Privacy Policy

1. Who we are

Mkopo Flow (“we”, “us”, “our”) is a financial technology platform that provides loan management software to regulated microfinance institutions (MFIs) in Tanzania. Our registered address is United Republic of Tanzania.

This Privacy Policy explains how we collect, use, store, and share personal data when you use the Mkopo Flow platform whether as an MFI staff member via the web portal (portal.mkopoflow.com) or as a borrower whose application is processed through an MFI that uses our software.

2. Personal data we collect

Depending on your role, we collect the following categories of data:

MFI staff and administrators:

• Full name, work email address, phone number
• Role and branch assignment within your institution
• Login credentials (passwords are hashed; we never store plaintext)
• Access logs and audit trails of actions taken in the platform

3. How we use your data

We use personal data strictly for the purposes listed below:

• Processing and underwriting loan applications on behalf of MFI partners
• Verifying salary and employment status Bank integration
• Initiating loan disbursements and monitoring repayment via payroll deductions
• Generating regulatory reports required by the Bank of Tanzania (BOT)
• Providing customer support and resolving disputes
• Maintaining audit trails for compliance and anti-money-laundering (AML) obligations
• Detecting and preventing fraud
• Improving the reliability and security of our platform (anonymised analytics only)

4. Legal basis for processing

We process personal data under the following legal bases as defined by Tanzania's Personal Data Protection Act, 2022 (Cap. 447):

• Contractual necessity to perform loan services requested through your MFI
• Legal obligation to comply with BOT regulations, AML/CFT requirements, and the Banking and Financial Institutions Act
• Legitimate interests fraud prevention and platform security
• Consent where explicitly sought (e.g. marketing communications), which you may withdraw at any time

5. Sharing your data

We do not sell personal data. We share data only as follows:

• Bank for salary verification and payroll deduction processing
• PSP for loan disbursement via mobile money or bank transfer
• Bank of Tanzania as required by regulatory reporting obligations
• Your MFI or employer as part of the loan processing workflow you initiated
• Cloud infrastructure providers (servers operating within or compliant with Tanzanian data localisation requirements)
• Professional advisers lawyers, auditors under strict confidentiality obligations

Any third-party service provider we engage is bound by data processing agreements requiring equivalent protection standards.

6. Data security

We apply the following technical and organisational measures to protect your data:

• Encryption at rest for all sensitive fields (NIN, bank account numbers) using Fernet symmetric encryption
• TLS 1.2/1.3 in transit for all API and web communications
• Role-based access control staff only access data relevant to their assigned function
• Immutable audit logs for every data access and modification event
• Regular security assessments and penetration testing

7. Data retention

We retain personal data for the period necessary to fulfil the purposes outlined above and to comply with legal obligations. Loan records and associated borrower data are retained for a minimum of seven (7) years after the loan is fully repaid or written off, in accordance with BOT requirements and the Limitation of Actions Act.

After the retention period expires, data is securely deleted or anonymised. You may request deletion of your account data at any time; where a legal obligation requires us to retain records, we will inform you of the specific period.

8. Your rights

Under the Personal Data Protection Act, 2022 you have the right to:

• Access request a copy of the personal data we hold about you
• Correction request that inaccurate or incomplete data be corrected
• Deletion request erasure of data where there is no lawful reason for continued processing
• Objection object to processing based on legitimate interests
• Portability receive your data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on your consent

To exercise any of these rights, contact us at privacy@mkopoflow.com. We will respond within 30 days. In some cases, identity verification may be required before we can fulfil your request.

9. Cookies and tracking

The Mkopo Flow marketing website (mkopoflow.com) uses only essential session cookies needed for navigation. No advertising or third-party tracking cookies are used. The portal (portal.mkopoflow.com) uses authentication session cookies strictly necessary to keep you logged in. We do not use cross-site tracking, fingerprinting, or sell browsing data.

10. Children's privacy

Our services are intended for institutions and adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor's data has been submitted, contact us immediately at privacy@mkopoflow.com.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the revised policy on this page and update the effective date above. If you are an MFI partner, we will also notify you by email at least 14 days before changes take effect. Continued use of the platform after that date constitutes acceptance of the revised policy.

12. Contact & complaints

For any privacy-related enquiries or to file a complaint:

• Email: privacy@mkopoflow.com
• Post: Data Protection Officer, Mkopo Flow, Tanzania

You also have the right to lodge a complaint with Tanzania's Personal Data Protection Commission (PDPC) if you believe your rights under the Act have been violated.