Privacy Policy

Welcome to SplitPay.

SplitPay is a technology platform that enables businesses ("Merchants") to offer installment payment plans to customers ("Customers"), while providing a secure platform for payment management, transaction tracking, identity verification, and financial record keeping.

Your privacy is important to us.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information whenever you use:

• the SplitPay mobile application
• the SplitPay website
• the Merchant Dashboard
• customer support services
• APIs
• payment services; and
• any other products or services operated by SplitPay (collectively, the "Platform")

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

SplitPay is committed to protecting your personal information and processing it responsibly.

We are guided by the principles of:

• lawfulness
• fairness
• transparency
• purpose limitation
• data minimization
• accuracy
• storage limitation
• integrity
• confidentiality; and
• accountability

Where applicable, SplitPay seeks to comply with the Kenya Data Protection Act, 2019, related regulations, and other applicable privacy laws governing our operations.

This Privacy Policy applies to:

• Customers
• Merchants
• business representatives
• administrators
• website visitors
• prospective users
• applicants for Merchant accounts
• customer support users; and
• anyone interacting with SplitPay services

This Privacy Policy applies regardless of whether you access the Platform through:

• Android applications
• iOS applications
• desktop browsers
• mobile browsers; or
• integrated third-party services

For purposes of this Privacy Policy:

Personal Information means information that identifies or can reasonably identify an individual.

Sensitive Personal Data includes information such as government identification numbers, biometric information where collected, financial information, and KYC documentation.

Merchant means an approved business using SplitPay.

Customer means an individual using SplitPay to manage installment purchases.

Processing includes collecting, storing, organizing, transmitting, analyzing, updating, deleting, or otherwise handling personal information.

Depending on how you use SplitPay, we may collect different categories of information.

A. Identity Information

This may include:

• Full legal name
• National ID Number
• Passport Number (where applicable)
• Date of birth
• Gender (where required)
• Profile photograph (optional)
• Signature (where applicable)

B. Contact Information

We may collect:

• Mobile phone number
• Email address
• Physical address
• County
• Postal address
• Customer support contact history

C. Merchant Information

Where you register as a Merchant, we may collect:

• Registered business name
• Business registration number
• Tax information
• KRA PIN
• Business address
• Business phone number
• Business email
• Social media profiles
• Company ownership information
• Authorized representative details

D. Financial Information

Depending on Platform usage, we may collect:

• Installment balances
• Payment schedules
• Payment history
• Transaction references
• Outstanding balances
• Payment frequency
• Merchant identifiers
• Refund information
• Payment confirmations

SplitPay does not intentionally collect or store complete payment card numbers unless required by an authorized payment processor.

E. KYC Documentation

Where required, Customers or Merchants may upload documents including:

• National ID
• Passport
• KRA PIN Certificate
• Bank statements
• Utility bills
• Certificate of Good Conduct
• Business registration certificates
• CR12 documents
• Other compliance documentation requested by Merchants or required by law

F. Device Information

When you use the Platform, we may automatically collect information including:

• Device model
• Operating system
• App version
• Browser type
• Device identifiers
• IP address
• Network provider
• Language settings
• Time zone
• Crash reports

G. Usage Information

We collect information about how you interact with SplitPay, including:

• Login activity
• Session duration
• Pages visited
• Features used
• Search activity
• Button clicks
• Navigation patterns
• Error logs

This helps us improve user experience and platform performance.

H. Location Information

Where permitted by your device settings and applicable law, we may collect:

• Approximate location
• GPS location
• Country
• Region
• County

Location information may be used for:

• fraud prevention
• account security
• regulatory compliance
• improving user experience

You may disable precise location permissions through your device settings where supported.

I. Communications

We may retain communications you send to us, including:

• emails
• live chat messages
• customer support tickets
• WhatsApp conversations (where applicable)
• SMS messages
• feedback
• surveys

These communications help us resolve disputes, improve our services, and maintain service quality.

When you access the Platform, certain information is collected automatically through technical means.

This may include:

• browser information
• device characteristics
• IP address
• pages visited
• timestamps
• referring URLs
• clickstream data
• cookies
• analytics data
• diagnostic information

This information is generally used for security, performance optimization, fraud detection, and service improvement.

We may receive information about you from trusted third-party providers including:

• identity verification providers
• payment processors
• mobile money operators
• government databases (where legally authorized)
• fraud prevention partners
• analytics providers
• business verification services

We only use such information where legally permitted and necessary for providing or securing our services.

