Privacy Policy

Last updated 24 September 2026

This policy explains what data pawa Loans collects, why, and how it's protected, whether you're a staff member of a SACCO or chama using pawa Loans, or a member whose SACCO or chama uses pawa Loans to manage its operations.

1. Who this applies to

pawa Loans is a platform that SACCOs, chamas, and microfinance groups ("businesses") use to manage their members, savings, loans, and financial operations. Two kinds of people interact with the platform, and this policy covers both:

Business staff: administrators, loan officers, tellers, and other staff who log in to run their organisation's day-to-day operations.
Members: individuals who belong to a SACCO or chama using pawa Loans, and who may use the member portal to check their own balances, loans, and statements.

2. Data we collect

Depending on how pawa Loans is used, we collect:

Account information: name, email, phone number, and login credentials for business staff and members.
Business information: the organisation's name, branches, contact details, and configuration.
Member records: as entered by a business's own staff (or by members themselves via the member portal), including name, national ID or passport number, contact details, next of kin, and employment information.
Identification and KYC documents: where a business or member uploads ID copies, proof of income, or similar documents to support onboarding or a loan application.
Financial and transaction data: savings balances, loan applications and repayments, contributions, and M-Pesa or bank transaction references needed to process those payments.
Usage data: log-in activity, IP address, and device/browser information, used for security and to keep the service running reliably.

Note: for member and financial data, the SACCO or chama itself decides what's collected and why, pawa Loans processes it on that business's behalf to provide the service. See our Data Protection page for how that responsibility is split.

3. How we use it

To operate the platform, member records, savings, loans, repayments, and reports that businesses and their members rely on.
To process payments, matching M-Pesa or bank transactions to the correct member and account.
To communicate service-related information, such as loan status, payment confirmations, or account security notices.
To maintain security, including audit trails of who did what and when, and to detect and prevent misuse.
To improve the platform, understanding how features are used so we can fix problems and build what's actually needed.

We do not sell personal data to third parties, and we do not use member financial data for advertising.

4. Who we share data with

Some data necessarily passes through third parties to make the service work:

Payment providers: M-Pesa (Safaricom) and banking partners, to process deposits, repayments, and disbursements.
SMS and communication providers: to deliver notifications like payment confirmations or PIN resets.
Hosting and infrastructure providers: who store and run the platform on our behalf.

Each of these only receives the specific data needed to perform its function, not full access to a business's records.

5. Data retention

We retain data for as long as a business's account is active, plus a reasonable period afterward to meet legal, accounting, or dispute-resolution obligations. A business can request deletion of its data on account closure, subject to any retention we're legally required to keep, for example, financial records relevant to a regulatory audit.

6. Security

Access to the platform is controlled by login credentials and role-based permissions, so a staff member only sees what their role requires, tellers, loan officers, and administrators have different levels of access. Significant actions, transactions, approvals, and record changes, are recorded in an audit trail. Member-facing access is separately authenticated from staff access, so a member can never see another member's account.

7. Your rights

Depending on your role, you may have the right to access, correct, or request deletion of your data. For a member, that request is generally directed to the SACCO or chama you belong to, since they control your record, we act on their instructions as the platform they use. For a business, you can manage most of this directly within the platform, or contact us for anything you can't. See our Data Protection page for more on how these rights work under Kenyan law.

8. Children's data

pawa Loans is not directed at children, and we do not knowingly collect data from anyone under 18 except where a business itself records a member's junior/dependant savings account, which remains that business's own data under the same controls as any other member record.

9. Changes to this policy

We may update this policy as the platform evolves or as legal requirements change. Material changes will be reflected by updating the date at the top of this page.

10. Contact us

Questions about this policy or your data can be sent to info@pawaloans.co.ke.