Legal
Privacy policy
This policy explains what personal data NdioLa collects, why, who we share it with, and what you can ask us to do with it. It is written under the Data Protection Act, 2019 of Kenya.
1. Who controls your data
The data controller is Kamathi GlobeISS Technologies Limited, Royal Gates House 78, Namanga Road, Kitengela, Kajiado County, Kenya. For any privacy question or request, write to privacy@ndiola.com.
2. What we collect
- Account data: your mobile phone number, the name attached to your mobile money account, your date of birth or age confirmation, and an email address if you give one.
- Verification data: where we are required to verify you, a government identity document number and, where necessary, a document image and a selfie.
- Transaction data: deposits, withdrawals, trades, positions, settlements and fees, with their timestamps and references.
- Technical data: device type, browser, IP address, and app event logs used for security, fraud prevention and debugging.
- Support data: the messages you send us and our replies.
We do not collect your mobile money PIN, and we will never ask you for it. Anyone who does is not us.
3. Why we use it, and on what legal basis
| Purpose | Basis |
|---|---|
| Operating your account, executing and settling your trades, paying you out | Performance of our contract with you |
| Verifying identity and age; anti-money-laundering checks; regulatory reporting | Legal obligation |
| Detecting and preventing fraud, market manipulation and account takeover | Legitimate interest in a safe platform |
| Fixing faults, monitoring performance, improving the product | Legitimate interest |
| Service messages about your account, trades and settlements | Performance of contract |
| Marketing messages about new markets and features | Your consent, withdrawable at any time |
4. Who we share it with
We share personal data only where it is needed, and only with:
- Payment and mobile money providers, to move money to and from your wallet.
- Identity verification providers, where a check is required.
- Infrastructure and hosting providers that run the platform on our behalf under written data processing terms.
- Regulators, courts and law enforcement, where we are legally required to disclose.
- Professional advisers such as auditors and lawyers, under duties of confidence.
We do not sell personal data, and we do not share it with advertisers or data brokers.
5. Transfers outside Kenya
Some of our infrastructure providers process data outside Kenya. Where that happens, we transfer data only where appropriate safeguards are in place, consistent with the requirements of the Data Protection Act, 2019.
6. How long we keep it
We keep account, identity and transaction records for seven years after your account closes, which is the period required of us for financial and anti-money-laundering record keeping. Technical logs are kept for twelve months. Support correspondence is kept for three years. After those periods, data is deleted or irreversibly anonymised.
7. Your rights
Under the Data Protection Act, 2019 you have the right to be told how your data is used, to get a copy of it, to have inaccurate data corrected, to object to certain processing, to withdraw consent where consent is the basis, and to ask for deletion where we have no continuing legal reason to keep it.
Write to privacy@ndiola.com. We respond within thirty days. If you are not satisfied with our answer, you may complain to the Office of the Data Protection Commissioner of Kenya.
Note that we cannot delete records we are legally required to retain, and we cannot keep an account open without the data needed to run it.
8. Security
Access to the platform uses one-time codes sent to your registered number rather than a stored password. Data is encrypted in transit and at rest. Access to production systems is restricted, logged and reviewed. We test for vulnerabilities and patch on a routine schedule. No system is perfectly secure; if a breach affects your data, we will notify you and the Office of the Data Protection Commissioner as the Act requires.
9. Cookies and similar technology
We use only what the platform needs to function: a session identifier to keep you signed in, and aggregate analytics on how the app is used. We do not use advertising or cross-site tracking cookies.
10. Children
NdioLa is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we close it and delete the data other than what we must retain for legal reasons, and we return any balance to the originating number.
11. Changes
If we change this policy materially, we will notify you in the app and by message to your registered number at least fourteen days before the change takes effect.
Kamathi GlobeISS Technologies Limited · PVT-3B1MD5ZR · Royal Gates House 78, Namanga Road, Kitengela, Kajiado County, Kenya · privacy@ndiola.com