Legal · cowdi.co/privacy
Privacy policy
The short version
- We do not sell your personal data.
- We use it to give you credit, check who you are and stop fraud.
- We share it only with the partners listed below, under data processing agreements.
- You can see, correct or delete your data. Email dpo@cowdi.co.
This summary helps you read the policy. The full text below is the policy.
Cowdi Tech Limited ("Cowdi", "we", "us") is a company registered in Kenya (Company No. PVT-JZUAPEJD). We process personal data in compliance with the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. This policy applies to data collected through the Cowdi mobile application, USSD channel, field agent operations, and partner integrations.
1What we collect
- Identity
- Full name, national ID or passport number, date of birth, gender, nationality, selfie photograph (biometric data)
- Contact
- Phone number (M-Pesa registered), email, business address and GPS coordinates
- Financial
- M-Pesa transaction history (minimum 6 months), loan and repayment records, credit scores
- Business
- Business type, location, inventory data, partner-provided buyer history
- Device
- Device ID, IP address, app usage data
- Calls
- Recordings of phone calls with our sales and support team, voicemails you leave us, and the transcripts and summaries we generate from them
- Agent data
- Identification, engagement and commission records, performance metrics, GPS location during working hours
2Why we collect it
- Loan origination, credit scoring, and account management (contractual necessity)
- KYC/KYB verification and CRB reporting (legal obligation: CBK regulations, POCAMLA, CRB Regulations 2020)
- Fraud prevention and product improvement (legitimate interest)
- Recording calls and voicemails, and transcribing and summarising them, so we can resolve disputes, follow up on your requests, check service quality, and train our team (legitimate interest). Every call starts with a message that tells you it is recorded, and you can object at any time.
- Marketing communications (your consent; you can opt out at any time)
3Who we share data with
We do not sell your personal data. We share it only as needed with:
| Choice Microfinance Bank | Banking and disbursement |
| Metropol CRB | Credit reporting (positive and negative) |
| Safaricom (M-Pesa) | Payment processing |
| IntaSend | Payment gateway |
| Partner companies (for example Gilani's, Greenwheels) | Partner credit products |
| Amazon Web Services | Encrypted cloud infrastructure, including storage of call recordings |
| Africa's Talking | Telephony provider that carries and records our calls |
| AI providers: Google Cloud (Gemini), OpenAI, Anthropic (Claude) or xAI (Grok) | Transcribe and summarise call recordings and voicemails on our instructions; may not use them to train their models |
All third parties are bound by data processing agreements.
4Automated credit scoring
We use automated credit scoring to assess loan applications. You have the right to request human review of any automated decision. The algorithm does not use sensitive personal data (race, ethnicity, religion, health) as scoring factors.
5Data security
AES-256 encryption at rest, TLS 1.2+ in transit, role-based access control, and regular security assessments. No method is 100% secure, but we follow industry best practices. To report a weakness, see Report a security issue.
6Retention
KYC documents, loan records, and M-Pesa data are retained for 7 years after the end of the relationship (per CBK and POCAMLA requirements). Credit scoring data is kept for the duration of the relationship plus 5 years. Marketing consent records are kept for the duration plus 2 years. Complaint records are retained for 7 years after resolution. Application logs are kept for 2 years. Call recordings and voicemails are deleted 2 years after the call. Call transcripts and summaries are kept for the duration of the relationship plus 7 years, or 2 years after the call if you never become a customer. Data is securely deleted or anonymised after the retention period.
7International transfers
Data is hosted on AWS and may be accessed by our parent entity, Cowdi Ltd (United Kingdom), for oversight. Call recordings are stored on AWS in South Africa; to transcribe and summarise them, call audio or transcripts are processed by our AI providers, which may take place outside Africa, including in the United States. Transfers comply with Section 48 of the Data Protection Act and rely on adequacy or standard contractual clauses.
8Your rights
Under the Kenya Data Protection Act you can:
- Be informed about how your data is collected and used
- Access, correct, or delete your personal data
- Restrict or object to processing
- Request data portability
- Opt out of automated decision-making
- Object to a call being recorded, or ask us to delete a recording, by telling the agent during the call or by writing to us
Make a request at cowdi.co/data-request, email dpo@cowdi.co, or write to ALN House, Eldama Ravine Close, Westlands, Nairobi. We respond within 30 days.
9Data breach notification
If we become aware of a data breach that is likely to affect your rights, we will notify the Office of the Data Protection Commissioner within 72 hours and inform affected individuals without undue delay.
10Children
Our services are not intended for anyone under 18. We do not knowingly collect data from minors.
11Changes
We may update this policy and will post changes here with a new "Last updated" date. Material changes will be notified via the App or email.
12Contact
If unresolved, you may escalate to the Office of the Data Protection Commissioner (ODPC) or the Central Bank of Kenya.
13Governing law
This policy is governed by the laws of Kenya, in particular the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. Any disputes are subject to the jurisdiction of the Kenyan courts.