Brichton Limited (“Brichton”, “the Lender”, “we”, “us” or “our”) is committed to safeguarding your privacy and protecting your personal data. This Privacy Policy explains how we collect, use, share, retain and protect your personal data when you apply for or use our lending services, whether through our mobile application (the “App”), our website, our systems or any other channel (together, the “Services”). We process personal data in accordance with applicable data protection laws in Kenya, including the Data Protection Act, 2019.
This Policy applies to personal data that Brichton collects and processes in the course of providing lending services to clients, partners and other relevant stakeholders.
It covers applicants, borrowers, guarantors, referees, service providers and other individuals whose data we process, as well as visitors to our website and users of our App. Brichton Limited is the Data Controller as well as Data Processor of the personal data described in this Policy.
We may collect and process the following categories of personal data:
| Category | Examples | Purpose |
| Personal Identification Information | Name, address, phone number, email address, national ID number | For identification, customer account creation, and communication purposes. |
| Financial Information | Bank account details, credit history, loan applications | To assess creditworthiness, manage loans, and process payments. |
| Transaction Data | Loan repayments, transaction history, payment dates | For monitoring loan repayments and maintaining accurate financial records. |
| Employment and Income Data | Employment status, income statements | To determine eligibility for loan products and assess financial capacity. |
| Recorded Communications | Emails, phone call records, correspondence | For dispute resolution, customer service, and compliance with legal and regulatory requirements. |
| Usage, device and location data | See section 5 | Operating, securing and improving the Services |
Where applicable, we also collect information about guarantors and referees you name (such as name, contact details and relationship to you), and verification data such as a photograph or selfie used to confirm your identity. We collect Sensitive Personal Data only where the law permits it and it is necessary for a stated purpose.
We collect personal data from various sources, including but not limited to:
When you provide data by filling out forms, applying for loans, or communicating with us directly.
Information from credit bureaus, regulatory authorities, and other authorized third parties involved in the loan approval and management process.
Data collected via our online platforms, including cookies, IP addresses, and transaction history.
We collect information about your activity on our Services, like service-related, diagnostic, and performance information. This includes information about your activity (including how you use our Services, your Services settings, how you interact with others using our Services, as well as the time, frequency, and duration of your activities and interactions while using our Services), log files, and diagnostic, crash, website, and performance logs and reports. This also includes information about when you registered to use our Services, the features you use like our messaging, calling, Status, or groups features, profile photo, about information.
We collect device and connection-specific information when you install, access, or use our Services. This includes information like hardware model, operating system information, app version, browser information, connection information including phone number, mobile operator or ISP, language, time zone, IP, device operations information, and identifiers like device identifiers (including identifiers unique to Brichton’s products associated with the same device or account).
We collect device location information if you use our location features, like when you choose to share your location with your contacts, view locations nearby or those others have shared with you, and the like, and for diagnostics and troubleshooting purposes such as if you are having trouble with our app’s location features. We use various technologies to determine location, including IP, GPS, Bluetooth signals, and information about nearby Wi-Fi access points, beacons, and cell towers.
We use cookies to operate and provide our services, including to provide our Services that are web-based, improve your experiences, understand how our Services are being used, and customize our Services. For example, we use cookies to provide Brichton for web and desktop and other web-based services. We may also use cookies to understand which of our Frequently Asked Questions (FAQs) are most popular and to show you relevant content related to our Services. Additionally, we may use cookies to remember your choices, like your language preferences, to provide a safer experience, and otherwise to customize our Services for you.
We may receive information about you from:
We process your personal data only where the law allows, relying on one or more of the following grounds:
We use your personal data to:
Where we rely on your consent, we will ask for it clearly and separately from other terms. You may withdraw consent at any time by contacting us. Withdrawal does not affect processing that took place before you withdrew, nor processing that we are required or permitted by law to continue. If you withdraw consent that is necessary to provide a loan, we may be unable to continue providing it.
