BiiTrust/Legal
BIITRUST / LEGAL

Privacy Policy

How personal information is collected, used, stored, and protected.

Last Updated: .............. Effective Date: ..............

1. INTRODUCTION

This Privacy Policy explains how .............. ("Company", "BiiTrust", "we", "our", or "us") collects, uses, stores, discloses, transfers, processes, and protects personal information through the BiiTrust platform, including all web applications, Android applications, iOS applications, APIs, websites, integrations, customer portals, reporting systems, and related services (collectively, the "Services").

We are committed to protecting privacy, maintaining data security, and complying with applicable data protection laws and regulations.

This Privacy Policy applies to:

  • Customers
  • Borrowers
  • Members
  • Website visitors
  • Mobile app users
  • Employees of client organisations
  • Institution administrators
  • API users
  • Service providers
  • Business partners

By using the Services, you acknowledge that your information may be processed as described in this Policy.

2. SCOPE OF THIS POLICY

This Policy applies to:

  • BiiTrust Web Application
  • BiiTrust Android Application
  • BiiTrust iOS Application
  • APIs and integrations
  • Customer engagement portals
  • Collections modules
  • Loan management modules
  • Financial reporting environments
  • KYC onboarding environments
  • Branch management systems
  • Mobile money integrations
  • Customer support systems

This Policy does not apply to third-party platforms operated independently from BiiTrust.

3. DATA CONTROLLER AND DATA PROCESSOR ROLES

Depending on the circumstances, BiiTrust may act as:

Data Processor

When we process information on behalf of a financial institution.

Examples:

  • Customer onboarding
  • Loan records
  • Transaction records
  • Branch operations
  • Collection activities

In these situations, the institution remains the primary Data Controller.

Data Controller

When we process information relating to:

  • Website visitors
  • Marketing communications
  • Support requests
  • Product usage analytics
  • Security monitoring

we act as the Data Controller responsible for determining processing purposes.

4. INFORMATION WE COLLECT

We collect information directly from users, institutions, integrated services, and automated technologies.

5. INFORMATION PROVIDED BY YOU

We may collect:

Identity Information

  • Full name
  • National ID number
  • Passport number
  • Driver's licence number
  • Tax identification number
  • Date of birth
  • Gender
  • Citizenship
  • Signature

Contact Information

  • Telephone number
  • Mobile number
  • Email address
  • Physical address
  • Postal address
  • GPS coordinates
  • Place of residence

Employment Information

  • Employer name
  • Position
  • Salary information
  • Employment status
  • Employer contact information

Business Information

  • Company name
  • Registration details
  • Business ownership information
  • Trading records
  • Beneficial ownership information

6. KYC INFORMATION

Where institutions use KYC functionality, we may process:

  • National ID copies
  • Passport copies
  • Selfies and photographs
  • Tax certificates
  • Utility bills
  • Proof of residence
  • Business licences
  • Registration certificates
  • Director information
  • Beneficial owner information
  • Verification documents
  • Customer risk assessments

Financial institutions remain responsible for ensuring legal grounds for collection.

7. FINANCIAL INFORMATION

Depending on service usage, we may process:

  • Loan applications
  • Loan balances
  • Payment history
  • Repayment schedules
  • Arrears information
  • Credit assessments
  • Collection records
  • Collateral information
  • Financial statements
  • Income information
  • Expense information
  • Guarantor records
  • Transaction histories

8. COLLATERAL INFORMATION

Where collateral management is enabled:

We may process:

  • Asset descriptions
  • Motor vehicle information
  • Land information
  • Asset ownership records
  • Valuation reports
  • Pledge information
  • Security documentation
  • Release records

9. DEVICE INFORMATION

We automatically collect certain technical information including:

  • Device model
  • Device type
  • Operating system
  • Browser version
  • App version
  • Screen resolution
  • Internet service provider
  • Time zone settings
  • Language settings

10. NETWORK INFORMATION

We may collect:

  • IP addresses
  • Login timestamps
  • Session identifiers
  • Device fingerprints
  • Geographic approximations
  • Access routes

for security and operational purposes.

