights, where those interests are not overridden by your rights under applicable law.
• Your consent, where consent is required for a specific activity. Where processing is based on consent, you may withdraw that consent as provided by law, without affecting processing that occurred before withdrawal.

Nothing in this Privacy Policy authorizes data collection or use that is prohibited by applicable law or Google Play policy.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including the life of your account or loan relationship, and for any additional period required or permitted by law. Retention periods may vary by data type and may be influenced by:

• The duration of your account, loan application, loan, repayment, or customer-service relationship.
• Legal, regulatory, accounting, tax, credit-reporting, KYC, anti-money-laundering, recordkeeping, and audit requirements.
• The need to prevent fraud, enforce agreements, resolve disputes, investigate complaints, or establish, exercise, or defend legal claims.

When information is no longer needed and no legal or regulatory basis requires retention, we will delete it, de-identify it, or securely dispose of it in accordance with our retention procedures. A request to delete an account does not require us to erase information that we must retain by law or that is reasonably necessary for unresolved financial, fraud, security, dispute, or legal obligations.

9. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, authentication, logging and monitoring, secure development practices, vendor controls, and encryption in transit using HTTPS/TLS where data is transmitted over public networks.

No security method is guaranteed to be completely secure. You are responsible for protecting your password, PIN, one-time codes, and device access, and for notifying us if you believe your account or credentials have been compromised.

10. International Data Transfers

RocketPesa and its service providers may process personal information in Kenya or in other countries where service providers or technical infrastructure are located. Where personal information is transferred across national borders, we will use safeguards required by applicable data-protection law and will take reasonable steps to ensure that the information remains protected consistent with this Privacy Policy.

11. Your Privacy Rights and Choices

Subject to applicable law and any lawful limitations, you may have rights regarding your personal information. These may include the right to:

• Ask whether we process personal information about you and request access to that information.
• Request correction or updating of inaccurate or incomplete information.
• Request deletion of personal information that we are not required or otherwise lawfully permitted to retain.
• Withdraw consent where processing is based on consent.
• Object to or request restriction of certain processing where applicable.
• Request information about certain automated decisions or human review where such rights apply.
• Request data portability where applicable and technically feasible.
• Lodge a complaint with the relevant data-protection authority. In Kenya, this may include the Office of the Data Protection Commissioner (ODPC), subject to its jurisdiction and applicable procedures.

To exercise a privacy right, contact us at rocketpesa@gmail.com. We may need to verify your identity before fulfilling a request. We will not discriminate against you for exercising a right provided by law.

12. Account and Data Deletion

You may request deletion of your RocketPesa account and associated personal information by using any account-deletion feature made available in the App or by emailing rocketpesa@gmail.com with a clear request to delete your account. We may ask you to verify ownership of the account before processing the request.

After a valid deletion request, we will delete or de-identify personal information that is not subject to a lawful retention requirement. Certain loan, payment, KYC, fraud-prevention, complaint, credit-reporting, accounting, or legal records may need to be retained for the period required or permitted by applicable law. Where retention is required, the information will be restricted to the permitted purpose and deleted or de-identified when the retention requirement ends.

13. Communications and Marketing

We may send service-related communications that are necessary to administer your account, loan application, loan, repayment, security, or legal notices. These communications are not promotional and may continue while you have an active account or outstanding obligation.

Promotional communications will be sent only where permitted by applicable law. Where consent is required, you may withdraw that consent or opt out using the method provided in the communication or by contacting us. Opting out of promotional messages does not stop essential account, security, repayment, or legal communications.

14. Children and Age Restrictions

RocketPesa is not intended for children. You must be at least 18 years old and otherwise eligible under applicable requirements to use the lending services. We do not knowingly provide personal loans to persons under 18. If we learn that information has been collected from a person who is not legally eligible to use the service, we will take appropriate steps in accordance with applicable law.

15. Third-Party Services and Links

RocketPesa may contain links to third-party websites, payment interfaces, mobile-money services, or other services that are not operated by Natal Tech Company Limited. Those third parties may process personal information under their own privacy policies and terms. We encourage you to review their privacy notices. This Privacy Policy does not govern independent third-party services except to the extent that we receive and process information from them as described above.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in RocketPesa, legal or regulatory requirements, security practices, service providers, or data-processing activities. When we make a material change, we will update the "Last Updated" date and, where appropriate or required, provide additional notice in the App, on the website, or through another suitable channel. Your continued use of RocketPesa after an update is subject to the updated policy, to the extent permitted by law.

17. Contact Us

If you have questions, complaints, or requests about this Privacy Policy or the processing of your personal information, please contact: