Privacy policy.

01Introduction and scope

CPact is a digital peer-to-peer lending marketplace operated by Zadhron Dynamics, a business registered in Kenya under Business Registration Number BN-2OS9D7D9. The Platform enables eligible individuals, businesses and organisations to explore lending opportunities, enter into lending arrangements, and manage associated financial activities.

This Privacy Policy explains how Zadhron Dynamics ("we", "us" or "our") collects, uses, shares, protects, retains and deletes personal data when you use the CPact mobile application, related website features and support services (together, the "Services"). It also explains your rights and how to contact us.

We aim to process personal data lawfully, fairly, transparently and only for specified purposes, in accordance with the Kenya Data Protection Act, 2019, its applicable regulations and other relevant requirements. This Privacy Policy is a notice about data processing; agreeing to the Terms of Service does not constitute consent for every optional use of your data.

02Who is responsible for your information

Zadhron Dynamics determines the purposes and means of processing personal information for CPact and is the responsible service provider for the processing described in this Policy, except where an external provider acts independently under its own terms and legal responsibilities.

Privacy questions, complaints and requests to exercise your rights may be submitted to info@zadhron.com. Do not email your password, verification codes, mobile-money PIN or unrequested identity-document photographs. We may ask for proportionate verification before disclosing or changing account data.

03Personal information we collect

The information collected depends on your account type, the services you use and applicable verification requirements. It may include:

3.1 Account and contact details: names, email address, phone number, account identifiers, user role, account status and communication preferences.

3.2 Identity and organisation details: date of birth, identification type and number, identification images, selfie or representative photograph, nationality where relevant, business or organisation name, registration and tax details, and details of authorised representatives.

3.3 Address and financial-profile information: address, occupation or business activity, employment and income information, turnover, source-of-funds declarations and other information you submit to support eligibility or verification.

3.4 Supporting documents: proof of address, identity documents, business registration records, incorporation or tax documents, and other documents requested for the relevant account type or transaction.

3.5 Lending and transaction information: loan listings and requests, offers, lending agreements, repayment schedules, payment instructions, account balances, deposits, withdrawals, transaction amounts, fees, references, receipts, funding and repayment history, and disputes.

3.6 Communications and preferences: messages to support, complaints, fraud reports, notification preferences, referral identifiers, marketplace visibility settings, account-restriction records and deletion requests.

3.7 Technical and security data: IP address, device or application information, session and authentication records, push-notification delivery tokens, timestamps, and operational or security events needed to operate and protect the Services.

Please submit only information requested for a legitimate purpose. If you provide another person's information on behalf of a business or organisation, you must have the appropriate authority and meet applicable notification requirements.

04Device features and permissions

CPact may request access to device features only when needed for a particular function. Permission requests are separate from this Policy, and you can review or change permissions in your device settings.

4.1 Camera and selected documents. Camera access may be used to capture identity photographs or supporting documents that you choose to submit. Document-selection tools may allow you to select specific files. Uploaded material is processed for the disclosed verification or account purpose. We do not require unrestricted access to your photo library merely to let you select a document.

4.2 Notifications. Where permission is required, notifications may be used for account, security, transaction and repayment updates. You can disable device notifications, but you remain responsible for checking your account and contractual due dates.

4.3 Phone-number suggestion or verification. Where offered, device-assisted phone-number selection or verification may involve relevant device, mobile-network or verification services. You can enter your number manually where supported. CPact does not need access to your phone contacts to use a referral identifier.

4.4 Address entry. You may enter your address manually. If an optional device-location-assisted address feature is made available, the app will explain its data use and request the applicable permission before access. No location collection should occur through that feature without the required notice and permission.

4.5 Device authentication. If device biometric or screen-lock authentication is offered, the device operating system handles biometric matching. CPact does not receive the fingerprint or face-unlock template stored by your device. Identity photographs voluntarily uploaded for verification are separate from device biometrics.

Some device capabilities and permissions may be unavailable or restricted under the rules applying to financial applications. CPact will only offer features and permissions that are lawful and permitted on the applicable distribution platform.

05Where information comes from

We obtain information directly from you, from your use of the Services, and from parties involved in authorised transactions. Relevant payment providers may send us payment confirmations, transaction identifiers and statuses. Identity-verification or other service providers may provide verification outcomes and supporting records, where lawful. Other marketplace participants may supply information relating to a transaction or dispute involving you.

06How we use personal information

We process information where reasonably necessary to:

• register, authenticate and administer accounts;
• assess eligibility and verify individuals and organisations;
• publish the marketplace information you elect to make available;
• present, establish, record and administer loan agreements;
• process, verify, reconcile and investigate payments and account balances;
• manage repayments, transaction records, statements and customer support;
• send service, security, payment and repayment communications;
• detect and prevent fraud, account abuse and unauthorised activity;
• handle complaints, disputes, correction requests and deletion requests;
• meet applicable legal, regulatory, tax, accounting and recordkeeping requirements; and
• administer optional referrals or promotions under disclosed programme rules, where offered.

We do not use private identity documents as public marketplace content. We do not sell personal information. We do not upload your phone address book as part of the referral process. Any new material purpose for processing will be explained before that processing begins, with separate consent where required.

07Legal grounds and your choices

Depending on the activity, we may process information to take steps at your request before entering an agreement, perform an agreement, comply with legal obligations, protect legitimate interests such as preventing fraud where lawful, or act on your consent where required.

Where consent is the legal basis, you may withdraw it through the available controls or by contacting us. Withdrawal does not invalidate earlier lawful processing or remove a separate legal basis for retaining relevant records. If information is necessary to verify identity, comply with law or perform a requested transaction, refusing to provide it may prevent access to that feature. Optional permissions and marketing choices must not be treated as consent to unrelated processing.

08Sharing and visibility

We share only information reasonably necessary for the relevant purpose, subject to applicable law and safeguards. Recipients may include:

8.1 Other marketplace participants. Information you choose to display in your profile or listings may be visible to eligible Platform users. Parties to a loan may receive the identity, contact, agreement and transaction information necessary to enter into or administer that relationship. Identity-document images and private verification records are not intended for general marketplace publication.

8.2 Payment and verification providers. Providers may receive the information required to confirm identities, process authorised payments or return transaction statuses, such as names, phone numbers, amounts, references and verification results.

8.3 Technical service providers. Authorised service providers may process data on our behalf for account services, hosting, document handling, notifications, security or customer support, subject to appropriate contractual and security controls.

8.4 Professional advisers, dispute bodies and public authorities. Information may be disclosed where reasonably necessary for legal advice, dispute resolution, fraud investigation or compliance with a valid legal requirement.

Where an external service operates independently, its own privacy terms may also apply. We do not treat a user's selection of a service as permission for unrestricted third-party access to their account.

09Financial profiles and automated processing

CPact may use account details, verification outcomes and transaction information to apply platform rules for eligibility, quotes, account status, repayment tracking, fraud prevention and optional programmes. Other users may make their own lending decisions based on information lawfully displayed to them.

A verification indicator or displayed estimate is not a guarantee of creditworthiness or repayment. Where a solely automated decision produces legal or similarly significant effects and applicable law provides safeguards, we will explain the processing and provide relevant opportunities to challenge the result or request review. You may contact us about materially inaccurate information affecting an outcome.

10Information security

We use appropriate technical and organisational measures intended to protect personal information from unauthorised access, misuse, alteration, disclosure, loss or destruction. These measures include access restrictions, authentication safeguards, secure data transmission, appropriate service-provider controls and incident-management procedures.

Access is limited to persons and service providers who need relevant information for authorised purposes. No system can promise absolute security. Please protect your device and credentials, and promptly report suspected account compromise or misuse.

Where required by applicable law, we will assess and report qualifying personal-data breaches to affected persons or competent authorities.

11International data processing

Some authorised service providers may process information outside Kenya. Where international transfers occur, we will apply applicable Kenyan data protection requirements, including an appropriate legal basis and required safeguards or conditions for the transfer. We do not assume that all information is stored in Kenya merely because the service is offered there.

You may contact us for relevant information about international processing and safeguards relating to your personal data.

12Retention of personal information

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy or to comply with applicable legal obligations. Retention depends on the type of record and its purpose:

• Account and profile information is generally needed while the account relationship continues and for justified post-closure purposes.
• Loan agreements, payments, accounting records and related disputes may be retained for applicable financial, legal, tax, audit and enforcement requirements.
• Verification documents are retained for verification purposes and any applicable lawful recordkeeping period, then removed or anonymised when no longer needed.
• Support, fraud and security records are retained for the period reasonably needed to resolve the issue and satisfy lawful obligations.
• Temporary files, caches and other unnecessary information are removed under appropriate operational retention controls.

We apply a record-specific retention schedule, with review and secure disposal of information no longer needed. Where a particular period is mandated by law, that requirement takes precedence. Contact us for information about the applicable retention period or criteria for a particular category. We do not claim that every type of record has the same retention period.

13Account closure and data deletion

You can request deletion of your CPact account and associated personal information through the account settings or by contacting info@zadhron.com.

To request deletion without the app, email info@zadhron.com with the subject "CPact account deletion". Include your customer ID or the email address or phone number associated with your account so we can locate it. Do not include passwords, payment PINs, verification codes or identity-document images. You do not need to sign in or reinstall the app to make this request.

We may need to verify that the request comes from you. We will distinguish closing access to an account from deleting the personal data associated with it. We will delete or anonymise information that is no longer required, while retaining only information that we are legally permitted or required to keep, including relevant unpaid loan, transaction, accounting, fraud or dispute records. We will explain material retention exceptions where applicable and limit the further use of retained data.

If you have outstanding financial obligations, account closure does not cancel them. You can still contact us for assistance even if you cannot sign in. Account suspension or deactivation alone is not a substitute for processing an eligible deletion request.

Information that you have separately downloaded or exported to your own device may remain in your possession and is not automatically removed by deleting your CPact account.

14Your data protection rights

Subject to applicable law, you may have rights to be informed about processing, access personal data, correct inaccurate or misleading information, object to processing, request erasure in appropriate circumstances, withdraw consent where processing relies on consent, and exercise applicable rights relating to restriction, portability or automated decisions.

Send requests to info@zadhron.com. Please describe the request and supply only the information reasonably needed to identify the account. We will respond within the period required by applicable law, explain any lawful limitations, and provide information about available complaints or escalation routes.

You may complain to Kenya's Office of the Data Protection Commissioner (ODPC). Information about the regulator and its complaint procedure is available at https://www.odpc.go.ke/ . Contacting CPact first does not waive your right to approach the regulator.

15Children's privacy

CPact financial accounts are intended for adults aged 18 or over and authorised adult representatives of eligible organisations. Children must not create accounts or submit identification information for their own account. If we learn that information has been collected from a child without a lawful basis, we will take appropriate steps under applicable law. Please contact us if you believe such information has been provided.

16Changes to this policy

We may update this Policy to reflect changes in our services, information practices or legal obligations. The updated version will state its effective date and be made available through the Platform or another appropriate channel. Material changes will be communicated where required. We will obtain fresh consent where applicable law requires it; continued use alone is not treated as consent to unrelated new purposes.

17Contact

Zadhron Dynamics CPact Privacy Enquiries Business Registration Number: BN-2OS9D7D9 Website: https://zadhron.com Email: info@zadhron.com Country: Kenya