11. APPLICATION USAGE DATA

We may collect information relating to:

  • Pages visited
  • Features used
  • Reports generated
  • Transactions processed
  • Login frequency
  • Error messages
  • Performance metrics
  • User interactions

12. LOCATION DATA

Subject to device settings and applicable law, we may collect:

  • GPS coordinates
  • Mobile network location
  • Device location signals
  • Branch activity location
  • Collection officer location

Location information helps facilitate:

  • Field collections
  • Customer visits
  • Branch operations
  • Fraud prevention
  • Security investigations

13. BIOMETRIC INFORMATION

Certain optional features may process:

  • Facial images
  • Facial verification data
  • Signature images

Biometric information will only be processed where permitted by applicable law and necessary consent has been obtained.

14. INFORMATION FROM THIRD PARTIES

We may receive information from:

  • Credit reference bureaus
  • Identity verification providers
  • Government registries
  • Mobile network operators
  • Payment providers
  • Mobile money providers
  • Fraud prevention vendors
  • Analytics providers
  • Security monitoring services

15. COOKIES AND SIMILAR TECHNOLOGIES

We use:

  • Cookies
  • Local storage
  • Session identifiers
  • Device identifiers
  • Analytics tags
  • Similar technologies

to improve functionality, performance, and security.

Additional information is provided in our Cookie Policy.

16. PURPOSES OF PROCESSING

We process information for purposes including:

Service Delivery

  • Account creation
  • Authentication
  • User management
  • Branch administration
  • Product configuration

Lending Operations

  • Loan processing
  • Repayment tracking
  • Collections management
  • Portfolio monitoring

Customer Support

  • Issue resolution
  • User assistance
  • Technical support

Security

  • Threat detection
  • Fraud prevention
  • Identity verification
  • Incident response

Analytics

  • Product improvement
  • Service optimisation
  • Usage analysis
  • Regulatory obligations
  • Audit requirements
  • Record management
  • Investigations

Where required by applicable law, processing is based upon:

Where consent has been obtained.

Examples:

  • Marketing communications
  • Optional analytics
  • Optional location services

Contractual Necessity

Where processing is necessary to provide Services.

Examples:

  • User authentication
  • Account management
  • Loan servicing

Where processing is required by law.

Examples:

  • AML requirements
  • Regulatory reporting
  • Tax obligations

Legitimate Interests

Where we have legitimate business interests.

Examples:

  • Security monitoring
  • Fraud prevention
  • Platform improvement
  • Service reliability

18. SHARING OF INFORMATION

We may share information with:

Service Providers

Including:

  • Cloud hosting providers
  • Infrastructure providers
  • Security providers
  • Monitoring providers
  • Support vendors

Financial Institutions

Where operating under institutional accounts.

Payment Partners

Including:

  • Banks
  • Payment gateways
  • Mobile money operators

Identity Verification Providers

For customer verification processes.

Credit Reference Agencies

Where permitted by law.

Regulators

Where disclosure is legally required.

Law Enforcement

Where required by law, court order, subpoena, warrant, regulatory request, or lawful government demand.

19. INTERNATIONAL DATA TRANSFERS

Your information may be processed or stored in countries different from your own jurisdiction.

Where cross-border transfers occur, we implement appropriate safeguards including:

  • Contractual protections
  • Technical controls
  • Organisational safeguards
  • Regulatory transfer mechanisms

The transfer locations include:

..............

20. DATA RETENTION

We retain information only for as long as necessary to:

  • Provide Services
  • Meet legal obligations
  • Resolve disputes
  • Conduct audits
  • Enforce agreements

Examples:

| Data Type | Retention Period | |------------|------------------| | Account Data | .............. | | Loan Records | .............. | | Financial Records | .............. | | Audit Logs | .............. | | Support Records | .............. | | KYC Records | .............. |

Retention periods may be extended where required by law.

21. AUTOMATED DECISION MAKING

Certain features may use automated processing including:

  • Credit scoring
  • Fraud detection
  • Risk assessment
  • Portfolio analysis

Automated outputs should not be treated as the sole basis for significant decisions without appropriate human review.

Institutions remain responsible for lending decisions.

22. SECURITY OF INFORMATION

We implement reasonable technical and organisational safeguards designed to protect information against:

  • Unauthorised access
  • Disclosure
  • Alteration
  • Loss
  • Destruction

Security measures may include:

  • Role-based access controls
  • Encryption
  • Monitoring systems
  • Access logging
  • Multi-factor authentication
  • Security reviews
  • Vulnerability assessments

No security system can guarantee absolute protection.

