Surehela User Privacy Agreement

This Privacy Policy explains how we collect, use, and disclose your information when you use our services, and informs you of your privacy rights and legal protections. If you do not agree with our policies and practices, you may choose not to use our services. For more information about Surehela, please visit the "Privacy Policy" section on our official website. This policy may be updated from time to time as needed. If a specific product has its own privacy policy, or its user service agreement contains special terms, that product's own privacy policy shall prevail; for content not covered in that product's privacy policy or user service agreement, this policy applies. We will use your personal data to provide and optimize related services. By accessing or using this service, you agree to our collection and use of your information in accordance with this Privacy Policy.

Introduction: Surehela highly values your privacy rights and is committed to protecting your personal data security. When you use our products and/or services, we may collect and use your relevant information. This "Surehela Privacy Policy" (hereinafter referred to as "this Policy") aims to provide you with a detailed overview of our business, the types of personal information we collect, the channels for accessing, updating, and deleting your information, related protective measures, and the relevant rules we must follow when sharing, transmitting, or publicly disclosing your personal information. This Policy is closely related to the Surehela financial services you use, and the various business functions included in these services (collectively, "our products and/or services"). We recommend that you carefully read this Policy before using our products and/or services to ensure that you fully understand all the contents of this Policy (especially the content marked in bold) and can make choices that conform to your own wishes based on the guidance of this Policy. For your convenience, all relevant terms used in this Policy have been explained concisely and clearly.

It is particularly important to note that this Policy only applies to the products and/or services defined in this Policy.

How We Collect Your Personal Information
We will collect and use personal information that you actively submit or that is generated during your use of our products and/or services, based on the basic principles of legality, fairness, and necessity. All use of information shall comply with the purposes clearly stated in this Policy. If we plan to use your personal information for purposes not mentioned in this policy, or to repurpose information collected for a specific purpose, we will notify you reasonably before use and obtain your explicit consent again.

1.1 Personal Data
During your use of our services, we may request certain information that can be used to contact or identify you personally. This personally identifiable information includes, but is not limited to, the following:

● Phone number

● Email address

● Name

● Gender

● Date of birth

● ID card number

● Education information

● Marital status

● Occupation information

● Address information

1.2 Usage Data
We primarily obtain your personal information through the following two channels:

Information you actively provide: We may collect and retain various information you submit when using Surehela financial services, including information you provide when filling out online forms, applying for products and/or services, participating in feedback, resolving related disputes, or contacting us regarding Surehela financial services. This also includes information generated during your use of our services related to your transactions and related activities.

Usage data is automatically collected during your use of the services.

Information We Actively Collect: When you visit Surehela's official website, use our applications, and related services, we collect information sent from your computer, mobile phone, and other access devices.

1.3 Information from Third-Party Social Media Services
If you choose to allow us access to your third-party social media services, we may collect personal data associated with your third-party social media service accounts, such as your name, email address, and activity records, after obtaining your explicit consent. You may also choose to share other additional information with us through your third-party social media service accounts. If you choose to provide such information and personal data during registration or other scenarios, it constitutes your consent for our company to use, share, and store this information and personal data in accordance with the relevant provisions of this Privacy Policy.

1.4 Mobile Data When Using the Application
When you use our application, in order to ensure that you can enjoy our financial services normally and to provide necessary data support for the anti-fraud system, we will collect and synchronize the following relevant information with your prior consent:

1.4.1 SMS Permission
Purpose of Permission: To complete identity verification, account security verification, and delivery of loan-related notifications, we will access your SMS content after obtaining your explicit authorization. This permission is only used to read verification and notification SMS messages related to Surehela services. It will not actively scan or read your other private SMS messages.

Data Usage: We only extract core content from SMS messages, such as verification codes and notification information, for identity verification, account security checks, and business process advancement. We will not store your complete SMS content, and the extracted information will be promptly deleted after verification.

Data Security: All SMS-related data is transmitted and processed using encryption technology, strictly adhering to data protection regulations. We will not share your SMS information with any unauthorized third parties and will only use the data within the scope of your authorization.