We collect information in several ways.

A. Information You Provide

Information you voluntarily submit when:

• creating an account
• completing your profile
• applying for Merchant approval
• uploading KYC documents
• making payments
• contacting support
• responding to surveys

B. Information Generated Through Your Use

As you interact with SplitPay, we automatically generate records relating to:

• payments
• installment schedules
• product applications
• account activity
• payment confirmations
• support interactions

C. Information From Payment Providers

Where payments are made through integrated payment providers, we may receive:

• payment confirmations
• transaction references
• payment status
• timestamps
• settlement information

D. Information From Identity Verification Services

Where identity verification is required, SplitPay may receive verification results from authorized verification providers.

Depending on applicable law and available integrations, this may include confirmation that submitted identity information matches official records.

SplitPay may provide optional features allowing Customers to securely store documents in a personal document vault.

Examples include:

• National ID copies
• KRA PIN certificates
• bank statements
• utility bills
• compliance documents

These documents remain under your control.

Except where required by law or with your explicit action, documents stored in your vault are not automatically shared with Merchants or other third parties.

You may, subject to applicable legal and operational requirements:

• upload new documents
• replace existing documents
• download copies
• remove documents from your vault

You are responsible for ensuring that the information you provide to SplitPay is:

• accurate
• complete
• current; and
• not misleading

Providing false or fraudulent information may result in suspension, termination of your account, or other actions permitted by law or our Terms & Conditions.

SplitPay processes personal information only for legitimate business purposes and in accordance with applicable law.

We may use your information to:

• create and manage your account
• verify your identity
• approve Merchant applications
• process installment payment transactions
• facilitate communication between Customers and Merchants
• maintain accurate payment records
• provide customer support
• improve Platform functionality
• personalize your experience
• detect and prevent fraud
• investigate suspicious activity
• comply with legal obligations
• enforce our Terms and Conditions
• respond to lawful requests from regulatory authorities; and
• develop new products and services

We do not sell your personal information to third parties.

Where required by applicable law, SplitPay processes your personal information based on one or more of the following legal grounds:

A. Performance of a Contract

We process your information where necessary to:

• create your account
• process installment payments
• facilitate transactions
• manage Merchant relationships
• provide Platform features

B. Legal Obligations

We may process your information to comply with legal and regulatory obligations, including:

• identity verification requirements
• fraud prevention
• anti-money laundering obligations where applicable
• tax reporting
• lawful requests from government authorities
• court orders
• regulatory investigations

C. Legitimate Business Interests

We may process personal information where reasonably necessary to:

• improve Platform performance
• secure user accounts
• detect fraud
• conduct analytics
• troubleshoot technical issues
• develop new services
• protect our legal rights

We ensure that these interests do not override your fundamental rights and freedoms.

D. Your Consent

Certain processing activities rely on your consent.

These may include:

• receiving promotional communications
• enabling location services
• optional document storage
• optional marketing surveys
• certain cookie preferences

You may withdraw your consent at any time where legally permitted.

To protect Customers, Merchants, and the integrity of the Platform, SplitPay may perform Know Your Customer ("KYC") verification.

Verification may include:

• validating your National ID
• verifying your mobile phone number
• verifying your email address
• reviewing uploaded documents
• confirming business registration details
• confirming authorized Merchant representatives

Identity verification helps us:

• prevent identity theft
• reduce fraud
• comply with legal obligations
• protect Customers and Merchants

Documents uploaded to SplitPay may be reviewed for authenticity and validity.

Verification may include:

• confirming document completeness
• detecting expired documents
• reviewing image quality
• identifying inconsistencies
• verifying ownership where reasonably necessary

SplitPay reserves the right to request updated documentation if previously submitted information becomes outdated or no longer satisfies regulatory or operational requirements.

Protecting our users from fraud is a core part of our services.

SplitPay may use personal information to:

• identify suspicious transactions
• detect unusual login behaviour
• identify duplicate accounts
• investigate unauthorized payments
• detect account takeovers
• prevent payment abuse
• identify forged documents
• protect Merchants from fraudulent purchases

Where fraud is suspected, SplitPay may:

• temporarily restrict an account
• delay a transaction
• request additional verification
• investigate account activity
• report suspected criminal activity to the appropriate authorities where legally required or permitted

SplitPay processes information necessary to facilitate installment payments and maintain accurate transaction records.

