Cashlog
Legal

Privacy Policy

Last updated: April 1, 2026

1. Who we are

Cashlog Ltd is a data controller registered with the Office of the Data Protection Commissioner of Kenya (registration on file). We comply with the Kenya Data Protection Act, 2019 ("DPA").

2. What data we collect

  • Identity data: name, National ID, KRA PIN, date of birth.
  • Contact data: phone number, email, residential address.
  • Vehicle data: logbook details, registration, valuation reports.
  • Financial data: bank or M-Pesa statements, employment and income information, CRB report.
  • Tracker data: GPS location pings collected via the security tracker fitted to your vehicle, accessed only during default escalation.
  • Usage data: device, browser, IP address, page interactions.

3. Why we collect it

  • To pre-screen your application before introducing you to our Partner Lender.
  • To share with our Partner Lender for underwriting and disbursement (with your explicit consent).
  • To comply with anti-money-laundering, KYC and CRB obligations.
  • To support you as a concierge while our Partner Lender services your loan.
  • To improve our website and services.

4. Lawful basis

We process your personal data on the bases of (a) your consent, (b) the performance of a contract with you, (c) compliance with a legal obligation, and (d) our legitimate interests in operating and improving our service.

5. Sharing

We share data with: our Partner Lender, regulated credit reference bureaux, NTSA for joint logbook registration, the tracker installation service provider, and where compelled by law. We do not sell your data to third parties.

6. Retention

Application data is retained for 7 years after loan closure (statutory requirement). Tracker pings are retained for 90 days unless required for an active recovery case.

7. Your rights

Under the DPA, you have the right to access, rectify, erase, restrict and port your personal data, and to object to processing. To exercise these rights, email dpo@cashlog.co.ke.

8. Security

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access is role-based and audit-logged.

9. Cookies

See our Cookie Policy for details on the cookies we use.

10. Contact our DPO

Email: dpo@cashlog.co.ke · Post: Data Protection Officer, 14th Floor, ABC Place, Waiyaki Way, Westlands, Nairobi.