Seanala.

Privacy and data protection

Your information, handled responsibly.

This notice explains what information Seanala handles, why it is needed, who processes it, how it is protected, and how you can request access, correction or deletion.

Effective: 16 July 2026 Seanala mobile application Kenya

In brief: Seanala uses information needed to register and verify customers, provide account and financial services, secure access, process transactions, meet legal obligations, and support customers. We do not sell customer personal information.

1 · Scope

Who is responsible for your information?

The financial institution that provides your Seanala account determines why and how your financial and customer information is used and is the data controller. Apex Softwares provides and supports the Seanala technology and processes information on that institution's documented instructions as a data processor.

Your account agreement or the information shown inside the app identifies the financial institution serving you. This notice applies to the Seanala application and related support services. A participating institution may provide an additional privacy notice for its own products, legal duties and processing activities.

2 · Information collected

Information Seanala may collect and process

Personal and KYC information

Name, mobile number, email address where supplied, date of birth, address, gender, occupation, tax information, next-of-kin or beneficiary information, and other details required to create and verify a customer profile.

Why: registration, identification, service delivery and compliance

National ID and customer images

National identity number, images of the front and back of an identification document, profile photograph or selfie, and images submitted for identity or account verification.

Why: identity verification, KYC, fraud prevention and account recovery

Financial and transaction information

Account identifiers, balances, savings activity, credit applications and status, scoring or eligibility information, borrowed and utilized amounts, installments, payments, transfers, beneficiaries, transaction references, dates and audit records.

Why: provide accounts, payments and credit-related services

Authentication information

Mobile number, encrypted or securely protected credentials, session information, one-time codes, login events, failed attempts and security settings. Never share your PIN or one-time code with another person.

Why: authenticate users and protect accounts

Device and technical information

Device type, operating system and app version, language, network and connection data, IP address, device security or biometric capability, diagnostic events and security logs.

Why: compatibility, security, troubleshooting and fraud prevention

Support communications

Messages, issue descriptions, attachments and contact details provided when you ask for help, dispute a transaction, make a complaint or exercise a privacy right.

Why: resolve enquiries, complaints and service issues

Seanala aims to collect only information that is relevant and reasonably necessary for the stated purposes. Some information is required by law or is necessary to open or operate an account. If required information is not provided, the relevant service may be unavailable.

3 · Biometrics

How biometric sign-in works

If you choose biometric sign-in, Seanala asks your phone's operating system to confirm your fingerprint, face or other biometric. The biometric template is enrolled, stored and matched by the device or its secure operating-system service. Seanala does not receive or store the underlying fingerprint or facial template.

The app receives only a confirmation that authentication succeeded or failed. Biometric sign-in is optional and can be disabled in the app or in your device settings. You can continue using the supported non-biometric sign-in method.

4 · Purposes

Why information is used

  • To register you, create your customer profile and administer your account.
  • To verify identity and perform KYC, anti-money-laundering and fraud checks.
  • To provide balances, statements, savings, payments, transfers and other requested services.
  • To assess eligibility, administer applications and service approved credit products.
  • To authenticate access, secure transactions and investigate suspicious activity.
  • To send service, security, transaction and account notifications.
  • To respond to enquiries, complaints, disputes and account-recovery requests.
  • To maintain records, audits, service reliability and regulatory compliance.
  • To improve app performance and fix errors using limited diagnostic information.

Processing is based, as applicable, on performing the service agreement, complying with legal obligations, protecting legitimate interests such as account security and fraud prevention, and consent where the law requires it. Consent may be withdrawn for optional processing without affecting processing already lawfully performed.

5 · Recipients

Who receives or processes information?

Information may be shared only as necessary with:

  • Your financial institution and authorised employees or agents who operate and support your account.
  • Apex Softwares, which hosts, maintains or supports Seanala and its secure banking integrations.
  • Payment and transaction partners, including mobile-money, banking, settlement and communications providers needed to complete your instructions.
  • Identity, KYC, fraud-prevention or credit-service providers where used by your financial institution and permitted by law.
  • Hosting, infrastructure, security and support providers acting under confidentiality and data-processing obligations.
  • Regulators, courts, law-enforcement bodies or other authorities when disclosure is required or authorised by law.
  • Professional advisers and auditors subject to professional or contractual confidentiality duties.

Seanala does not sell customer personal information. Service providers may use information only for the contracted service and must apply appropriate confidentiality and security safeguards. Where information is transferred outside Kenya, the responsible institution must use safeguards required by applicable data-protection law.

6 · Protection

Encryption and security practices

Seanala and its service providers use layered technical and organisational controls, including:

  • Encrypted HTTPS/TLS connections for information transmitted between the app and service endpoints.
  • Encryption or equivalent platform safeguards for protected information stored in supported systems and device-secure storage.
  • PIN, session and optional device-biometric authentication controls.
  • Role-based access, least-privilege practices and access reviews for authorised personnel.
  • Security logging, audit trails, monitoring, backups and incident-response procedures.
  • Contractual confidentiality and data-protection duties for relevant service providers.
No application or transmission method can guarantee absolute security. Keep your device updated and protected, use a strong PIN, do not share verification codes, and contact support immediately if you believe your device or account has been compromised.

7 · Retention

How long information is retained

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected and in accordance with the retention schedule of the financial institution responsible for your account. Retention periods depend on the data category, account status, transaction and dispute history, security needs, and applicable financial, tax, anti-money-laundering, audit and legal requirements.

Closing an account does not always permit immediate deletion of every record. Transaction, KYC, fraud-prevention, dispute and regulatory records may need to be retained for a legally required period. When information is no longer required, it is securely deleted, erased, anonymised or pseudonymised in accordance with applicable procedures. Backup copies are removed through the applicable backup lifecycle.

8 · Deletion

Account closure and data deletion

You may request account closure and deletion of personal information by emailing info@seanalacredit.co.ke. Use the subject “Seanala account and data deletion request” and include the mobile number registered to your account. Do not email your PIN, password or one-time code.

To protect you from unauthorised deletion, support may ask you to verify your identity. After verification:

  • the request will be sent to the financial institution responsible for the account;
  • eligible information will be deleted or anonymised;
  • information that must be retained by law will be restricted to the permitted purpose; and
  • you will be informed of the outcome or any lawful reason that limits the request.

Removing Seanala from your phone does not by itself close your financial account or delete server-held records. Submit a deletion request using the process above.

9 · Your choices

Your privacy rights

Subject to applicable law, you may ask to:

  • be informed about how your personal information is used;
  • access personal information held about you;
  • correct information that is inaccurate, incomplete, outdated or misleading;
  • object to or request restriction of certain processing;
  • request deletion where information is no longer lawfully required;
  • receive portable information where the right applies; or
  • withdraw consent for optional processing that relies on consent.

You may also raise a complaint with the Office of the Data Protection Commissioner of Kenya. Visit www.odpc.go.ke for current guidance and complaint channels.

10 · Contact

Customer support and privacy requests

Contact Seanala support if you have a privacy question, need help with your account, want to exercise a data right, or believe information has been used incorrectly.

Apex Softwares — Seanala Support

Email: info@seanalacredit.co.ke

Telephone: +254 14 3196667

Westlands Business Park, 3rd Floor, Suite 305, Waiyaki Way, Westlands, Nairobi, Kenya

This notice may be updated when services, legal requirements or data practices change. Material changes will be communicated through the app, this page or another appropriate channel.