Data Protection
01Our commitment
AfrikCap is operated by AFRISKY CONNECT LTD in Kampala, Uganda. Protecting the personal data of borrowers, lending partners, agents and website visitors is central to how we work.
This notice explains how we meet our obligations under the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021. It should be read together with our Privacy Policy.
02Registration with the PDPO
AfrikCap is registered with the Personal Data Protection Office (PDPO), the regulator responsible for data protection in Uganda. Our registration covers the collection and processing of personal data for loan sourcing and facilitation.
03Data protection principles
We handle personal data in line with the principles set out in the Act. We:
- Collect data only for a clear, lawful purpose that we explain to you.
- Collect only the data we need for that purpose.
- Keep data accurate and up to date.
- Keep data only for as long as we need it.
- Protect data against loss, misuse and unauthorised access.
- Are accountable for how data is used, including by the partners we share it with.
04Data Protection Officer
We have appointed a Data Protection Officer (DPO) who oversees our compliance with the Act, trains our staff and agents, and is your point of contact for any data protection question. You can reach the DPO at [email protected].
05How to exercise your rights
You have the right to access, correct or delete your personal data, to object to its use and to withdraw your consent. To make a request:
- Email [email protected] or call +256 704 924 290.
- Tell us your name, phone number and what you would like us to do.
- We may ask you to confirm your identity before we act on the request.
- We will respond within 30 days. There is no charge for a reasonable request.
06Sharing with lending partners
We only share your data with a lender after you have given consent. Every lending partner signs a data sharing agreement with us that requires them to protect your data to the standard set by the Act, to use it only to assess and manage your loan, and not to pass it on without a lawful basis.
07Service providers
We use a small number of trusted service providers for hosting, communication and customer support. They process data only on our written instructions, under contracts that require appropriate security and confidentiality.
08Security measures
- Encryption of data in transit and at rest.
- Role-based access, so staff and agents only see what they need.
- Secure, managed devices for field agents.
- Regular security reviews and staff training.
- Logging and monitoring of access to personal data.
09Data breaches
If a personal data breach puts your rights at risk, we will notify the PDPO without delay, as required by the Act. Where appropriate, we will also tell you what happened, what data was affected and what steps you can take to protect yourself.
10Transfers outside Uganda
Where any of our service providers process data outside Uganda, we only transfer it where the destination offers an adequate level of protection, or where suitable safeguards are in place, as required by the Act.
11Children
Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact us and we will delete it.
12Complaints
If you are unhappy with how we have handled your data, please contact our Data Protection Officer first so we can put it right. If you are still not satisfied, you have the right to complain to the Personal Data Protection Office (PDPO).