1. PERSONAL DATA OF CHILDREN

We do not knowingly request or collect Personal Data from anyone below the age of 18. If We discover that We have unintentionally collected Personal Data from anyone below 18, We will remove that person’s Personal Data from our records promptly. However, M-KOPA may collect Personal Data about children below the age of 18 years of age from the parent or guardian directly, and with that person’s explicit consent.

2. SOURCES OF PERSONAL DATA

We collect Personal Data from or about you from the following sources:

• M-KOPA website(s): Website(s) operated by Us under our own domain(s)/URL(s) (such as www.M-KOPA.com) and mini-sites that We run on third party social networks such as Facebook  (“Websites”).
• M-KOPA mobile sites/apps: Customer-directed mobile sites or applications operated by or for M-KOPA, such as smartphone apps.
• Call, text, USSD (Unstructured Supplementary Service Data) message and other electronic messages: Interactions with electronic communications between you and M-KOPA.
• M-KOPA Customer Care call centres: Communications with our Customer Care team.
• Registration forms: Printed or digital registration and similar forms that We collect when you sign up to purchase our products and services, in-store demos, contests and other promotions, or events. 
• Advertising interactions: Interactions with our advertisements (e.g., if you interact with on one of our ads on a third-party website, We may receive information about that interaction).
• Surveys: Information gathered when you complete any survey, focus group, interview, study or other such activity.
• Recruitment and former employees: Information shared by yourself when applying for a job with Us, information publicly available on social media platforms to identify prospective candidates for a specific function, or basic information required from former employees about their employment at M-KOPA.
• Data We create: In the course of our interactions with you, We may create Personal Data about you (e.g. records of your purchase(s), issue logs etc).‍
• Data from other sources. Credit reference bureaus, third party social networks (e.g. such as Facebook), advertising networks (e.g. such as Google), messaging apps (e.g. such as WhatsApp), market research (if feedback is not provided on an anonymous basis), third party data aggregators, M-KOPA promotional partners, public sources and data received when We acquire other companies.
  ‍

3. PERSONAL DATA THAT WE COLLECT ABOUT YOU AND HOW WE COLLECT IT

Depending on how you interact with M-KOPA (online, offline, over the phone, etc.), We collect various types of information from you, as described below:

• Personal contact information: This includes any information you provide to Us that would allow Us to contact you, such as your name, e-mail address, social network details, or phone number.
• Your Account: Any information that is required to create your account with M-KOPA and give you access to your specific account profile. Examples include your login ID, date of birth, age or age range, gender, geographic location occupation, national identity number (or similar identification numbers as applicable), image, mobile number, password in unrecoverable form, and/or security question and answer and any other information required for our due diligence and to better understand your credit profile (such as daily income/purchase potential etc).
• Device information: Any information about the device that you have purchased from Us or that has been issued to you as an employee, which may include, your device’s unique device ID (IMEI number), make/model, location based data, geo-location and other similar device data that may be (i) for the performance of the contract you have entered with us; (ii) to comply with our legal obligations (for example where We are required to carry out due diligence on our customers to avoid theft, fraud and comply with anti-money laundering regulations); (iii) to help us improve the quality of the devices and services that We offer you, and to offer you additional products and services.
• Websites/communication usage information: As you use our applications or websites, We collect certain information about your actions in order to prevent fraudulent use of your account by others, assist you in remembering your log in details or language and other preferences to avoid you having to re-enter your preferences every time you use our website. This information is captured using automated technologies such as cookies and web beacons and is also collected through the use of third party tracking for analytics and advertising purposes. You have the right to object to the use of such technologies, for further details please see Section 4.
• Market research & customer feedback: Any information that you voluntarily share with Us about your experience of using our products and services. As part of completing a survey, you may be asked to provide your name, address, phone number and any other information relevant. This can be done via means such as email, ads, SMS, phone calls, messaging apps and postal mailings to the extent permitted by applicable laws. Some of our research, campaigns and promotions are run on third party websites and/or social networks. This use of your Personal Data is voluntary, which means that you can oppose (or withdraw your consent in certain countries) to the processing of your Personal Data for these purposes.
• Profiling and automated decision making: To improve your experience and fight fraud, we may conduct manual reviews or use automated decision making, for example, your identification documents may be subject to human review and/or automated decision making for verification purposes. 
• Customer-generated content: Any content that you create and then share with Us on third party social networks or by uploading it to one of our Websites or apps, including the use of third party social network apps such as Facebook. Examples include photos, videos, personal stories, or other similar media or content. Where permitted, We collect and publish customer-generated content in connection with a variety of activities, including contests and other promotions, website community features, consumer engagement, and third party social networking.
• Third party social network information:  We receive your third party social network profile information (or parts of it) every time you interact with M-KOPA on a third party social network platform such as Facebook, every time you use a social networking feature that is integrated within M-KOPA’s website or every time you interact with Us through a third party social network. We use your Personal Data when you interact with the platform’s features, such as “Like” functions on Facebook or Instagram, to serve you with advertisements and engage with you on third party social networks. To learn more about how your information from a third party social network is obtained by M-KOPA, or to opt-out of sharing such social network information, please visit the website of the relevant third party social network.
• Employment information: We are constantly searching for new talent for our organization, and We collect information about job applicants or prospective candidates from several sources. Applicants are referred to M-KOPA Careers for more information. When an employee leaves M-KOPA, We continue to process information that is related to them for any remaining business, contractual, employment, legal, and/or fiscal purposes as required by law.
• Payment and Financial information: Any information that We need in order to fulfil an order. 
• Calls to M-KOPA:  Communications with M-KOPA can be recorded or listened into, in accordance with applicable laws, for local operational needs (e.g. for quality or training purposes). Payment details are not recorded. Where required by law, you will be informed about such recording at the beginning of your call.‍
• Sensitive Personal Data: We do not seek to collect or otherwise process sensitive Personal Data in the ordinary course of our business. Where it becomes necessary to process your sensitive Personal Data for any reason, We rely on your prior express consent for any processing which is voluntary. If We process your sensitive Personal Data for other purposes, We rely on the following legal bases: (i) detection and prevention of crime (including the prevention of fraud); and (ii) compliance with applicable law (e.g. to comply with our diversity reporting).
  ‍