1.4.2 Rough Location Permission
Purpose of Permission: We request your rough location permission to understand your approximate geographical distribution in order to optimize service adaptability, prevent cross-regional fraud risks, and provide you with more localized financial service suggestions. We will not collect your precise location information.

Data Usage: We only collect your approximate geographical information (such as city and region) for service optimization, risk management, and localized service adjustments. We do not associate it with your personal identity information for location tracking, nor do we store your location trajectory.

Data Security Guarantee: Preliminary location data is transmitted encrypted, and storage time is strictly controlled within necessary limits. Your location information will never be shared with any third party without your explicit consent, ensuring your location privacy and security.

1.4.3 Camera Permissions

Purpose of Permission: With your authorization, we will access your camera permissions, primarily for identity verification (such as taking photos of ID cards and facial recognition), uploading on-site photos when providing feedback, and completing loan-related document verification to facilitate faster business processes.

Data Usage: Camera footage will only be used for identity verification, document review, and problem feedback processing. After shooting, only necessary image data related to business will be retained; irrelevant images will be deleted in real time, and the retained data will be strictly controlled for storage periods in accordance with data protection regulations.

Data Security Guarantee: All image data taken by the camera is transmitted and stored encrypted, managed by a trusted and secure system, and will not be used for purposes unrelated to the service, nor will any image data be shared with any unauthorized third parties.

1.4.4 Device Permissions

Purpose of Permissions: We need to obtain your device permissions to collect basic device information, including operating system type, system version, IMEI number, IMSI number, MAC address, device serial number, Android ID, screen size, and other hardware and system information. This information is used to identify the device, prevent device counterfeiting, block unauthorized operations, and ensure account and transaction security.

Purpose of Data: With your authorization, this device information will be used to verify device authenticity, monitor abnormal logins and fraudulent activities, ensure device security when you use the service, provide data support for the anti-fraud system, and ensure stable service operation.

Data Security Guarantee: We promise that we will never share your device data with any third party without your explicit permission. All device information is encrypted and uploaded via an HTTPS server (https://surehela.com), ensuring secure data transmission throughout the process and strictly complying with relevant data protection regulations.

1.4.5 Application List Information

Purpose of Permission: After obtaining your authorization, we will collect application list information on your device, primarily for identifying the device's operating environment, detecting abnormal applications (such as malicious and fraudulent applications), preventing account security risks, and ensuring the security of your environment when using Surehela services.

Data Usage: Only application names and installation status are collected. No content, data, or usage records within the applications are read. It is used solely for risk identification and environmental security detection, and not for any other unrelated purposes. The data retention period will not exceed the length necessary for business operations.

Data Security Guarantee: Application list information is transmitted and stored in an encrypted manner to strictly protect your privacy. Your application list information will not be shared with any third party. All data processing activities are conducted within the scope of your explicit authorization.

1.4.6 Advertising ID Statement
Purpose of Permission: We may obtain your device's advertising ID, primarily for pushing financial service-related advertisements and activity information more tailored to your needs, optimizing advertising effectiveness, and improving your service experience. You can choose whether to allow this permission.

Data Usage: The advertising ID is only used for advertising optimization, is not associated with your personal identification information, and will not be used for other business purposes. You can disable Ad ID authorization in your device settings. Disabling it will prevent us from pushing personalized ads based on your Ad ID and will not affect your use of core services.

Data Security: The collection and use of Ad IDs strictly comply with relevant laws and platform regulations. We will not disclose your Ad ID and associated information to any third party. You can revoke authorization at any time through your device settings, and we will immediately cease collecting and using the relevant data.

All permissions we request are strictly matched to the financial service functions we provide and are only necessary to achieve the service purpose and ensure service security. If our business functions are adjusted, the requested device permissions will also be optimized and adjusted accordingly. When requesting permissions from you for the first time, we will ask you separately whether you agree to enable them and explain the specific purpose of the permission request in detail to ensure that you fully understand and make your own choice. Please note that enabling the relevant permissions means that you authorize us to collect and use the corresponding personal information to achieve the above-mentioned service functions; if you choose to disable the permissions, the relevant authorization will be automatically cancelled, and we will no longer collect your relevant personal information or provide you with the service functions corresponding to that permission. However, the decision to disable permissions will not affect our personal information processing operations based on your previous authorization.

