Crest Loan Customer Privacy Policy

1.1 Data Controller: Swiftcrest Capital Limited, a private limited company incorporated in Kenya (Registration No. PVT-7LU572M2), trading under the business name "Crest Loan", is the data controller responsible for your personal data.

1.2 Scope: This Privacy Policy applies to all prospective and existing customers who interact with Crest Loan through our website (crestloan.co.ke), physical field onboarding visits, our mobile application (Crest Loan APK), and customer support channels.

1.3 Legal Framework: We process personal data in strict compliance with the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, and Section 13 (Confidentiality) of the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022.

To evaluate credit applications and manage facilities under our hybrid physical-and-digital onboarding framework, we collect:

• Identity & KYC Data: Full legal name, National Identification Number (ID), date of birth, and photographic copy of your national identity card;
• Business Verification Data: Physical address/location of your business premises, business operating history, nature of commercial enterprise, and copy of your single business permit or county trading licence;
• Nominated References: Names and mobile contact numbers of two (2) nominated reference persons. Note: Nominated contact persons are references used solely for onboarding confirmation and do not carry guarantor obligations unless a separate legal guarantee has been consented to in writing;
• Financial & Transaction Data: Registered Safaricom M-Pesa mobile number, loan disbursement records, repayment history, and applicable fee records;
• Credit Bureau Data: Lawfully obtained credit information from licensed Credit Reference Bureaus (CRBs) in Kenya;
• Technical & App Data: Device model, operating system version, and IP address collected strictly for session security and anti-fraud authentication.

Crest Loan is dedicated to dignified, ethical financial services. In compliance with the Kenya Data Protection Act and Section N of our Credit Policy, we enforce the following non-negotiable guarantees:

• Zero Public Shaming: We strictly prohibit posting, sharing, or threatening to share a borrower's debt status on social media platforms, WhatsApp groups, or public noticeboards;
• No Harassment: We never contact unauthorized third parties, employers, or family members unconnected with the loan;
• No Commercial Sale of Data: We will never sell, rent, or trade your personal or business data to marketing brokers or commercial third parties.

We process your personal information under the following lawful bases recognised under Section 30 of the Data Protection Act, 2019:

• Performance of a Contract: To verify your eligibility, process your loan application, disburse funds via M-Pesa, and manage loan repayments;
• Legal & Regulatory Obligations: To comply with Central Bank of Kenya prudential reporting, Anti-Money Laundering/Counter Financing of Terrorism (AML/CFT) screening, and statutory audits;
• Legitimate Interests: To detect, prevent, and investigate identity theft, multiple fraudulent applications, or loan defaults;
• Explicit Consent: Where you expressly authorize credit bureau checks or specific communications through the Crest Loan APK.

We only share customer data with authorized third parties where strictly lawful and necessary:

• Mobile Money Service Providers (Safaricom M-Pesa): For electronic disbursement of loan proceeds and processing repayments;
• Licensed Credit Reference Bureaus (CRBs): Reporting positive and adverse loan performance under Part IV of the DCP Regulations. Note: Adverse reporting requires mandatory 30 days prior notice, and no negative data is submitted for amounts of KSh 1,000 or below;
• Regulatory & Judicial Authorities: The Central Bank of Kenya, law enforcement agencies, or courts of competent jurisdiction where legally mandated;
• Auditors & Professional Legal Advisors: Subject to strict professional non-disclosure agreements.

6.1 Security Measures: We employ industry-standard administrative, physical, and technical safeguards. All data transmitted between the Crest Loan APK and our servers is encrypted using Secure Sockets Layer / Transport Layer Security (TLS/SSL).

6.2 Retention Period: Personal, KYC, and transaction records are retained for the duration of the customer relationship and for seven (7) years following loan closure in compliance with Kenyan financial recordkeeping statutes and Central Bank requirements.

Under the Data Protection Act, 2019, you have the right to:

• Right to be Informed: To know what personal data is collected and how it is processed;
• Right of Access: To request a copy of the personal data held about you;
• Right to Rectification: To request correction of false, inaccurate, or outdated data;
• Right to Erasure: To request deletion of data that is no longer required for statutory or contractual purposes;
• Right to Object: To object to processing of personal data on legitimate grounds;
• Right to Complain: To lodge a complaint regarding data mishandling with our Data Protection Officer or the Office of the Data Protection Commissioner (ODPC).

If you have questions, data access requests, or privacy complaints, please contact our Data Protection Desk:

• Email: support@crestloan.co.ke
• Telephone / WhatsApp: +254 797 849 393
• Data Protection Officer: Swiftcrest Capital Limited, Nairobi, Kenya

You also have the statutory right to file a complaint with the Office of the Data Protection Commissioner (ODPC), Republic of Kenya (www.odpc.go.ke).