App   LOAN PLUS DIGITAL CREDIT PROVIDER LIMITED

Privacy Policy

Version: 1.0 Effective Date: March 27, 2026

L Pesa(“we,” “us,” “our,” or the “Platform”) is a mobile application owned and operated by LOAN PLUS DIGITAL CREDIT PROVIDER LIMITED, a digital credit provider operating in Kenya in accordance with applicable laws and regulatory requirements.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, protect, share, and otherwise process your information when you access or use the L Pesa mobile application, website, customer support channels, and related services.

Please read this Privacy Policy carefully before using our services. By accessing or using L Pesa, you acknowledge that you have read and understood this Privacy Policy.

For important device permissions, we request your consent separately at the time the relevant function is used. You may withdraw permission at any time through your device settings. Refusing a non-essential permission may prevent certain features from working, but will not prevent you from using unrelated functions.

Scope of This Privacy Policy

This Privacy Policy applies to personal data collected through:

  • the L Pesa mobile application;
  • our official website at https://www.loanplus.co.ke/;
  • our customer support channels;
  • identity verification and loan application processes;
  • repayment, account management, and related services.

This Privacy Policy does not apply to third-party websites, payment channels, or services that have their own privacy policies, except to the extent we are legally responsible for the processing carried out by our service providers acting on our behalf.

This Privacy Policy applies specifically to L Pesa. If you have accounts with other lending applications operated by LOAN PLUS DIGITAL CREDIT PROVIDER LIMITED, please note that data sharing between these platforms requires separate consent and is governed by additional safeguards.

What Information We Collect

We collect personal data that is necessary to provide our services, comply with legal obligations, verify identity, assess credit risk, prevent fraud, and improve service security and performance.

2.1 Information You Provide Directly

When you register, apply for a loan, complete KYC, contact us, or use our services, we may collect:

Account and Registration Information

  • mobile phone number;
  • full name;
  • password or verification credentials;
  • email address, where provided.

Identity Verification and KYC Information

  • national identification information;
  • date of birth;
  • gender;
  • facial image or selfie used for liveness verification;
  • photographs or images of your identification document;
  • other information required to verify your identity under applicable law.

Loan Application Information

  • residential address;
  • marital status;
  • education level;
  • employment status;
  • occupation and employer details, where applicable;
  • income information;
  • loan purpose, where required;
  • bank account or mobile money wallet details for disbursement and repayment.

Emergency Contact Information

  • the names, telephone numbers, and relationship to you of the contact persons you choose to provide.

You are responsible for ensuring that any third party whose information you provide to us has been informed and, where required, has consented.

Customer Support and Complaint Information

  • records of calls, emails, chats, tickets, and dispute submissions;
  • information you provide when requesting support, filing a complaint, or requesting account closure or data deletion.

2.2 Information We Collect Automatically

When you use the App, we may automatically collect limited technical and usage information necessary for security, risk control, and service performance, including:

  • device model;
  • operating system version;
  • app version;
  • IP address;
  • device language and time zone;
  • device-generated identifiers such as vendor-based app/device identifiers where available;
  • login history;
  • app interaction logs;
  • crash logs, diagnostics, and performance data;
  • security and fraud-risk indicators, such as abnormal device or account behavior.

We do not collect or rely on device identifiers that are not appropriate for iOS or are not required for the services we provide.

2.3 Information Obtained from Third Parties

Where permitted by law and/or authorized by you, we may obtain information from third parties, including:

Credit Reference Bureau (CRB) Information We may request your credit information from licensed credit reference bureau partners in Kenya for purposes of credit assessment, responsible lending, fraud prevention, and account risk management.

Identity Verification and Anti-Fraud Information We may receive risk signals, verification results, or fraud-prevention information from identity verification providers, anti-fraud partners, payment partners, or other lawful service providers.

Repayment and Transaction Confirmation Information We may receive payment status updates and settlement confirmations from payment processors, banks, or mobile money partners in order to process disbursement, repayment, reconciliation, and dispute handling.

Device Permissions We Request

We request permissions only when needed for a specific feature and explain the purpose at the time of request.

3.1 Location Permission (Approximate Location)

Purpose of Use

  • to help verify service eligibility within Kenya;
  • to support fraud prevention and geographic risk assessment;
  • to protect against suspicious or unauthorized account activity.

Data Collected

  • approximate location information.

When Used

  • when you log in, register, or submit a loan application, if the feature requires it.

Important Note We seek to use approximate location only to the extent necessary for security and service eligibility purposes.

3.2 Camera Permission

Purpose of Use

  • to capture your ID document;
  • to complete selfie or liveness verification;
  • to support KYC and fraud prevention requirements.

Data Collected

  • images of your identification document;
  • selfie or facial images submitted during liveness or identity verification.

When Used

  • only when you actively choose to complete identity verification or upload required KYC materials.