How We Use Your Personal Information

To comply with relevant national laws and regulations and the requirements of regulatory authorities, provide you with high-quality and stable services, continuously improve service quality, and protect your account and financial security, we will reasonably use your personal information in the following scenarios:

1. To achieve the collection purposes described in the "How We Collect Your Personal Information" section of this policy, ensuring that the collected information is highly matched to its intended use and will not be used for irrelevant scenarios.

2. To ensure the stability and security of our services, we will use your personal information for identity verification, security protection, fraud monitoring, prevention and prohibition of illegal activities, risk control, data archiving and backup, etc., to fully protect your account security.

3. To keep you informed of the service usage status, we will send you various service reminders to ensure you can clearly understand the service progress, account dynamics, and other relevant information.

4. In accordance with the requirements of laws, regulations, and regulatory authorities, we will truthfully report your relevant information to the relevant competent authorities and fulfill our legal information disclosure obligations.

5. To invite you to participate in customer surveys related to our services, collect your opinions and suggestions, and provide reference for service optimization.

6. To improve, enhance, and optimize Surehela's online financial services, taking into account your usage habits and needs to improve service adaptability and convenience.

7. To process your applications, inquiries, or feedback requests regarding Surehela products and/or services, responding efficiently to your needs and resolving any issues you encounter during use.

8. We will anonymize your personal data using technical means. The anonymized data will be unable to identify the specific data subject. Please understand and agree that, under these circumstances, we have the right to reasonably use such anonymized information; at the same time, we have the right to conduct statistical analysis of the user database without disclosing any of your personal information and to use the analysis results for commercial purposes.

Furthermore, we may conduct statistical analysis of the collected personal information to provide solid data support for service optimization, risk management, and business development.

We may conduct statistical analysis of the usage of our products and/or services and may share such statistical data with the public or third parties to demonstrate the overall usage trends of our products and/or services. However, it must be clearly stated that such statistical data does not contain any personally identifiable information and will not disclose your privacy.

If we plan to use your personal information for purposes not covered by this policy, or to redirect information collected for a specific purpose to other uses, we will obtain your explicit consent beforehand. Please understand that the products and/or services we provide to you are continuously updated and iterated. If you choose to use other products and/or services not listed in this policy, we will explain the purpose, method, and scope of information collection to you in detail before collecting your personal information, and obtain your explicit authorization. If you refuse to provide relevant information, you may not be able to use that specific service, but this will not affect your normal use of our other services.

When we need to display your personal information, we will use methods such as content replacement and anonymization to reduce the sensitivity of the information, maximize the security of your personal information, and avoid the risk of information leakage.

How We Use Cookies and Similar Technologies

3.1 Use of Cookies

To provide you with a more convenient browsing experience, we sometimes store small data documents called cookies on your computer or mobile device. A cookie is a plain text file stored on your device by a web server, and only the server that created the cookie can retrieve and read it. Each cookie is uniquely associated with your web browser or mobile application and typically contains an identifier, a website name, and several numbers and characters. Cookies allow websites to remember a user's single visit (using session cookies) or multiple visits (using persistent cookies), and also save your device settings, such as language, font size, and other browsing preferences, so you don't have to reconfigure these preferences each time you visit. If a website does not use cookies, you will be treated as a new visitor each time you open a page. For example, if you log in to the website and then switch to another page, the website will not be able to recognize your identity, and you will be logged out again.

To provide you with more convenient and personalized services, we will provide the following services through cookies and other related technologies:

(1) Remember your account information: For example, when you access information or services that require login, we will encrypt your login name and store it.

