1. Commitment to Data Protection

Nelion Finance Limited (referred to as "we", "us", "our", or the "Company") values your privacy. We are committed to safeguarding the personal records and transaction histories of all borrowers and website visitors.

This Privacy Policy is designed to comply with the Tanzania Personal Data Protection Act, 2022, the regulations of the Personal Data Protection Commission (PDPC), and directives of the Bank of Tanzania (BoT). This policy details how we collect, store, process, share, and protect your information.

2. Data We Collect

To provide digital micro-lending services, we collect various categories of information:

• Identity & Demographic Details: Full name, date of birth, gender, marital status, and your verified National Identification Number (NIDA).
• Contact Credentials: Primary phone numbers (including network provider listings for Vodacom, Airtel, Tigo, or Halotel), email address, physical address, and detailed residential directions.
• Occupational & Financial Data: Employment status, business name, business address, current stock valuations, weekly sales, and net income calculations.
• KYC Documentation: Photos of NIDA cards, residence verification photos, business assessment photos, and verification photographs taken in the field by our Loan Officers.
• Guarantors & Referees: Contact names, phone numbers, and relationships of individuals who vouch for your applications.
• Device & Network Identifiers: Web browser details, IP address hashes (SHA-256), login session history, and 2FA authentication logs to protect your account against fraudulent logins.

3. Legal Basis and Purpose of Processing

We collect and process your personal data under the following legal bases:

• Performance of a Contract: To evaluate creditworthiness, register customer accounts, approve micro-loans, and coordinate mobile money disbursements.
• Compliance with Legal Obligations: To verify identities in compliance with Anti-Money Laundering (AML) regulations, tax reporting (Tanzania Revenue Authority), and microfinance licensing standards.
• Consent: When you register and apply for credit services, agreeing to credit reports and data verification.

4. Disclosure & Sharing of Your Information

We do not sell or lease your personal records. We share data only with authorized parties as permitted by law:

• Credit Reference Bureaus (CRBs): As required under the Tanzania Microfinance Act, we share client repayment behavior (both positive and negative) with registered CRBs.
• Payment Processors: We share transactional instructions with mobile money operators (M-Pesa, AirtelMoney, TigoPesa, Halopesa) via payment aggregators (e.g. Azampay) to disburse cash and receive repayments.
• Regulatory Authorities: We disclose data when mandated to do so by the Bank of Tanzania, the PDPC, law enforcement agencies, or tax offices.
• Internal Field Staff: Assigned Loan Officers (LO) and Collection Officers (CO) will access your profile parameters to complete assessments and perform collections. This is restricted by strict branch-level security rules.

5. Data Retention Period

In compliance with Tanzanian financial and anti-money laundering laws, we store borrower records, account histories, audit logs, and loan files for a minimum of five (5) years after the closure of your account or final loan repayment. Once this period has elapsed and there are no outstanding legal disputes, data is securely anonymized or permanently deleted.

6. Security Infrastructure

Your personal and financial records are stored securely behind advanced firewalls and access controls. All databases restrict connections through Row-Level Security (RLS) policies. Sensitive documents (identity cards, verification photos) are stored in secure cloud containers accessible only to verified administrators. Furthermore, all administrative login attempts undergo Two-Factor Authentication (2FA) and device identification checks.

7. Your Data Rights

Under the Personal Data Protection Act, 2022, you have specific rights regarding your records:

• Right of Access: You can request a summary of the personal data we hold about you.
• Right to Rectification: You can request correction of inaccurate, incomplete, or outdated information.
• Right to Erasure: You may request deletion of records, subject to regulatory retention mandates (loans cannot be deleted while active or within statutory compliance retention windows).
• Right to Lodge a Complaint: You have the right to appeal to the Personal Data Protection Commission (PDPC) if you believe your data has been handled unlawfully.

8. Changes to this Policy

We may revise this Privacy Policy periodically to reflect changes in regulatory requirements or platform upgrades. Significant updates will be communicated through the Platform interfaces or via SMS alerts.

9. Contact Information

For questions regarding data privacy, your rights, or to submit data requests, please contact our Data Protection Officer at:
Email: privacy@nelionfinance.co.tz
Address: Nelion Finance Limited, Dar es Salaam, Tanzania