3.3 Photo Library Permission

Purpose of Use

  • to allow you to select and upload images that you choose, such as ID images or supporting documents for customer support or dispute handling.

Data Collected

  • only the image or images you specifically select and confirm for upload.

We do not scan or upload your entire photo library.

3.4 Contacts Permission

Purpose of Use

  • Emergency contacts are used SOLELY for account security verification (e.g., suspected fraud) and identity consistency checks.
  • We strictly prohibit using emergency contacts for debt collection, recovery purposes, or marketing.
  • We will never disclose your loan details or debt status to these contacts.

Data Collected

  • only the specific contact entries you manually select, such as name, phone number, and relationship.

We do not collect, upload, or store your full address book.

How We Use Your Information

We use your information for the following purposes:

4.1 To Provide Loan and Account Services

  • create and manage your account;
  • process registration and authentication;
  • review your loan application;
  • disburse approved loans;
  • process repayments and update balances;
  • administer your account and loan history.

4.2 To Verify Identity and Meet KYC / Legal Requirements

  • verify your identity;
  • complete customer due diligence and KYC procedures;
  • comply with anti-fraud, anti-money laundering, consumer protection, and other legal or regulatory obligations.

4.3 To Assess Creditworthiness and Manage Risk

  • assess your eligibility for credit;
  • determine suitable loan amounts, pricing, or repayment terms;
  • detect fraud, impersonation, duplicate accounts, abuse, or suspicious conduct;
  • manage delinquency, recovery, and portfolio risk.

4.4 To Communicate with You

  • send verification codes;
  • notify you of loan status, repayment reminders, account changes, and important service notices;
  • respond to your questions, complaints, disputes, and support requests.

4.5 To Improve Security, Stability, and Service Quality

  • monitor app performance;
  • diagnose errors and crashes;
  • investigate security incidents;
  • improve functionality, reliability, and user experience.
  • investigate misuse of the service;
  • enforce our agreements;
  • establish, exercise, or defend legal claims.

4.7 CBK Digital Credit Compliance & Consumer Rights

As a licensed Digital Credit Provider regulated by the Central Bank of Kenya (CBK):

  • Cooling-off Period: You have the right to cancel the loan within 24 hours of disbursement without incurring any interest or fees (Cooling-off Right).
  • Total Cost of Credit (TCC): Before loan disbursement, we disclose the total amount you will repay, including principal, interest, and all applicable fees.
  • Annual Percentage Rate (APR): We display the APR clearly in the loan offer before you accept.
  • Responsible Lending: We conduct affordability assessments based on your declared income and credit bureau information to ensure you can repay without undue financial stress.
  • Prohibited Practices: We do not engage in harassment, threats, or intimidation in debt collection. We do not contact your emergency contacts for debt recovery purposes.
  • Complaint Escalation: If your complaint is not resolved within 30 days, you may escalate to CBK’s Consumer Protection Unit at complaints@centralbank.go.ke.

Automated Processing and Credit Decisions

We may use automated tools, models, scoring systems, or rules-based decision processes to support:

  • credit assessment;
  • fraud detection;
  • identity verification;
  • account risk management;
  • repayment risk analysis.

These processes help us make faster and more consistent lending and security decisions. Where required by applicable law, you may contact us to request review, clarification, correction of underlying data, or reconsideration of a decision based on appropriate manual review procedures.

Where required by applicable law, we process your personal data on one or more of the following grounds:

  • your consent;
  • necessity for entering into or performing a contract with you;
  • compliance with a legal or regulatory obligation;
  • protection of your vital interests or the interests of others;
  • our legitimate interests, including fraud prevention, service security, responsible lending, and service improvement, where such interests are not overridden by your rights.

How We Share and Disclose Your Information

We do not sell your personal data.

We may share your information only where necessary, lawful, and proportionate, including in the following circumstances:

7.1 Service Providers and Processors

We may share data with trusted vendors and service providers who process data on our behalf, such as:

  • cloud hosting and storage providers;
  • KYC and identity verification providers;
  • payment processors and settlement partners;
  • customer support service providers;
  • SMS or communication service providers;
  • analytics, security, and system monitoring providers;
  • anti-fraud and risk-control providers.

These parties are required by contract to protect your information and use it only for authorized purposes.

7.2 Credit Reference Bureau and Credit Reporting

Where permitted or required by law, and where applicable based on your application or account conduct, we may share information with licensed CRBs or other lawful credit reporting partners in Kenya, including information relating to:

  • your application history;
  • your repayment performance;
  • default or delinquency status, where legally reportable.

We share information with licensed Credit Reference Bureaus in Kenya, including TransUnion CRB, Creditinfo CRB, and/or Metropol CRB. This includes your application history, repayment performance, and default status where legally reportable. You have the right to request one free credit report per year from these bureaus. Inaccurate information can be disputed directly with the respective CRB.

