Privacy Policy

Lakisa Assetlink Finance is the trading name of [Registered company name — e.g. Lakisa Assetlink Finance Limited], a company registered in Kenya (registration number [Company registration number]), with its registered office at Fedha Estate, Embakasi, Nairobi, Kenya.

For the personal data described in this policy, Lakisa Assetlink Finance is the data controller under the Data Protection Act, No. 24 of 2019 (Kenya) (the “DPA”). We are registered with the Office of the Data Protection Commissioner (“ODPC”) under [ODPC registration number].

Our Data Protection Officer can be reached at [Data Protection Officer — name & email, e.g. dpo@lakisa.co.ke].

This policy explains what personal data we collect, why, how we use and share it, how long we keep it, and the rights you have.

When you apply for a loan

• your full name, National ID or passport number, phone number, email address and physical location or area;
• the type of collateral and details of the item or vehicle — make, model, year, registration number, condition and logbook status;
• one to three photographs of the item, or of the logbook and vehicle.

When you buy from our shop

• your name, delivery address, phone number, email address, and order and payment details (card and mobile-money payments are handled by our payment provider — see “When we share your data”).

When you sell an item to us

• your name and contact details, a description and photos of the item, and the details we need to pay you.

When you contact us

• the message you send and your contact details, whether through the website form, WhatsApp, email or phone.

Automatically, as you use the site

• limited technical information such as device and browser type and the pages you view, and information stored in your browser (see “Cookies and local storage”). We do not currently use third-party analytics or advertising trackers.

We do not knowingly collect personal data from anyone under 18 years of age.

We use your personal data for the purposes below. Next to each is our lawful basis under section 30 of the DPA.

• Assess and process your loan application, evaluate the collateral, and administer any loan — taking steps prior to a contract and performing that contract, and our legitimate interest in assessing credit risk.
• Verify your identity and prevent fraud and money laundering — compliance with a legal obligation, and our legitimate interests.
• Process and deliver shop orders and handle sell-your-item transactions — performance of a contract with you.
• Respond to your enquiries and provide customer support — our legitimate interests, and your consent where you started the contact.
• Meet our regulatory obligations as a licensed Digital Credit Provider, including reporting to Credit Reference Bureaus where the law permits — compliance with a legal obligation.
• Keep records, manage disputes and improve our services — our legitimate interests.
• Send you service messages about a transaction or application — performance of a contract and our legitimate interests. We only send marketing messages if you have opted in, and you can opt out at any time.

Our loan decisions are not made solely by automated means — a member of our team reviews every application.

We share personal data only as described here:

• Service providers acting on our instructions — hosting and IT, payment processing, delivery and logistics, secure storage of collateral, and communications. They may use the data only to provide their service to us.
• Credit Reference Bureaus licensed in Kenya, and other lenders, where the law permits in connection with a loan. Before we submit any adverse (negative) information about you to a Bureau, we will give you prior notice as required by the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022.
• Regulators, courts and law enforcement — including the Central Bank of Kenya and the ODPC — where we are required or permitted to disclose.
• Professional advisers such as lawyers, auditors and insurers, under duties of confidentiality.
• A buyer or successor if we sell or reorganise our business, subject to this policy.

We do not sell your personal data, and we do not share it for third-party marketing.

Some of our service providers may process data outside Kenya. Where that happens we take the steps the DPA requires — for example confirming the destination offers adequate protection, putting appropriate contractual safeguards in place, or relying on your consent — so your data stays protected. Confirm which providers process data outside Kenya and the safeguards used.

We keep personal data only for as long as we need it for the purpose we collected it, then delete or anonymise it.

• Loan applications and loan records: for the life of the loan and for [retention period — e.g. 7 years] afterwards, to meet legal, regulatory and audit requirements.
• Shop orders and sell-your-item records: [retention period].
• Contact-form messages and enquiries: [retention period].
• Photographs submitted with an application: held only for as long as needed to evaluate and administer that application, then deleted — unless we must keep them as part of a loan or dispute record.

We use technical and organisational measures appropriate to the risk: access limited to staff who need it, secure premises for stored collateral, encryption of data in transit, and confidentiality obligations on our team and service providers.

No system is completely secure. If a breach affects your rights and freedoms, we will notify you and the ODPC as the DPA requires.

You have the right to:

• be informed of how your data is used (this policy);
• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, where the law allows;
• object to, or ask us to restrict, certain processing;
• request a copy of certain data in a portable, machine-readable format;
• withdraw any consent you have given, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing that significantly affects you;
• lodge a complaint with the ODPC (www.odpc.go.ke) if you believe we have mishandled your data.

To exercise any of these rights, contact us using the details in “How to contact us” below. We will respond within the time the DPA allows and may need to verify your identity first. Some rights have limits — for example, we may keep data we are legally required to retain.

Our website stores a small amount of information in your browser using cookies and local storage. Today this is limited to:

• keeping your shopping cart and recently-viewed items;
• remembering interface preferences, such as a tab or filter you last chose.

This information stays in your browser, is not shared with third parties, and is not used for advertising or cross-site tracking. We do not currently run third-party analytics. If analytics or marketing tools are added later, update this section and add a cookie-consent banner.

You can clear or block cookies and local storage in your browser settings. Some features, such as the cart, may not work if you do.

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed, and we will highlight significant changes on this page. Please check back periodically.

• Data Protection Officer: [Data Protection Officer — name & email, e.g. dpo@lakisa.co.ke]
• Email: info@lakisa.co.ke
• Phone: +254 140 005790
• Post: Lakisa Assetlink Finance, Fedha Estate, Embakasi, Nairobi, Kenya
• Regulator: Office of the Data Protection Commissioner