4. COOKIES/SIMILAR TECHNOLOGIES

Please see our Cookie Policy to learn how you can manage your cookie settings and for detailed information on the cookies We use and the purposes for which We use them.
‍

5. DISCLOSURE OF YOUR PERSONAL DATA

In addition to the M-KOPA entities mentioned in the data controllers & contact section (see section 11), We share your Personal Data with the following types of third party organisations:

• Service providers: These are external companies that We use to help Us run our business (e.g. order fulfilment, payment processing, fraud detection and identity verification, website operation, market research companies, support services, promotions etc.). Service providers, and their selected staff, are only allowed to access and use your Personal Data on our behalf for the specific tasks that they have been requested to carry out, based on our instructions, and are required to keep your Personal Data confidential and secure.
• Credit reporting agencies/debt collectors. To the extent permitted or required by applicable law, credit reporting agencies and debt collectors are external companies that We use to help Us to verify your creditworthiness (in particular for orders with invoice) or to collect outstanding payments.
• Third party companies using Personal Data for their own marketing purposes. Except in situations where you have given your consent, We do not license or sell your Personal Data to third party companies for their own marketing purposes. Their identity will be disclosed at the time your consent is sought.‍
• Third party recipients using Personal Data for legal reasons or due to merger/acquisition. We will disclose your Personal Data to third parties for legal reasons or in the context of an acquisition or a merger.
  ‍

6. RETENTION OF YOUR PERSONAL DATA

M-KOPA takes every reasonable step to ensure that your Personal Data are only processed for the minimum period necessary for the purposes set out in this Privacy Notice and as communicated to you. We will however retain copies of your Personal Data in a form that allows for identification only for as long as: 

1. We maintain an ongoing relationship with you (e.g. where you have not unsubscribed from our marketing); 
2. your Personal Data are necessary for the purposes set out in this Privacy Notice; and c) we have valid legal basis plus the duration of: (i) any applicable limitation period (i.e. any period during which a person could bring a legal claim against us), plus (ii) an additional 2 months following the end of the applicable limitation period (so we are able to identify any Personal Data of a person who may bring a claim at the end of the applicable period); and
3. if any relevant legal claims are brought, we may continue to process your Personal Data for such additional time necessary in connection with that claim. 

During the periods noted in paragraph b) above, processing of your Personal Data will be restricted to review in connection with any claim or obligation under applicable law, storage and maintaining security of those data.Once the periods in paragraphs a), b) and c) above, each to the extent applicable, have expired, we will either (i) permanently delete or destroy the relevant Personal Data or (ii) anonymise the relevant Personal Data.
‍

7. ACCESS, STORAGE AND/OR TRANSFER OF YOUR PERSONAL DATA

We use appropriate measures (described below) to keep your Personal Data confidential and secure. Please note, however, that these protections do not apply to information you choose to share in public areas such as third party social networks.

