Privacy Policy

LUMBIKA Microfinance Limited is the data controller for personal data processed in connection with its lending, asset-financing, customer-support and related operations, subject to applicable law.

• Identity and KYC information, including NIDA-related verification information where applicable.
• Contact information, mobile number, address and relevant demographic information.
• Loan/application, repayment, account and transaction information.
• Credit-reference and affordability information obtained for lawful lending purposes.
• Asset identifiers such as serial number, IMEI or vehicle identifiers where applicable.
• Customer communications, complaints and support records.
• Location/asset-monitoring information where lawfully enabled, disclosed and authorised.
• Technical and audit information generated by authorised LUMBIKA systems.

• Customer identification and verification.
• Credit assessment and responsible lending.
• Account administration, payment allocation and reconciliation.
• Asset allocation, security and authorised portfolio monitoring.
• Customer support, complaints handling and communications.
• Fraud prevention, risk management, audit, compliance and regulatory reporting.
• Establishment, exercise or defence of lawful contractual or legal rights.

Personal data may be shared only where necessary and lawful with authorised service providers, payment processors, credit-reference providers, regulators, professional advisers, courts or other persons where disclosure is legally required or permitted. LUMBIKA does not authorise service providers to use customer information for unrelated purposes.

LUMBIKA's platform is not designed to access customer contact lists, call logs, messages, photographs, social-media accounts, email accounts or installed applications as a delinquency-management technique. Any device permission requested must be limited to a specific legitimate purpose.

Where L-GAR or related functionality is used, location information is treated as personal data. Access is restricted to authorised personnel and must not be used to harass, shame or publicly expose a customer.

LUMBIKA applies role-based access, authentication, audit logging, controlled administrative privileges and encrypted communications where supported. Personal data will be retained only for periods justified by operational, contractual, legal, regulatory, audit or dispute-resolution requirements.

Customers may use LUMBIKA's designated support and complaints channels to raise privacy questions, request correction of inaccurate information, or exercise other rights available under applicable personal-data protection requirements.