Privacy Policy

01Who we are

Self Repay Credit (“SRC”, “we”, “us”) operates a membership-based commercial framework through partner businesses in Kenya, together with this website and the SRC mobile app. For the personal data described in this policy, SRC acts as a data controller. Where a partner business enrols you as a member, that business may also process your data for its own purposes and is responsible for doing so lawfully.

This policy is written with the Kenya Data Protection Act, 2019 and its regulations in mind.

02Information we collect

Depending on how you use SRC, we may collect the following:

• Identity and contact details: your name, phone number, email address and any identification details needed to verify your membership or your business.
• Membership and account details: the partner business you joined, your membership status, and your SRC savings and credit balances.
• Transaction information: purchases made with the enrolling business, redemptions of SRC balances, and related payment references, including mobile-money references where used.
• Business information (for businesses): trading name, registration and contact details, and aggregated issuance and trading activity needed for assessment and ongoing administration.
• Device and usage information: device type, operating system, app version, log data and general usage, collected to keep the website and app secure and working.
• Communications: messages, enquiries and complaints you send to us.

03How we use your information

• To create and administer your membership and show you accurate SRC savings and credit balances.
• To process transactions, apply SRC credit and savings, and maintain the repayment cycle.
• To assess, authorise and administer participating businesses and any related financing.
• To verify identities, prevent fraud and misuse, and keep the platform secure.
• To respond to your enquiries, complaints and requests, and to send service notices.
• To produce aggregated, de-identified insights that help partner businesses plan inventory and supply.
• To meet legal, regulatory and accounting obligations.

04Our lawful bases

We process personal data only where we have a lawful basis: to perform our agreement with you (your membership), where you have given consent, where we are required to by law, or where it is necessary for our legitimate interests in running a secure and sustainable service and those interests are not overridden by your rights. Where we rely on consent, you can withdraw it at any time.

05Who we share it with

We do not sell your personal data. We share it only where needed:

• With the partner business you joined, so it can serve you and apply your SRC balances.
• With service providers acting on our instructions, such as payment, hosting, communications and security providers.
• With regulators, courts, law enforcement or other authorities where the law requires or permits it.
• In connection with a business transfer, restructuring or similar transaction, subject to equivalent protections.

Partner businesses do not see more of your information than they need to serve you and administer SRC.

06International transfers

Some of our service providers may store or process data outside Kenya. Where this happens we take steps to ensure the transfer meets the requirements of Kenyan data protection law and that your data remains protected.

07How long we keep it

We keep personal data only for as long as it is needed for the purposes above, including to meet legal, tax and accounting requirements and to resolve disputes. When it is no longer needed, we delete it or de-identify it.

08How we protect it

We use technical and organisational measures appropriate to the risk, including access controls, encryption of data in transit and restricted internal access. No system is completely secure, so please protect your own device and sign-in details and tell us promptly if you suspect misuse of your account.

09Your rights

Under the Data Protection Act, 2019 you have the right to:

• Be informed about how your data is used.
• Access the personal data we hold about you.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete data we no longer have a lawful reason to keep.
• Object to, or ask us to restrict, certain processing, including direct marketing.
• Receive your data in a portable format where applicable.
• Withdraw consent at any time, without affecting processing that already took place.

To exercise any of these rights, write to selfrepaycredit@gmail.com. We may need to verify your identity first. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

10Website and mobile app

This website may use essential cookies and similar technologies that are needed for it to function and stay secure. The SRC Android app is distributed as an APK file directly from this website. We ask that you download it only from this site; copies obtained elsewhere may have been altered and are not covered by this policy.

The app may request permissions on your device, such as network access or notifications, to provide its features. You can review or revoke permissions in your device settings, though some features may then stop working.

11Children

SRC memberships and the SRC app are intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

12Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows when it last changed, and we will take reasonable steps to tell you about material changes.

13Contact us

For privacy questions or to exercise your rights, email selfrepaycredit@gmail.com.