Depending on the payment method used, we may process:

• payment amounts
• payment references
• payment dates
• transaction status
• Merchant identifiers
• Customer identifiers
• settlement information

Payment processing may involve trusted third-party payment providers.

SplitPay does not intentionally store sensitive payment credentials such as full debit or credit card numbers unless required through an approved payment processing partner operating under applicable security standards.

SplitPay may use automated systems to assist in identifying:

• potentially fraudulent transactions
• unusual account activity
• duplicate registrations
• high-risk payment patterns
• suspicious login attempts

These automated processes help improve Platform security.

Where automated processing significantly affects your rights, you may request that the decision be reviewed by an appropriate member of our team, subject to applicable law.

We may contact you regarding your account and use of the Platform.

These communications may include:

• payment reminders
• transaction confirmations
• account verification notices
• password reset instructions
• customer support responses
• important policy updates
• security alerts
• regulatory notices

These service communications are necessary for operating the Platform and generally cannot be opted out of while your account remains active.

With your consent where required, SplitPay may send:

• newsletters
• promotional offers
• feature announcements
• educational content
• surveys
• product updates

You may unsubscribe from marketing communications at any time by:

• selecting the unsubscribe link in our emails
• adjusting your notification preferences within the Platform; or
• contacting SplitPay customer support

Opting out of marketing communications will not affect essential service-related communications.

SplitPay shares personal information only where necessary to operate the Platform, comply with legal obligations, or with your authorization.

We do not sell personal information to advertisers or unrelated third parties.

Where you choose to purchase goods or services from a Merchant using SplitPay, we may share information necessary to facilitate the transaction.

Depending on the transaction, this may include:

• your name
• contact information
• payment status
• installment schedule
• verification status
• information you expressly choose to share from your document vault

Documents stored in your vault are not automatically shared with Merchants. Any sharing of optional documents is initiated by you unless disclosure is required by law.

SplitPay may engage trusted service providers who process information on our behalf, including providers of:

• payment processing
• cloud hosting
• data storage
• customer support
• analytics
• messaging services
• email delivery
• SMS notifications
• fraud detection
• identity verification
• cybersecurity services

These providers are required to process personal information only for authorized purposes and under appropriate confidentiality and security obligations.

SplitPay may disclose personal information where required or permitted by law, including in response to:

• court orders
• lawful requests from government agencies
• regulatory investigations
• law enforcement requests
• legal proceedings

Where legally permitted, we may notify affected users before disclosing their information.

If SplitPay undergoes:

• a merger
• acquisition
• corporate restructuring
• investment transaction; or
• sale of assets,

personal information may be transferred as part of that transaction, subject to applicable legal safeguards.

Users will be notified where required by applicable law.

SplitPay may create aggregated or anonymized datasets that do not identify individual users.

These datasets may be used to:

• improve our services
• analyze platform performance
• understand user trends
• develop new features
• support research and reporting

Anonymized information cannot reasonably be used to identify you.

SplitPay uses cookies and similar technologies to improve the functionality, security, and performance of the Platform.

Cookies are small text files stored on your device when you visit our website or use certain Platform features.

Depending on your browser or device settings, we may use:

• session cookies
• persistent cookies
• authentication cookies
• security cookies
• analytics cookies
• preference cookies

Cookies help us:

• keep you signed in
• remember your preferences
• improve website performance
• understand user behaviour
• detect fraud
• maintain Platform security

You may disable certain cookies through your browser settings. However, doing so may affect the functionality of some Platform features.

SplitPay may use analytics tools to better understand how users interact with the Platform.

Analytics information may include:

• pages viewed
• session duration
• navigation paths
• device information
• application performance
• crash reports
• feature usage

Analytics data helps us:

• improve user experience
• identify software issues
• measure Platform performance
• develop new features

Where reasonably possible, analytics information is aggregated or anonymized.

Protecting your information is one of SplitPay's highest priorities.

We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, or destruction.

Security measures may include:

• encryption of data in transit using industry-standard protocols
• encryption of sensitive data at rest where appropriate
• role-based access controls
• multi-factor authentication for administrative accounts
• secure password storage
• audit logging
• network monitoring
• intrusion detection systems
• routine software updates
• vulnerability management procedures
• regular security assessments

Despite these safeguards, no electronic system or internet transmission can be guaranteed to be completely secure. Users should also take reasonable steps to protect their devices, passwords, and account credentials.

