Data Protection

This policy sets out how LUMBIKA Microfinance Limited manages and protects personal data processed in connection with its lending, asset-financing, customer-support, payment, risk-management, compliance and related operations. Personal data must be handled lawfully and for legitimate business, contractual, legal, regulatory and customer-service purposes. Access to personal information is restricted to authorised persons according to legitimate operational responsibilities. This policy should be read together with LUMBIKA's Privacy Notice, which explains to customers what personal data may be collected, why it is processed and how customer rights may be exercised.

LUMBIKA processes personal data in accordance with the following principles:

• Personal data is processed lawfully, fairly and for legitimate purposes.
• Data is collected only for specified, identified operational, contractual, legal, regulatory or customer-service purposes.
• Personal data processed is limited to what is necessary for its identified purpose.
• Reasonable steps are taken to maintain accurate and current information.
• Personal data is retained only for periods justified by legitimate requirements.
• Appropriate access controls and security measures are applied to protect personal information.

LUMBIKA may process the following categories of personal data in connection with its services:

• Identity and KYC information, including NIDA-related verification information where applicable.
• Contact information, mobile number, address and relevant demographic information.
• Loan, application, repayment, account and transaction information.
• Credit-reference and affordability information obtained for lawful lending purposes.
• Asset identifiers such as serial number, IMEI or vehicle identifiers where applicable.
• Customer communications, complaints and support records.
• Location and asset-monitoring information where lawfully enabled, disclosed and authorised.
• Technical and audit information generated by authorised LUMBIKA systems.

Personal data is collected through direct customer interactions, financing applications, digital platforms and authorised third-party sources where lawful. Personal data may be processed for:

• Customer identification and verification.
• Credit assessment and responsible lending.
• Account administration, payment allocation and reconciliation.
• Asset allocation, security and authorised portfolio monitoring.
• Customer support, complaints handling and communications.
• Fraud prevention, risk management, audit, compliance and regulatory reporting.
• Establishment, exercise or defence of lawful contractual or legal rights.

LUMBIKA's platform is not designed to access customer contact lists, call logs, messages, photographs, social-media accounts, email accounts or installed applications as a delinquency-management technique. Any device permission requested must be limited to a specific legitimate purpose.

Customers applying for LUMBIKA financing are required to provide accurate identity, contact, residential and business information as part of the customer identification and verification process. Lawful verification may include NIDA-related verification information and mobile-number information where applicable. Customer identification data is processed for legitimate KYC, credit-assessment and account-administration purposes.

Loan, application, repayment, account and transaction information is processed for credit assessment, account administration, payment allocation and reconciliation, and related financing-service purposes. Credit-reference and affordability information may be obtained from authorised credit-reference providers for lawful lending purposes. Asset identifiers such as serial number, IMEI or vehicle identifiers are processed where applicable to identify and manage financed assets. Where L-GAR or related functionality is used, location and asset-monitoring information is treated as personal data. Access is restricted to authorised personnel and must not be used to harass, shame or publicly expose a customer.

Personal data may be shared only where necessary and lawful with authorised service providers, payment processors, credit-reference providers, regulators, professional advisers, courts or other persons where disclosure is legally required or permitted. LUMBIKA does not authorise service providers to use customer information for unrelated purposes.

LUMBIKA applies appropriate access and administrative controls to protect customer information. Approved controls include, where applicable:

• Role-based access.
• Authentication.
• Audit logging.
• Controlled administrative privileges.
• Encrypted communications where supported.

Access to personal information is restricted to authorised persons according to their legitimate operational responsibilities.

Personal data will be retained only for periods justified by operational, contractual, legal, regulatory, audit or dispute-resolution requirements. LUMBIKA does not retain personal data beyond the period necessary to fulfil its identified purpose and applicable legal or regulatory obligations.

LUMBIKA takes reasonable steps to ensure that personal data is accurate, complete and up to date where necessary for its identified purpose. Customers may request correction of inaccurate personal information through LUMBIKA's designated support channels. Customers are also responsible for providing accurate information and keeping relevant contact and personal details reasonably current so that LUMBIKA can maintain reliable records and deliver effective communications.

Customers may use LUMBIKA's designated support and complaints channels to raise privacy questions, request correction of inaccurate information, or exercise other rights available under applicable personal-data protection requirements. Requests will be assessed and handled in accordance with applicable legal requirements and LUMBIKA's operational procedures. For details on how to raise a privacy concern or complaint, customers may also refer to LUMBIKA's Complaints Procedure.

LUMBIKA maintains appropriate arrangements for identifying, assessing and managing data-security incidents. Where a data-security incident is identified, it will be assessed to determine the nature and scope of the incident, the personal data affected and the appropriate response. Incident management is conducted in accordance with LUMBIKA's internal procedures and applicable legal and regulatory requirements.

All employees and authorised agents who handle personal information must do so only for legitimate operational purposes and within their authorised responsibilities. Employee and agent access to personal data is governed by role-based access controls, controlled privileges and confidentiality obligations. Location and asset-monitoring information is accessible only to authorised personnel for legitimate purposes. Customer information must not be used for threats, harassment, intimidation, public shaming or unlawful disclosure of personal information, whether in connection with delinquency management, complaint handling or any other purpose.

Partners, service providers and technology providers handling customer information in connection with LUMBIKA services must use it only for legitimate authorised purposes and in accordance with applicable data-protection requirements. LUMBIKA does not authorise service providers to use customer information for unrelated purposes.

This policy is reviewed periodically to support its continued relevance and effectiveness in protecting personal data. Where a material change to this policy affects customer rights or obligations, the change will be communicated to affected customers appropriately.

For data protection enquiries, please contact us: