Table of Contents

• Definitions and Interpretation
• The Data We Collect
• How Your Personal Data Is Collected
• How We Use Your Personal Data
• Marketing
• How We Use “Cookies” on Our Website
• The Use of Hyperlinks
• Change of Purpose
• Disclosure of Personal Information
• Transfer of Your Personal Data Outside Kenya
• How We Keep Your Information Secure
• How Long We Shall Retain Your Personal Data
• Data Subject’s Rights
• Collection of Personal Data on Children
• Internal Complaint Handling Procedure
• Non-Compliance with the Privacy Policy
• Changes to This Privacy Policy
• How to Contact Us

Definitions and Interpretation

• “Applicable Law” means the Constitution of the Republic of Kenya, all Acts of Parliament including regulations, rules, guidelines, guidance notes issued pursuant to any Act of Parliament, legislative and regulatory requirements, and codes of practice applicable to the processing of personal data and/or applicable to a data controller or data processor as may be amended from time to time;
• “Personal Data” means any information relating to an identified or identifiable natural person (hereinafter “Data Subject”). For clarity, an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of such a natural person;
• “Controller” means the natural or legal person, authority, organization or other agency that makes decisions individually or together with other parties regarding the purposes and means for processing personal data;
• “LOOP PayCo LTD” includes all its subsidiaries and affiliates (hereafter referred to as “LOOP”, “we”, “us” or “our”);
• “NCBA GROUP” includes all its subsidiaries and affiliates (hereafter referred to as “NCBA”);
• “Messaging Platforms” means third-party messaging applications and services through which users may interact with LOOP for purposes of accessing products, services, customer support and communications;
• “Online and Mobile Financial Services” means the services we offer on our online and mobile platforms;
• “Processing” means an operation or activity or set of operations or activities performed on personal data whether or not by automated means;
• “Processor” is a natural or legal person, authority, organization or other agency that processes Personal Data on behalf of the Controller;
• “Sub-processor” is the contractual partner of the Processor, engaged to carry out specific processing activities on behalf of the Processor;
• “Third Party” means a natural or legal person, public authority, agency or body other than the Data Subject, Controller, Processor, Sub-processor, and persons who, under the direct authority of the Controller, Processor or Sub-processor, are authorized to process Personal Data;
• “Website” means https://loop.co.ke/

• Definitions of terms in our general terms and conditions shall be applicable to this Policy;
• The singular shall include the plural and vice versa; and
• A reference to any one gender, whether masculine, feminine or neuter, includes the other; and
• All the headings and sub-headings in this policy are for convenience only and are not to be taken into account for the purposes of interpreting it.

The Data We Collect

• Identity data which includes name, username or similar identifier, Identity card/Passport number, PIN number, photo, marital status, property details, family details including names of your children and parents, fingerprints, race, nationality, ethnic or social origin, color, age, title, date of birth and gender, and any other similar information;
• Contact data which includes billing address, postal address, physical address, email address and telephone numbers;
• Financial data which includes wallet account details, card payment details and other electronic and non-electronic payment details;
• Transaction data which includes details about payments to and from you and other details of products and services you have acquired from us;
• Technical data which includes internet protocol (IP) address, your login identity data, browser type and version, time zone setting and location data where applicable, browser plug-in types and versions, device information, operating system and platform, and other technology on the devices you use to access our systems;
• For Merchants utilizing the LOOP POS System, we additionally collect:
  • Business Performance Metrics
  • Inventory Data
  • Employee access logs
  • Bank settlement Information
  • Reconciliation data
• Profile data which includes your profile identification information, purchases or orders made by you, your interests, preferences, feedback and survey responses;
• Usage data which includes information about how you use our website, products and services;
• Interaction data including:
  • chat content
  • metadata
  • timestamps
  • delivery status
  • read status
  • preferences
  • any information exchanged through Messaging Platforms
• Marketing and communications data which includes your preferences in receiving marketing information from us and our third parties and your communication preferences;
• Visitors’ personal information/identification details on our premises;
• Biometric data such as fingerprint, images, voice and other similar information, surveillance footages by CCTV cameras on our premises;
• Employment information such as employment history and educational background.

How Your Personal Data Is Collected

Information you give us

• Apply for or use our products or services;
• Open an account(s) with us;
• Subscribe to our services or publications;
• Request marketing information to be sent to you;
• Enter a competition, promotion or survey;
• Give us feedback or contact us;
• Use guest/visitor’s Wi-Fi on our premises; or
• Pay using our services.

Information we collect about you

• Technical information, including the Internet protocol (IP) address used to connect your computer or mobile phone to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies;
• Information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page and any phone number used to call our customer service number.

Information we receive from other sources

• We receive your Personal Data from third parties who provide it to us. We will receive Personal Data about you from various third parties to whom you have consented and public sources including but not limited to: companies registry, lands registry and other government registries; service providers we interact or integrate with now or in future; Integrated Personal Registration Systems, Kenya Revenue Authority and the National Transport and Safety Authority database.
• We may collect information about you from other publicly accessible sources not listed above. We may also collect information about you from trusted partners, not listed above, who provide us with information about potential customers of our products and services;
• We receive your Personal Data from third parties, where you purchase any of our products or services through such third parties; and
• We collect Personal Data that you manifestly choose to make public, including via social media (e.g., we may collect information from your social media profile(s), to the extent that you choose to make your profile publicly visible).

How We Use Your Personal Data

• Where we need to undertake certain processes in order to enter an agreement with you, and where we need to perform the agreement we have entered with you;
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service or product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests; and/or
• Where we need to comply with a legal obligation.

Automated Decision-Making

Marketing

• Promotional offers from us: We may use your identity, contact, technical, usage and profile data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant to you. You will receive marketing communication from us if you have requested information or used our products and services, and if you have opted in to or not opted out of receiving such information.
• Third-party marketing: We may share your Personal Data with any third party for marketing purposes where we believe that the marketing information from such third parties will be relevant to you and where we have obtained your prior consent.

Opting In and Out

• You may Opt in or Out of receiving Marketing Communications by setting your preferences when you first sign up to the LOOP app. This is done by sliding the toggle option to the right to indicate ‘Yes to Marketing” or leaving it to the left to indicate ‘No to Marketing’. If you choose to opt in to marketing, you will receive updates about Product Offerings, Exclusive Deals, Partner discounts, Cashbacks and Seasonal rewards.
• You can adjust your Marketing Preferences anytime under the Profile Settings on your LOOP app. You can also opt out by using the links included in any marketing messages we send to you or by contacting us through the channels provided in this Privacy Policy.
• You can ask third parties to stop sending you marketing messages any time by contacting them and following their opt out process.
• Where you opt out of receiving marketing messages, this will not apply to Personal Data provided to us as a result of product or service subscribed to, warranty registration, product or service experience or other transactions.

How We Use “Cookies” on Our Website

The Use of Hyperlinks

Change of Purpose

• We will only use your Personal Data and special category data for the purposes for which we collected it as indicated in this Privacy Policy or for reasons we give you during the collection of the data.
• If we need to use your Personal Data for an unrelated purpose, we will notify you and seek your consent where necessary.
• Please note that we may process your Personal Data without your knowledge or consent if this is required or permitted by law.

Disclosure of Personal Information

• Government (including law enforcement) authorities and regulators e.g. Central Bank of Kenya;
• Other financial institutions through which your transactions are processed;
• Other companies and financial institutions that we work with to provide services to you e.g. credit card service providers, technology service providers, credit reference bureaus, employers, debt collection agencies and outsourced services vendors; fraud prevention/detection, private investigators, agencies tasked with conducting surveys on behalf of LOOP or NCBA group;
• Third parties with accruing legal obligations e.g. trustees and executors, guarantors, anyone holding a power of attorney to operate an account on your behalf and joint account holders;
• Third parties with reference to acquisition, merger, asset sales, restructuring or by legal obligation or otherwise. We may also transfer your personal data to any of our subsidiaries, new owners, successor entities, or in case of change of business; your personal data may be used in the same way as in this Privacy Policy;
• Third Parties for POS Services including Payment Service Providers (i.e. card payment processors, card schemes and acquiring banks), Mobile Money Operators where you utilize mobile money payments services, Payment Gateway Providers, PIN Validation SDK Vendor for transaction authentication and Technology Infrastructure providers.
• Third parties who are service providers acting as processors, professional advisers including lawyers, bankers, auditors and those who provide consultancy, banking, legal, insurance and accounting services;
• Restricted or publicly accessible government repository as a verification procedure in compliance with regulations;
• Regulatory authorities, police or security agencies, courts of law or statutory authorities in response to litigation and demand issued on legal/regulatory grounds in accordance with the law;
• Agencies tasked with conducting surveys on behalf of LOOP;
• Emergency and disaster response providers in cases where a person’s health and safety is at stake when an emergency call is made;
• Third Party fulfillment partners for purposes of processing and delivering LOOP products and services you use or order.