We may disclose information where necessary to:

  • comply with legal obligations;
  • respond to lawful requests from courts, regulators, supervisory authorities, or law enforcement agencies;
  • protect our rights, property, systems, customers, or the public.

7.4 Corporate Transactions

If we are involved in a merger, acquisition, restructuring, financing, asset sale, or similar transaction, your information may be transferred as part of that process, subject to appropriate confidentiality and legal safeguards.

International Data Transfers

Your personal data is primarily processed and stored in accordance with applicable legal and operational requirements. In certain circumstances, we or our service providers may process or store data outside Kenya.

Where this occurs, we will take appropriate steps to ensure that such transfer is conducted lawfully and that your data remains protected through contractual, technical, organizational, or other appropriate safeguards.

Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including to provide services, comply with legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

Retention periods may vary by data type. For example:

  • account and transaction records: retained for the period required by law, regulation, audit, tax, accounting, or lawful business needs;
  • KYC and identity verification records: retained for the legally required period;
  • customer support records: retained for a reasonable period necessary for complaint handling, quality review, dispute resolution, and legal compliance;
  • technical logs and security data: retained only as long as reasonably necessary for fraud prevention, incident investigation, platform security, and system integrity;
  • images uploaded for support: retained only for the period necessary to resolve the issue, unless a longer retention period is legally required.

Where retention is no longer necessary, we will securely delete, anonymize, or de-identify the data, unless continued retention is required by law.

Data Security

We implement administrative, technical, and physical safeguards designed to protect your information against unauthorized access, loss, misuse, disclosure, alteration, or destruction.

These safeguards may include:

  • encryption of data in transit using secure protocols such as HTTPS/TLS;
  • encryption or equivalent protection for sensitive data at rest;
  • role-based access controls and least-privilege controls;
  • access logging and monitoring;
  • internal security reviews and vulnerability management;
  • incident response procedures and recovery controls.

No system can be guaranteed to be completely secure. However, we take reasonable and appropriate measures to protect your personal data.

Your Rights

Subject to applicable law and necessary verification of your identity, you may have the right to:

  • be informed about how your personal data is processed;
  • request access to the personal data we hold about you;
  • request correction of inaccurate or incomplete information;
  • request deletion of personal data where applicable;
  • object to certain processing;
  • request restriction of certain processing;
  • withdraw consent where processing is based on consent;
  • request portability of data where applicable;
  • request review or reconsideration of certain automated decisions, where applicable.

We may decline or limit a request where the law permits us to do so, including where retention is required for legal, regulatory, fraud-prevention, audit, dispute-resolution, or debt-enforcement purposes.

Account Deletion and Account Closure

If you wish to close your account or request deletion of eligible personal data, you may do so through the in-app account deletion function or by contacting us using the details below.

Before account closure can be completed:

  • outstanding loans, accrued charges, or legally due obligations may need to be settled;
  • we may need to verify your identity and confirm the request;
  • certain records may continue to be retained where required by law, regulation, lawful reporting obligations, fraud prevention needs, dispute handling, or the establishment, exercise, or defense of legal claims.

Deleting your account does not necessarily mean that all associated records will be immediately erased where continued retention is legally required.

Children’s Privacy

Our services are intended only for persons who are legally eligible to enter into a lending relationship under applicable Kenyan law. We do not knowingly provide our services to children or knowingly collect personal data from children.

If we become aware that personal data of a child has been collected inappropriately, we will take reasonable steps to delete it, subject to applicable legal requirements.

Cookies and Similar Technologies

If you access our website or web-based services, we may use cookies or similar technologies to:

  • keep the service secure;
  • remember preferences;
  • understand usage patterns;
  • improve website performance and user experience.

You can manage cookies through your browser settings. Some features may not function properly if cookies are disabled.

Updates to This Privacy Policy

We may amend this Privacy Policy from time to time to reflect legal, regulatory, operational, security, or service changes.

Where required, we will notify you of material changes through appropriate means, which may include an in-app notice, website notice, SMS, email, or other reasonable method. The updated version will take effect from the effective date stated at the top of the revised policy.

Your continued use of the services after the updated Privacy Policy becomes effective constitutes acknowledgment of the updated terms, to the extent permitted by law.

How to Contact Us

If you have any questions, complaints, or requests regarding this Privacy Policy or your personal data, please contact us:

Company Name: LOAN PLUS DIGITAL CREDIT PROVIDER LIMITED
App Name: L Pesa
Customer Support Email: lpesa.help@loanplus.co.ke or help@loanplus.co.ke
Privacy / Data Protection Email: lpesa.help@loanplus.co.ke or help@loanplus.co.ke
Customer Service Hotline: +254 207 905 952
Website: https://www.loanplus.co.ke/
Registered Address: Adlife Plaza Chania Road , Parklands Nairobi,Kenya

If you are dissatisfied with our response, you may have the right to lodge a complaint with the relevant competent authority in Kenya.