You are responsible for maintaining the confidentiality of your account credentials.

You agree to:

• choose a strong password
• keep your login credentials confidential
• avoid sharing one-time verification codes
• sign out from shared devices
• promptly notify SplitPay of suspected unauthorized access

You are responsible for activities conducted through your account until you notify SplitPay of unauthorized use.

SplitPay retains personal information only for as long as necessary to:

• provide our services
• comply with legal obligations
• resolve disputes
• enforce our agreements
• prevent fraud
• satisfy regulatory requirements

The retention period depends on the type of information and the purpose for which it was collected.

For example, we may retain:

• account information while your account remains active
• transaction records for periods required by applicable financial, tax, or regulatory laws
• customer support records for quality assurance and dispute resolution
• KYC documentation for the period required by applicable legal or compliance obligations

When personal information is no longer required, it will be securely deleted, anonymized, or otherwise disposed of in accordance with applicable law.

SplitPay may use service providers located outside Kenya to support Platform operations, including cloud hosting, data storage, analytics, and customer communications.

Where personal information is transferred internationally, SplitPay will implement appropriate safeguards to ensure that your information continues to receive an adequate level of protection consistent with applicable law.

Subject to applicable law, you may have the right to:

• request access to your personal information
• request correction of inaccurate information
• request deletion of personal information where legally permissible
• request restriction of certain processing activities
• object to certain processing
• withdraw consent where processing is based on consent
• receive your personal information in a portable format where technically feasible
• lodge a complaint with the relevant data protection authority

Certain rights may be limited where retention or processing is required by law, contractual obligations, or legitimate business purposes.

You may update certain account information directly through your SplitPay account.

If you cannot update your information through the Platform, you may contact SplitPay using the contact details provided below.

We may request identity verification before processing requests relating to your personal information.

You may request closure of your SplitPay account at any time.

Account deletion requests are subject to legal and operational requirements, including the retention of certain records for:

• financial reporting
• fraud prevention
• regulatory compliance
• dispute resolution
• legal obligations

Closing your account does not automatically result in the deletion of all information where retention is required by law.

SplitPay is not intended for individuals under the age of eighteen (18), or the age of majority applicable under relevant law.

We do not knowingly collect personal information from children.

If we become aware that personal information has been collected from a child without appropriate legal authorization, we will take reasonable steps to delete such information promptly.

Parents or legal guardians who believe a child has provided personal information should contact us immediately.

The Platform may contain links to third-party websites, payment providers, or services.

This Privacy Policy applies only to SplitPay.

We are not responsible for the privacy practices, content, or security of third-party websites or services.

Users are encouraged to review the privacy policies of any third-party services they access.

SplitPay may update this Privacy Policy from time to time to reflect:

• changes in applicable law
• regulatory requirements
• new Platform features
• security enhancements
• operational improvements

Where material changes are made, we will provide notice through appropriate channels, which may include:

• in-app notifications
• email
• website announcements; or
• other reasonable methods

The "Last Updated" date at the top of this Privacy Policy indicates when the latest version became effective.

Continued use of the Platform after the effective date of any revised Privacy Policy constitutes acknowledgment of the updated Policy.

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal information, you may contact SplitPay through the contact information published on our official website or within the mobile application.

If SplitPay appoints a Data Protection Officer or other designated privacy contact, their details will also be published through our official communication channels.

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the Republic of Kenya.

Nothing in this Privacy Policy limits any rights you may have under applicable data protection legislation or other laws.

If any provision of this Privacy Policy is determined to be invalid or unenforceable by a court or competent authority, the remaining provisions shall continue in full force and effect.

This Privacy Policy constitutes the entire privacy notice governing the collection, use, disclosure, and protection of personal information by SplitPay in connection with the Platform.

It should be read together with:

• the SplitPay Terms and Conditions
• any Cookie Policy published by SplitPay
• any supplemental privacy notices provided for specific services

By creating a SplitPay account, accessing the Platform, or using any SplitPay services, you acknowledge that:

• you have read this Privacy Policy
• you understand how your personal information is collected and processed
• you understand your privacy rights
• you consent to the processing of your information where consent is the applicable legal basis; and
• you agree to the practices described in this Privacy Policy