We may use automated tools, including credit scoring models, to help assess loan applications and detect fraud. Where a decision based solely on automated processing significantly affects you, you may ask us to review it with human involvement, express your point of view, and contest the decision, as provided by Data Protection Law.
We do not sell your personal data. We may share it with:
We may also use or share aggregated or anonymised information that does not identify you, for analytics and business measurement.
We share information about your loan and repayment performance with licensed credit reference bureaus, and may obtain your credit information from them, in line with applicable credit information sharing regulations. Defaults and late payments may affect your credit record and your ability to obtain credit in future. You may request a copy of your credit report from the bureau, and ask us to correct any inaccurate information we have reported.
We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory and reporting requirements. Loan-related data is typically retained for seven (7) years after the agreement ends or the business relationship is closed. After that period, we securely delete or anonymise it.
We may keep certain data for longer where the law requires it, where it is needed to establish, exercise or defend legal claims, or where an investigation or regulatory request is ongoing.
We use appropriate technical and organisational measures, including encryption, secure storage and access controls, to protect your personal data against unauthorised access, alteration, disclosure or destruction. No system is completely secure, so please also protect your login credentials and devices.
Our measures include:
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Office of the Data Protection Commissioner within the period required by law (currently 72 hours of becoming aware of it) and will inform affected individuals without unreasonable delay, explaining what happened, the likely impact and the steps we are taking.
Where necessary, we may transfer your personal data to third parties outside Kenya. In those cases we ensure that appropriate safeguards are in place, as required by applicable law.
Safeguards may include transferring data only to countries with adequate data protection, using contractual protections with the recipient, or obtaining your consent where required.
As a data subject, you have the following rights regarding your personal data:
You may request a copy of the personal data we hold about you.
You can request correction of any inaccuracies in your personal data.
In certain circumstances, you may request the deletion of your personal data.
You may request the restriction of processing where applicable.
You can object to the processing of your personal data for specific purposes, such as direct marketing.
You may request to receive your data in a structured, machine-readable format or request its transfer to another entity.
To exercise any of these rights, complete our Data Subject Rights Form or write to us at info@brichton.com. We may need to verify your identity first, and some rights are subject to our legal and regulatory retention obligations. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner.
You also have the right to withdraw your consent at any time and not to be subject to certain solely automated decisions. We will respond to your request within the time required by law. We do not charge a fee for making a request unless it is clearly unfounded or excessive, in which case the law may allow us to charge a reasonable fee or decline it.
Where applicable, the Lender may transfer your personal data to third parties outside of Kenya. In such cases, we ensure that appropriate safeguards are in place to protect your data, as required by applicable laws.
Our Services are intended for adults aged 18 and above. We do not knowingly collect personal data from children. If we learn that we have done so without valid authorisation, we will delete it promptly. If you believe a child has provided us with personal data, please contact us.
Please give us accurate, complete and current information, and tell us promptly if your details change. If you give us personal data about another person, such as a guarantor or referee, you must have their permission to do so. Keep your login credentials and devices secure, and tell us immediately if you suspect unauthorised access to your account.
By downloading the App, or accessing our system or website and clicking “Accept” on our Terms and Conditions, you are deemed to have accepted this Privacy Policy.
We may update this Policy from time to time. We will notify you of significant changes, and the latest version will always be available on our website. By continuing to use the Services after an update, you agree to the revised Policy.
A cookie is a small text file that a website asks your browser to store on your computer or mobile device.
We use cookies to operate, secure and provide our Services, including to:
You can change your cookie settings through your browser or device settings (usually under “Settings” or “Preferences”). If you disable cookies, some parts of the Services may not work properly.
Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these web-sites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
If you have questions or concerns about this Privacy Policy or the processing of your personal data, please contact:
Brichton Limited
Post Office Box 27774-00100
Nairobi, Kenya
Email: info@brichton.com
Please address privacy requests and complaints to our Data Protection Officer at the details above, marking your message “Data Protection”.