23. DATA BREACH RESPONSE

In the event of a security incident, we may:

  • Investigate activity
  • Contain incidents
  • Restore systems
  • Preserve evidence
  • Notify affected parties
  • Notify regulators

where required by applicable law.

24. YOUR RIGHTS

Subject to applicable law, you may have rights including:

Right of Access

To request copies of information.

Right to Correction

To correct inaccurate information.

Right to Deletion

To request deletion of information.

Right to Restriction

To restrict processing.

Right to Object

To object to certain processing activities.

Right to Data Portability

To receive information in a portable format.

Where processing relies on consent.

25. GDPR RIGHTS

Where the General Data Protection Regulation applies, individuals may exercise rights including:

  • Access
  • Rectification
  • Erasure
  • Restriction
  • Portability
  • Objection
  • Complaint to Supervisory Authority

26. CCPA AND U.S. PRIVACY RIGHTS

Where applicable U.S. privacy laws apply, California residents may have rights to:

  • Know collected information
  • Access information
  • Delete information
  • Correct information
  • Limit certain disclosures

We do not sell personal information unless explicitly stated and legally authorised.

27. CHILDREN'S PRIVACY

The Services are not intended for children.

We do not knowingly collect personal information from individuals below the minimum age permitted by law.

If such information is identified, it will be removed where legally required.

28. MARKETING COMMUNICATIONS

We may send:

  • Product updates
  • Security notices
  • Operational notices
  • Marketing communications

Where required by law, marketing communications shall be sent only with appropriate consent.

Users may unsubscribe at any time.

29. THIRD-PARTY WEBSITES

The Services may contain links to third-party websites.

We are not responsible for the privacy practices, security measures, or content of third-party services.

Users should review third-party privacy policies independently.

30. CHANGES TO THIS PRIVACY POLICY

We may update this Policy periodically.

Updates become effective upon publication unless otherwise required by law.

Continued use of the Services following publication constitutes acknowledgment of the revised Policy.

31. CONTACT INFORMATION

Data Protection Officer

Name: ..............

Email: ..............

Telephone: ..............

Address: ..............

Privacy Requests

Email: ..............

Support Portal: ..............

Postal Address: ..............

Regulatory Enquiries

Email: ..............

Address: ..............

32. FINANCIAL SERVICES AND CUSTOMER DATA PROCESSING

Because BiiTrust is designed for financial institutions, microfinance institutions, SACCOs, lenders, cooperatives, NGOs, and similar organisations, certain categories of information processed through the Services may be considered sensitive or regulated data under applicable law.

Such information may include:

  • Customer identification records;
  • KYC documentation;
  • Credit history;
  • Loan applications;
  • Account information;
  • Collection records;
  • Repayment histories;
  • Asset and collateral records;
  • Guarantor information;
  • Employer information;
  • Income verification records;
  • Risk classification information;
  • Fraud monitoring records.

The primary responsibility for determining the lawful basis of processing such information remains with the financial institution using the Services.

33. ANTI-MONEY LAUNDERING AND FRAUD MONITORING

To protect users, institutions, and the integrity of the financial system, information may be processed for purposes including:

  • Anti-Money Laundering controls;
  • Counter Terrorism Financing controls;
  • Fraud prevention;
  • Sanctions screening;
  • Regulatory investigations;
  • Identity verification;
  • Transaction monitoring;
  • Risk detection.

Information may be reviewed using automated and manual methods.

Where required by law, information may be disclosed to:

  • Financial intelligence units;
  • Regulators;
  • Law enforcement agencies;
  • Courts;
  • Government authorities.

Nothing in this Policy prevents disclosures required by law.

34. AUDIT TRAILS AND SYSTEM LOGGING

To maintain integrity, accountability, and regulatory compliance, BiiTrust maintains detailed audit records relating to system activity.

Audit records may include:

  • Login attempts;
  • Session activity;
  • Device information;
  • User actions;
  • Record modifications;
  • Approval actions;
  • Workflow activity;
  • Administrative changes;
  • Security events.

Audit records exist to:

  • Investigate incidents;
  • Resolve disputes;
  • Meet regulatory requirements;
  • Support compliance reviews;
  • Detect fraud;
  • Protect customer information.

Users should not expect platform transactions to occur without corresponding audit records.

35. DATA MINIMISATION PRINCIPLE

We seek to collect only information that is reasonably necessary for:

  • Service delivery;
  • Compliance obligations;
  • Security purposes;
  • Customer support;
  • Product improvement.