• People who can access your Personal Data: Your Personal Data will be processed by our authorised employees or agents, on a need to know basis, depending on the specific purposes for which your Personal Data have been collected (e.g. our employees in charge of consumer care matters will have access to your consumer record).
• Information Security: To protect your Personal Data from unauthorized access, use, and disclosure, We have implemented reasonable physical, administrative, and technical safeguards. We also require our Business Partners, suppliers, and third parties to implement appropriate safeguards. ‍
• Transfer of your Personal Data. Because of the international nature of our business, We may need to transfer your personal data within the M-KOPA group, and to third parties as noted in Section 5 above, in connection with the purposes set out in this Privacy Notice. For this reason, We may transfer your personal data to other countries that may have different laws and data protection compliance requirements to those that apply in the country in which you are located (see Section 11 below for details of which countries your Personal Data may be transferred to). We have put in place the strictest standards to protect your Personal Data if transferred. If the countries to which your Personal Data will be transferred to do not implement adequate personal data protection standards, We will ensure that any transfer is subject to adequate levels of protection.
  ‍

8. YOUR RIGHTS

Depending on where you are located, you have certain rights when it comes to the handling of your Personal Data. You may contact Us (see Section 11) to:

‍

1. request access to the Personal Data that We have on you, or have it updated or corrected. Depending on the applicable law, you may have additional rights concerning your Personal Data;
2. request to obtain your Personal Data in a usable format and transmit it to another party (also known as the right to data portability);
3. request to delete the Personal Data We hold about you;
4. opt-out of specific Personal Data processing types, such as targeted advertising;
5. ask questions related to this Privacy Notice and our privacy practices; 

submit a complaint if you are not satisfied with how M-KOPA is processing your Personal Data.Any identification information provided to Us will only be processed in accordance with, and to the extent permitted by applicable laws. Note: requests submitted by a person other than you without evidence that it is legitimately made on your behalf will be rejected.Please note that the above rights are not absolute and may be subject to limitations or exemptions within local legislation. Where applicable, we will identify this in our response to your request.We hope that We can satisfy your queries about the way We process your Personal Data. If you have unresolved concerns you also have the right to complain to the relevant competent data protection authority. Authorities can be contacted through their websites (see below).

‍

‍

9. YOUR CHOICES ABOUT HOW WE USE AND DISCLOSE YOUR PERSONAL DATA

The following mechanisms give you control over your Personal Data:

• Cookies/Similar Technologies: You can manage your consent so as to refuse all or some cookies/similar technologies, or to alert you when they are being used. Please see Section 4 above.‍
• Advertising, marketing and promotions: You can consent for your Personal Data to be used by M-KOPA to promote its products or services through tick-box(es) located on the registration forms or by answering the question(s) presented by our Customer Care representatives. If you decide that you no longer wish to receive such communications, you can unsubscribe from receiving marketing-related communications at any time, by following the instructions provided in each such communication. Please note that, even if you opt-out from receiving marketing communications, you will still receive administrative communications from Us, such as notifications about your account activities (e.g. loan status, password changes, etc.), and other important non marketing related announcements.
  ‍

10. CHANGES TO THIS NOTICE

If We change the way We handle your Personal Data, We will update this Notice. We reserve the right to make changes to this Notice at any time. Please check back frequently to see any updates or changes to our Notice.

11. DATA CONTROLLERS & CONTACTS

M-KOPA comprises of M-KOPA Holdings Limited (a limited liability company in England & Wales, registered number 10891868) and its affiliates and/or subsidiaries (referred to collectively as “M-KOPA” or “we” or “our”). M-KOPA affiliates and/or subsidiaries do business across Africa. The privacy laws in some countries consider a Controller (or Responsible Party as defined in South Africa) to be the legal entity (or natural person) who defines the purposes for which the processing of Personal Data takes place and how that data is processed. Parties that are involved in processing operations on behalf of a Controller are referred to as Processors (or Operator as defined in South Africa). The titles associated with the obligations differ, depending on the jurisdiction. Where relevant for the privacy laws in your country, the Controller of your Personal Data is M-KOPA’s main subsidiary or affiliate in your country. The contact details of our main affiliate and/or subsidiary in your country or region can be found in the table below: If you have any questions about our products or services, please contact Us at customercare@m-kopa.com.To ask questions or make comments on this Notice and our privacy practices or to make a complaint about our compliance with applicable privacy laws, please contact Us at dpo@m-kopa.com or call our Customer Care team (see below table for phone numbers).