Cookies are stored in your computer's cookie file. Because they are stored using irreversible encryption, even if someone else uses your computer, they cannot identify your login name. All collection, storage, and encryption operations are completed automatically by the system; you do not need to perform any additional operations. Cookies help you avoid repeatedly entering account information when using our services, improving ease of use.

(2) Analyzing your service usage: For example, we may use cookies and web beacons to understand your usage of our services and the types of pages or services you prefer, providing data for service optimization.

(3) Optimizing advertising delivery: We may show you products or advertisements that may interest you based on statistics of your website visits. Such statistics do not contain any personally identifiable information and are only used to evaluate the effectiveness of advertising. Through cookies and web beacons, we can provide you with more targeted and relevant advertisements, rather than generic advertisements.

(4) Collecting anonymized access data: We may also use web beacon technology to collect anonymized access data. Again, such statistics do not contain any of your personal information and are only used for service analysis and optimization.

We will not use cookies for any other purpose than those expressly stated in this policy. You can manage or delete cookies at any time using the cookie clearing function of your browser or operating system software, according to your preferences. You can also clear all cookies stored on your device. Most web browsers automatically accept cookies, but you can usually modify your browser settings to refuse or delete cookies as needed. Note that if you choose to refuse or delete cookies, you may need to manually adjust your user settings each time you visit our website, which may affect the security and convenience of your use of the services, but will not affect your normal use of other services we provide.

3.2 Use of Web Beacons, Pixel Tags, and Similar Technologies In addition to cookies, we also use web beacons, pixel tags, and other similar technologies on our website. For example, emails we send you may contain clickable URLs pointing to content on our website. If you click on this link, we will track this click to understand your product and service preferences and improve customer service. Web beacons are typically transparent images embedded in websites or emails. Pixel tags in emails allow us to know whether an email has been opened. If you do not wish to have your activity tracked in this way, you can unsubscribe at any time.

How We Retain, Share, Transfer, and Disclose Your Personal Information

4.1 Retention of Personal Data
We retain your personal data only for the period necessary to achieve the purposes described in this Privacy Policy. We retain and use your personal data in accordance with legal obligations (e.g., to comply with applicable laws), to resolve related disputes, and to fulfill our legal agreements and policies.

We also retain data for internal analysis purposes. Such data is typically retained for a shorter period unless it is used to improve security, optimize our service functions, or if we are legally required to retain such data for a longer period. Generally, we will retain your data for a maximum of one year after you cease using our services, after which the data will be deleted or anonymized.

4.2 Sharing Your Personal Information
We may share your personal information in the following specific scenarios, and all sharing activities strictly comply with this Privacy Policy and relevant laws and regulations:

1. Sharing with Service Providers: We may share your personal information with our partner service providers to assist us in monitoring and analyzing service usage, and in contacting you and providing related service support.

2. Sharing with Affiliated Companies: We may share your information with our affiliated companies. In this case, we will explicitly require such affiliated companies to strictly comply with the relevant provisions of this Privacy Policy. Affiliated companies include our parent company, all subsidiaries, joint venture partners, and other enterprises that we control or jointly control.

3. Sharing with Business Partners: We may share your information with our business partners to provide you with specific products, services, or promotional activities, and to enhance your service experience.

4. Sharing with Other Users: When you post personal information in public areas or interact with other users, all users can view that information, and it may be disseminated externally by users. If you interact with other users or complete registration through third-party social media services, the contacts on those third-party services may see your name, profile, photo, and activity description; similarly, other users can also view the activities you describe, communicate with you, and view your profile.

5. Sharing with Your Consent: With your explicit consent, we may disclose your personal information for other purposes approved by you.

4.3 Transfer of Personal Data

Except in the following special circumstances, we will not transfer your personal information to any company, organization, or individual:

1. We will transfer your personal information to a designated party after obtaining your explicit consent;

2. We are required to transfer your personal information in accordance with applicable laws and regulations, legal procedures, or mandatory administrative or judicial requirements;

3. In the event of a merger, acquisition, bankruptcy liquidation, or other similar event involving the transfer of personal information, we will require the new company or organization receiving your personal information to continue to comply with this Privacy Policy, or require them to obtain your explicit authorization again before using the relevant personal information.

