Privacy Policy

1. Introduction

shrwed.co Limited ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use shrwed.co (the "Platform").

We comply with the Data Protection Act, 2019 (Kenya) and are registered with the Office of the Data Protection Commissioner (ODPC).

2. Information We Collect

2.1 Information You Provide Directly:

• Account Information: Name, email, phone number, password, date of birth
• Identity Verification: National ID number, KRA PIN (when required for certain features)
• Financial Information: Income range, existing loans, credit preferences (for comparison tools)
• Communications: Support requests, feedback, survey responses

2.2 Information Collected Automatically:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, time spent, links clicked, search queries
• Location Data: General location (county/region) for relevant product recommendations
• Cookies: See Section 10 below

2.3 Information from Third Parties:

• Credit Reference Bureaus (CRBs): With your consent, we may access CRB data for personalised recommendations
• Partners: Lenders, SACCOs, or brokers you apply to through our Platform
• Public Sources: Regulatory databases (CBK licensed institutions)

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Platform
• Personalise your experience (product recommendations, content)
• Process your applications with third-party providers
• Send transactional communications (account updates, security alerts)
• Send marketing communications (with your consent — opt out anytime)
• Analyse usage trends and Platform performance
• Prevent fraud, abuse, and security threats
• Comply with legal obligations (CBK, ODPC, KRA requirements)

4. Legal Basis for Processing (Data Protection Act, 2019)

We process your data under the following legal bases:

• Consent: You have given explicit consent (e.g., marketing emails)
• Contract: Processing is necessary to provide requested services
• Legitimate Interest: Platform improvement, fraud prevention, security
• Legal Obligation: Compliance with Kenyan laws and regulations

5. How We Share Your Information

We do NOT sell your personal information.

We share information only in these circumstances:

5.1 With Your Consent: When you apply for a product through our Platform, we share necessary information with the lender/SACCO/broker.

5.2 Service Providers: Trusted vendors who help us operate (hosting, analytics, email delivery, customer support). All are bound by confidentiality agreements.

5.3 Legal Requirements: When required by law, regulation, court order, or government request (CBK, ODPC, law enforcement).

5.4 Business Transfers: In connection with merger, acquisition, or sale of assets. You will be notified before any data transfer.

5.5 Aggregated/Anonymised Data: We may share anonymised, aggregated data that cannot identify you (e.g., "average APR for mobile loans in Kenya").

6. Data Retention

We retain your data only as long as necessary:

• Active Accounts: Duration of account + 3 years
• Application Data: 3 years from application date (regulatory requirement)
• Marketing Data: Until you unsubscribe + 30 days
• Analytics Data: 26 months (anonymised thereafter)

After retention periods, data is securely deleted or anonymised.

7. Your Data Protection Rights

Under the Data Protection Act, 2019, you have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion ("right to be forgotten")
• Restriction: Request restriction of processing
• Portability: Request data transfer to another provider
• Objection: Object to processing (e.g., direct marketing)
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact privacy@shrwed.co. We respond within 30 days as required by law.

8. International Data Transfers

Your data is primarily stored in Kenya. If transferred outside Kenya:

• We ensure adequate safeguards (standard contractual clauses, adequacy decisions)
• We comply with ODPC requirements for cross-border transfers
• You will be notified of any significant changes

9. Security Measures

We implement appropriate technical and organisational measures:

• Encryption in transit (TLS/SSL) and at rest
• Access controls and authentication
• Regular security audits
• Employee training on data protection
• Incident response procedures

Note: No system is 100% secure. Report suspected breaches to security@shrwed.co.

10. Cookies & Tracking

We use cookies and similar technologies:

• Essential: Required for Platform functionality (cannot disable)
• Analytics: Understand usage (privacy-friendly analytics tools)
• Functional: Remember preferences (language, location)
• Advertising: Show relevant ads (with your consent)

Manage cookie preferences via browser settings or our Cookie Consent Tool. Disabling cookies may limit Platform functionality.

11. Third-Party Links

Our Platform links to third-party sites (lenders, SACCOs, brokers). We are not responsible for their privacy practices. Review their policies before providing information.

12. Children's Privacy

Our Platform is not intended for persons under 18. We do not knowingly collect data from minors. If we learn we have collected data from a minor, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified via email or Platform notice. Continued use after changes constitutes acceptance.

14. Contact & Complaints