Privacy Policy

1. Introduction.
Chaalant Limited is an online platform committed to protecting your privacy and
personal data. We respect your privacy and are committed to protecting your
personal data as guaranteed by the Kenyan Data Protection Act (No. 24 of 2019).
2. Regulation of data privacy and protection
As our client, your primary data controller will be Verychalaant Limited. We comply
with the applicable data protection and privacy laws of the Republic of Kenya and
international best practices where applicable.

3. Purpose and scope of this statement
The purpose of this statement is to inform you about how we collect, use, store,
make available, disclose, update, safeguard, destroy or otherwise deal with
(process) your personal information and to explain your rights relating to the privacy
of your personal information and how the law protects you.
Protecting the privacy, confidentiality and security of your personal information is
very important to us as it is critical for us to maintain your trust and act in the right
way to meet your needs. We have therefore implemented policies and procedures to
ensure that your personal information is protected and shall ensure we have a
contract in place with any third parties involved in processing your data outside
Kenya.

4. Personal information and types of personal information we collect
Personal information is any information from which you can be identified. The
personal information we may collect about you includes:

4.1 Name, age, gender, sex and identifying numbers;
4.2 Physical and email addresses and contact numbers;
4.3 Online identifiers and your online behaviour such as cookies and IP
addresses;
4.4 Engagements with us including use of products or services, transactions,
requests, queries, applications and complaints;

4.5 Marketing Data that is your preferences in receiving marketing
communications from us.
4.6 Payment Data that is, billing address and limited payment card details
(handled securely via third-party payment providers).

5. Collection of your personal data
5.1 We will collect personal information directly from you or by telephone or
through online channels such as our website, mobile applications, internet
banking or electronic messaging platforms.
5.2 We also collect personal information about you from other sources where
lawful and reasonable, such as reputable third parties (where you have
consented for your personal information to be shared for either the express
purpose or for any further processing) that you deal with or that company
interacts with for the purposes of conducting its business. These third parties
include:

5.2.1 Business partners (including partners and participating partners involved in
reward programmes, campaigns or other business activity, joint-venture
partners, social media platform partners) or companies that we may
acquire or that merge with us.
5.2.2 Service providers (including payment processors, card network providers,
debt collection and tracing agencies, credit agencies and bureaux,
electronic communication service providers, public and private data and
data verification providers including data registries, aggregators, search
engines, social media, and marketing list providers).
5.2.3 Government departments, regulatory authorities, courts of law and law
enforcement agencies and tax authorities.

5.3 If you are a third-party service provider, we may collect personal information
about you as a data subject to ensure that the business relationship and
matters relating to the agreement between you and us can be fulfilled. You
warrant that, if you provide us with any personal information about other
persons, such as employees, shareholders, or your directors, you are

authorised to share their personal information with us for purposes set out in
this statement.
5.4 Providing your personal information to us is voluntary. However, it is
mandatory under certain circumstances in which, if you fail to provide us with
your personal information when requested, we may not be able to provide the
products or services to you or comply with our legal obligations.
6. Processing your personal information
Our responsibilities to you are very important to us and we aim to provide you with
personalised services to meet your needs. We may process your personal
information for any of the reasons outlined in this section:

5.1 Contract requirements

We may need to process your personal information if we require it to conclude or
perform under a contract or agreement with you for a product or service that you
have applied for either with us or through our business partners with whom we have
entered a partnership, collaboration, or alliance arrangement or for purposes of:

6.1.1 Providing products and services to you, executing transactions, collecting
payments due to us by you, managing our risks and maintaining our
overall relationship with you;
6.1.2 Communicating with you regarding the products or services you have with
us; or
6.1.3 Providing you with further information that you request from us regarding
the products or services you have with us.

6.2 Lawful obligations
6.2.1 To complete integrity and business conduct checks required for
compliance purposes including due diligence and onboarding processes,
monitoring and assurance reviews and conduct sanctions screening
against any sanction's lists.
6.2.2 To comply with other risk management, regulatory and legislative
requirements.
6.2.3 To comply with voluntary and mandatory codes of conduct.

6.2.4 To detect, prevent and report theft, money laundering, terrorist financing,
corruption or other potentially illegal activity, or activity that could lead to
loss.
6.2.5 To process and settle transactions and payments.
6.2.6 To conduct research and analysis (which may include assessing product
suitability, credit quality, insurance risks, market risks and affordability,
developing credit models and tools and obtaining related information).