Information not required for legitimate business purposes should not be uploaded into the Platform.

Institutions remain responsible for ensuring data submitted to the Platform complies with applicable legal requirements.

36. DATA ACCURACY

We encourage institutions and users to maintain accurate information.

Users should promptly update:

  • Personal information;
  • Contact information;
  • Identification documents;
  • Employment records;
  • Business records;
  • Customer records.

The quality of system outputs often depends on the quality of information entered into the Platform.

BiiTrust cannot guarantee the accuracy of information submitted by users or institutions.

37. INFORMATION SECURITY GOVERNANCE

BiiTrust maintains security controls designed to:

  • Protect confidentiality;
  • Preserve integrity;
  • Ensure availability;
  • Detect security incidents;
  • Reduce operational risk.

Security activities may include:

  • Access management;
  • Vulnerability management;
  • Security monitoring;
  • Infrastructure hardening;
  • Security assessments;
  • Log reviews;
  • Backup management;
  • Recovery testing.

Security controls are periodically reviewed to address evolving threats and business requirements.

38. DATA STORAGE LOCATIONS

Information may be stored:

  • In cloud infrastructure;
  • In managed hosting environments;
  • In backup systems;
  • In disaster recovery systems;
  • In security archival systems.

Storage locations may change over time based on:

  • Operational requirements;
  • Regulatory obligations;
  • Infrastructure upgrades;
  • Disaster recovery planning.

The Company reserves the right to migrate infrastructure where necessary to improve resiliency, performance, security, or compliance.

39. DATA DELETION REQUESTS

Where permitted by applicable law, individuals may request deletion of personal information.

Deletion requests may be declined where retention remains necessary to:

  • Meet legal obligations;
  • Resolve disputes;
  • Defend legal claims;
  • Conduct audits;
  • Prevent fraud;
  • Satisfy regulatory requirements;
  • Enforce agreements.

Records retained following deletion requests will only be maintained to the extent required by law or legitimate business necessity.

40. BUSINESS TRANSFERS

In the event of:

  • Merger;
  • Acquisition;
  • Consolidation;
  • Reorganisation;
  • Asset sale;
  • Business transfer;

information may be transferred as part of the transaction.

Where legally required, affected individuals will be notified through appropriate channels.

Any acquiring entity must continue handling information in accordance with applicable privacy obligations.

41. ARTIFICIAL INTELLIGENCE AND AUTOMATED TOOLS

Certain Service components may use:

  • Predictive models;
  • Pattern recognition systems;
  • Automated risk scoring;
  • Fraud detection tools;
  • Recommendation systems;
  • Analytics engines.

These technologies may assist institutions in decision-making.

However:

  • They do not replace professional judgment;
  • They do not guarantee outcomes;
  • They do not constitute legal advice;
  • They do not constitute financial advice.

Institutions remain responsible for final decisions affecting customers.

42. INCIDENT RESPONSE

Where a security incident affecting personal information is identified, BiiTrust may:

  • Investigate the incident;
  • Isolate affected systems;
  • Preserve evidence;
  • Engage security specialists;
  • Notify affected parties;
  • Notify regulators;
  • Implement corrective actions.

Notifications will be provided where required by applicable law.

Response activities are performed in accordance with operational and legal requirements.

43. REGULATORY COMPLIANCE COMMITMENT

BiiTrust is committed to supporting compliance with applicable privacy and security laws, including where relevant:

  • GDPR;
  • UK GDPR;
  • CCPA/CPRA;
  • African regional privacy regulations;
  • Financial-sector regulations;
  • AML rules;
  • Data protection statutes.

Nothing in this Policy should be interpreted as a guarantee of regulatory compliance by institutions using the Platform.

Each institution remains responsible for its own regulatory obligations.

44. POLICY LANGUAGE

This Privacy Policy may be translated into multiple languages.

Where inconsistencies arise between translations, the English version shall prevail unless otherwise required by law.

45. CONTACT INFORMATION

For any privacy-related enquiry, request, complaint, data subject request, regulatory enquiry, or security concern, please contact:

Data Protection Officer

Name: ..............

Email: privacy@..............

Telephone: ..............

Privacy Department

Email: privacy@..............

Security Team

Email: security@..............

Email: legal@..............

Registered Address

..............

Website

https://..............