4.4 Public Disclosure of Personal Data

We will only publicly disclose your personal information in the following circumstances:

1. We will disclose the personal information you specify in a manner approved by you after obtaining your explicit consent;

2. We may disclose your personal information in cases of legal requirements, legal procedures, litigation, or mandatory government requirements. Subject to compliance with laws and regulations, when we receive such disclosure requests, we will require the other party to provide relevant legal documents (such as subpoenas, investigation letters, etc.). We believe that, within the scope permitted by law, information disclosure requests should be as transparent as possible. We will rigorously review all requests to ensure they have a legal basis and are limited to law enforcement agencies for specific investigative purposes, and that they have legal data access permissions.

4.5 Exceptions to the Sharing, Transfer, or Public Disclosure of Personal Information Without Prior Authorization

According to relevant laws, regulations, and national standards, we may share, transfer, or publicly disclose your personal information without prior authorization in the following circumstances:

1. Fulfilling legal obligations stipulated by laws and regulations;

2. Directly involving national security or defense security;

3. Directly involving public safety, public health, or significant public interests;

4. Directly involving criminal investigation, prosecution, trial, and execution of judgments;

5. To protect your or others' significant legitimate rights and interests (such as life and property safety), and it is difficult to obtain your consent;

6. Personal information that you have voluntarily disclosed to the public;

7. Personal information collected from legally publicly disclosed information, such as legitimate news reports or information released through government information disclosure channels.

How We Protect Your Personal Information

We highly value the security of your personal information and have taken all reasonable and feasible measures to comprehensively protect your personal data security and prevent various information security risks. The following are our specific technical and operational protection measures:

5.1 Data Security Technical Measures

We adopt industry-standard security protection measures and general security technologies to effectively prevent your personal information from being accessed, modified, leaked, damaged, or lost without authorization. Specific measures are as follows:

1. Encryption Technology: We use encryption technology to securely store your personal information. Simultaneously, through a comprehensive security management system, standardized security policies and processes, and a reasonable network architecture, we comprehensively protect your transaction security and personal information security.

2. Network Security: Our network services use encryption technologies such as Transport Layer Security (TLS) and HTTPS to provide you with secure browsing and usage services, ensuring that your personal information is not illegally intercepted or tampered with during transmission, thus guaranteeing transmission security.

3. Data Anonymization: When using your personal information (such as in information display, related calculations, etc.), we will use various data anonymization technologies such as content replacement and hash processing to reduce information sensitivity and further enhance the security of personal information during use.

4. Malware Protection: We have built a comprehensive malware protection system using various methods, including white-box code security testing, black-box security testing, and intrusion detection and prevention technologies, to effectively resist malicious code attacks and protect your personal information from infringement.

5.2 Other Personal Information Protection Security Measures
We comprehensively regulate and strictly manage the storage and use of personal information through data classification management, layered control, clear data security management standards, and standardized secure development processes. Specific measures are as follows:

1. Access Control: We implement a strict data access control mechanism and multi-factor authentication process to comprehensively protect personal information security. At the same time, we sign strict confidentiality agreements with information access personnel and implement comprehensive security control through a sound monitoring and auditing mechanism to prevent unauthorized access and use of information.

2. Security Audit: We conduct personal information security audits through code security checks and data access log analysis to promptly identify and prevent security risks, ensuring that personal information processing procedures are compliant and secure.

3. Information Security Committee: We have formally established an Information Security Committee and a dedicated security team to coordinate and promote personal information security-related work and ensure the implementation of various protection measures.

4. Security Training: We regularly conduct security and privacy protection training to strengthen employees' awareness of the importance of personal information protection, improve their security awareness and operational standards, and build a solid information security defense from a personnel perspective.

5.3 Security Incident Handling

1. Security Assurance: The internet environment is not absolutely secure. We will make every effort to ensure the security of all information you send to us. If our physical, technical, or managerial protection measures are breached, resulting in unauthorized access, disclosure, alteration, or destruction of your personal information and affecting your legitimate rights and interests, we will bear corresponding legal responsibility in accordance with the law.