6.3 Legitimate Interest
We may process your personal information in the regular management of its
business and to protect the interests of Kenya and its clients, depositors,
shareholders, employees and other third parties, including our business
partners and members of the public.
This may be done to:
6.3.1 Maintain, monitor, improve and develop our business policies, systems
and controls;
6.3.2 Maintain and improve data quality;
6.3.3 Design, develop and test products, services and solutions for clients,
which may include combining sources and types of your personal
information across multiple legal entities and countries, subject to
compliance with applicable laws;
6.3.4 Personalise and customise products, services and solutions, messaging
and advertising;
6.3.5 Respond to client enquiries and communications and to record these
interactions for the purpose of analysis and improvement;
6.3.6 Manage business emergencies and stress events;
6.3.7 Process and settle transactions and payments;
6.3.8 Meet record-keeping obligations;
6.3.9 Conduct research and analysis (among other things, to assess product
suitability, credit quality, insurance risks, market risks and affordability, to
conduct behavioural profiling, to develop credit models and tools and to
obtain related information);
6.3.10 Enable clients to use value-added solutions and participate in reward
programmes;

6.3.11 Achieve other related purposes.

7. Consent
In addition to the reasons given above, we may process your personal
information where we have your specific consent for a defined purpose. We
will also seek your consent where applicable laws require it. We will store your
personal information according to our defined retention schedules as provided
by the law and thereafter delete it.

8. Length of retention of your personal information
We retain your personal information in line with our legal and regulatory obligations
and for our business and operational purposes as highlighted above. This will
generally be for at least five (5) years from your last transaction with us.

9. Communication with you
Besides in-person communication, we use a wide array of channels to engage with
you regarding our products and services and to keep you updated. These include
SMSs, email, phone calls, notifications sent to your mobile device and in-app
notifications. We need to keep you up to date on an ongoing operational basis .We
may contact you through these means for research purposes or to communicate with
you for marketing of new products or services as explained in greater detail below.

10. Using your personal information for marketing
10.1 If you are an existing client with whom we have had previous
interactions in respect of your financial well-being or needs, you are important
to us and therefore we would like to share information about our products,
services, and special offers with you (subject to applicable local laws).
10.2 If you are a prospective client, and we have had no previous interaction
or have no relationship with you, we will seek your express consent in
compliance with local laws to market to you electronically.
10.3 If you no longer wish to be contacted for marketing purposes, you may
opt out at any time as per the instructions contained in any marketing

communication you receive. You can also opt out by contacting us through
any of the following:
10.3.1 Phone calls
10.3.2 Emails
10.3.3 Phone messaging

11. Protection of your personal information
The security of your personal information is important to us, and we take reasonable
steps to keep your personal information safe and to prevent loss, destruction of and
damage or unlawful access to your personal information by unauthorised parties. We
require the same level of security to be implemented by our service providers and
other third parties. However, you must not share or send us any personal information
through unauthorised channels, as these are not a secure way of communication
and carry a risk of interception and unauthorised access. You should only share
personal information through our authorised channels.
12. Your rights
We value your trust and want you to be familiar with your rights under the legislation
and to know how you can exercise them in your interactions with us.You have the
right to:

12.1 Access the personal information we hold about you and to correct and
update your information;
12.2 Object to our processing your personal information, where applicable;
request that we delete your personal information where appropriate;
12.3 Be notified that your personal information is being collected by us or
has been accessed or acquired by an unauthorised person;
12.4 Object to the processing of personal information for the purposes of
direct marketing; not be subject to automated decision-making processes in
respect of an application for products and/or services, except under certain
circumstances; and
12.5 To request reasons or make a representation to us if your application
for products and/or services is refused.

You may exercise your rights by making requests to us and we shall respond within
the following timelines;

Restriction request – within fourteen (14) days
Objection request – within fourteen (14) days
Data Access request – within seven (7) days
Rectification request – within seven (7) days
Data Portability request – within seven (7) days
Erasure request – within seven (7) days
13. General
We may change this statement from time to time in accordance with changes in our
products or services or regulatory requirements. We will make reasonable efforts to
notify you through suitable communication channels.