Transfer of Your Personal Data Outside Kenya

• We may need to transfer or store your information in another jurisdiction to fulfill a legal obligation, to enable performance of our contractual obligations to you, for our legitimate interest and to protect the public interest.
• Insofar as is required for providing our services, we use third party service providers who are located outside Kenya or store your information (including your sensitive personal data) outside Kenya, including in countries that may have different data protection laws from those in Kenya.
• When we, or our permitted third parties transfer or store information outside Kenya, we or they will ensure that it is lawful and that it has an appropriate level of protection, including transfer to jurisdictions that have established data protection laws, and entering legally binding agreements to ensure the security of your Personal Data.
• Where your information is transferred to affiliates of LOOP in other countries, we ensure that your Personal Data is protected by requiring that they follow the same rules when processing your Personal Data.
• We may also transfer your information across country borders where you have consented to the transfer.
• If we transfer your information outside Kenya in other circumstances (for example, because we have to provide such information by law), we will use best endeavours to put in place appropriate safeguards to ensure that your information remains adequately protected.

How We Keep Your Information Secure

• We have put in place appropriate security measures to prevent your Personal Data from being lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.
• We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
• We maintain industry-recognized security standards, including certification under the Payment Card Industry Data Security Standard (PCI DSS) for the secure processing, storage, and transmission of payment card data. We are also duly registered with the Office of the Data Protection Commissioner as both a Data Controller and Data Processor, in compliance with applicable data protection laws.
• While we implement appropriate security measures, communications conducted via Messaging Platforms may be subject to inherent security risks associated with third-party platforms. We encourage you to exercise caution and avoid sharing sensitive personal data unless necessary and requested through official channels

How Long We Shall Retain Your Personal Data

• We will only retain your Personal Data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.
• To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
• By law we have to keep basic information about our customers (including contact, identity, financial and transaction data) for a minimum of seven years after they cease being customers. Our internal policy as amended from time to time may also require us to keep customer data for a longer period.
• In some circumstances, we will anonymize your Personal Data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Data Subject’s Rights

• Right to be informed that we are collecting your personal information and how we are processing it;
• Right to rectify your personal data where it is inaccurate or incomplete;
• Right to withdraw your consent to processing of your personal data. However, we may continue processing your personal data for legitimate interests or legal grounds. Please note that your withdrawal will not affect the lawfulness of our processing which was based on prior consent before your withdrawal. In some instances, we will not be able to provide our products and services if you withdraw your consent;
• Right to object to processing of all or part of your personal data. However, we may decline your request if we are obliged by law or entitled to do so;
• Right of erasure of your personal data held by us, noting that we may continue to retain your information if we are entitled to do so or obliged by law;
• Right to access your personal data in our possession;
• Right to not be subjected to profiling or automated decision making in regards to processing of your Personal Data. However, we may decline your request if we are obliged by law or entitled to do so;
• Right to request your personal data to be processed in a restricted manner. Note that we may continue processing data and reject the request if we are entitled to or are legally obliged; and
• Right to data portability in a manner we may deem appropriate such as electronic format.

Exercising Your Data Protection Rights:

Collection of Personal Data on Children

Internal Complaint Handling Procedure

Non-Compliance with the Privacy Policy

Changes to This Privacy Policy

How to Contact Us

Statement updated: June 2026