2. Incident Notification: In the event of a personal information security incident, we will inform you of the basic situation of the incident, the possible impact, the countermeasures already taken and planned, self-protection and risk reduction suggestions, and relevant remedial measures as soon as possible. We will notify you through appropriate means such as email, letter, telephone, and push notifications; if it is difficult to notify every affected user individually, we will issue a public announcement in a reasonable and effective manner. At the same time, we will report relevant security incidents in a timely manner as required by regulatory agencies.

3. Contact Us: If you discover that your personal information (especially your account and password) has been leaked, please contact us immediately using the contact information provided at the end of this policy so that we can take appropriate protective measures to reduce security risks.

5.4 How We Store and Retain Your Personal Information

1. Retention Period: We will retain your personal information only for the period necessary to achieve the purposes described in this policy, and for the period stipulated by laws, regulations, and regulatory requirements. To protect your consumer rights, unless otherwise expressly provided by laws and regulations, we will retain your personal information for a maximum of one month after your account is cancelled; after this period expires, we will delete or anonymize your personal information to completely eliminate the risk of information leakage.

2. Service Termination: If you stop using our services, we will immediately stop collecting and using your personal information, unless otherwise stipulated by laws, regulations, or regulatory agencies. If we plan to terminate our services or cease operations, we will notify you at least thirty days in advance; after the formal termination of services or operations, we will promptly delete or anonymize your personal information to ensure information security.

Your Rights

Surehela highly values your concerns and requests regarding your personal information. In accordance with relevant Kenyan laws, regulations, and standards, we are committed to ensuring that you can legally exercise the following rights regarding your personal information:

6.1 Accessing Your Personal Information

Unless otherwise expressly provided by laws and regulations, you have the right to access your personal information at any time. If you wish to exercise this right, you can obtain the relevant information through the following designated paths:

1. Your application information: Access path within the mobile application: Billing page - My Application Status Inquiry.

2. Your transaction information: Access path within the mobile application: Billing page - My Bills and Other Historical Transaction Information.

If you are unable to access your personal information normally through the above paths, you can contact us using the methods provided in the "How to Contact Us" section of this policy. We will respond to your access request within 15 business days and complete identity verification and related processing.

For other personal information generated during your use of our products or services, we will provide it to you as long as it does not require excessive cost and effort. If you need to access such information, you can contact us using the methods provided in the "How to Contact Us" section of this policy, and we will cooperate in accordance with the law.

6.2 Correction/Deletion of Your Personal Information

If you discover any errors in the personal information we process about you, you have the right to request our correction. You can submit a correction request through the methods listed in the "6.1 Accessing Your Personal Information" section of this policy. If you are unable to complete the correction through the above methods, you can contact us through the methods provided in the "How to Contact Us" section of this policy. We will respond to your correction request within 15 business days and complete the verification and processing.

Deletion of Your Personal Information: You may call our customer service center to request the deletion of your personal information in the following circumstances:

1. Our processing of your personal information violates relevant laws and regulations;

2. We have collected or used your personal information without your consent;

3. Our processing of your personal information violates any relevant agreements signed with you.

Upon receiving your deletion request, we will process it in accordance with your request and relevant laws and regulations, and promptly provide you with feedback on the processing results. If we decide to grant your deletion request, we will also notify all relevant entities that have obtained your personal information, requiring them to immediately delete your personal information, unless otherwise stipulated by laws and regulations, or such entities have obtained your independent authorization.

Please note that after you delete your personal information from our services, this information may not be immediately deleted from our backup system. However, we will complete the deletion process synchronously when the backup system is updated.

You can also revoke our authorization to continue collecting your personal information by canceling your account.

Account Cancellation: You can directly apply to cancel your account, cancel Surehela financial services, or cancel specific service functions you have subscribed to within our products and/or services. You can complete account cancellation through the "My - Account Cancellation" path in the mobile application, or...