LockBx Limited — Data Protection Statement

1. Introduction

LockBx Limited ("LockBx", "we", "us", "our") is licensed by the Central Bank of Kenya as a Non-Deposit-Taking Credit Provider / Digital Credit Provider, and is registered with the Office of the Data Protection Commissioner (ODPC) as a data controller under the Data Protection Act, 2019 ("the DPA"). ODPC Registration No.:INST-4181144BDEA. This Privacy Policy explains how we collect, use, share and protect your personal data when you apply for or use our products, or visit our website.

2. Personal Data We Collect

Depending on the product or channel, we may collect:

Identification data: name, national ID/passport number, date of birth, PIN, photograph;
Contact data: phone number, email, physical/postal address;
Employment and income data: employer, payroll number, salary, employment history (for check-off loans);
Financial data: bank/M-Pesa account details, credit history, credit reference bureau reports, transaction and repayment history;
Asset data: logbook, vehicle or equipment details (for asset-backed and E3W financing);
Device and usage data: device identifiers, SMS/USSD logs, and app or website usage data reasonably required to deliver, secure or improve our services; and
Communications: records of your calls, emails, WhatsApp messages, and correspondence with us regarding complaints.

In line with Regulation 26 of the DCP Regulations, we collect only the personal data reasonably required for your credit appraisal, approval, disbursement, collection, and compliance with applicable legal or regulatory obligations.

3. How We Use Your Data

To assess your creditworthiness and ability to repay before advancing a loan;
To process your application, disburse funds, and administer your loan account;
To verify your identity, including through the Integrated Population Registration System (IPRS), where necessary;
To report positive and negative credit information to licensed Credit Reference Bureaus;
To comply with our obligations under the CBK Digital Credit Providers Regulations, 2022, the Proceeds of Crime and Anti-Money Laundering Act, and other applicable law;
To handle complaints and provide customer support;
To send you service messages relating to your loan account; and
With your consent, to send you marketing communications about our products, which you may opt out of at any time.

4. Legal Basis for Processing

We process your personal data on the basis of: your consent; the necessity of processing to perform our contract with you; our compliance with a legal or regulatory obligation (including obligations to the CBK, the ODPC, and Credit Reference Bureaus); and our legitimate interests in preventing fraud, recovering debts responsibly, and improving our services, balanced against your rights and freedoms.

5. Sharing Your Data

We may share your personal data with:

Licensed Credit Reference Bureaus, for credit reporting and appraisal purposes;
The Central Bank of Kenya and other regulators, where required by law;
Payment partners (e.g., M-Pesa, our banking partners) to process disbursements and repayments;
Your employer, strictly for payroll deduction purposes, where you have a Check-Off Loan;
Licensed debt collection agents, where a loan is non-performing, who are contractually bound to the fair debt-collection standards in our Terms and Conditions;
Professional advisers (auditors, lawyers) and technology service providers who process data on our instructions, under written confidentiality and data-processing agreements; and
Any authority where disclosure is required by law or a valid court order.

We do not sell your personal data. We will not share your data with any other third party without your consent, except as permitted or required by law.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, including any period required to meet our legal, regulatory, accounting, tax, or credit-reporting obligations, after which it is securely deleted or anonymised. [Insert specific retention periods per data category once confirmed internally.]

7. Your Rights as a Data Subject

Under the Data Protection Act, 2019, you have the right to:

be informed of the use to which your personal data is to be put;
access your personal data held by us;
request correction of inaccurate or outdated personal data;
request the deletion of your personal data, subject to any legal or regulatory retention requirement;
object to, or restrict, the processing of your data in certain circumstances;
withdraw consent to processing based on consent, at any time; and
lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

To exercise any of these rights, contact our Data Protection Officer at info@lockbx.io or Hello@locbx.io , call +254 709 320 100, or WhatsApp +254 719 658 223.

8. Data Security

We maintain appropriate technical and organisational measures — including access controls, encryption in transit, and staff confidentiality obligations — to protect your personal data against unauthorised access, loss, misuse, or alteration, in line with Regulation 24 of the DCP Regulations.

9. Cookies

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you through our website or other appropriate channels at least thirty (30) days before they take effect, where the change affects how your data is used.

11. Contact Us

Address: Sifa Towers, 6th Floor, 6A Lenana Road, Kilimani, P.O Box 25590-00603, Nairobi, Kenya
Phone: +254 709 320 100
WhatsApp: +254 719 658 223
Email: info@lockbx.io, hello@lockbx.io (Data Protection queries)