Privacy Policy

Last updated 25 September 2026

1. 1. Who we are
2. 2. What we collect
3. 3. Where it comes from
4. 4. How we use it
5. 5. Automated decisions
6. 6. Who we share it with
7. 7. Transfers outside Kenya
8. 8. How long we keep it
9. 9. Security
10. 10. Your rights
11. 11. The app & device permissions
12. 12. Children
13. 13. Changes
14. 14. Contact us

1. Who we are

Redemptor is a technology platform that lets boda boda riders use credit backed by their SACCO savings at partner merchants. Redemptor is operated by Dawit Consulting, Nairobi, Kenya ("Redemptor", "we", "us"). For the personal data described here, we act as a data controller under the Kenya Data Protection Act, 2019. Your SACCO and the lender that funds your credit may also be controllers of your data for their own purposes.

This policy covers the website at redemptor.co.ke, the Redemptor Android app, and the portals used by riders, SACCO officials, merchants and lenders.

2. What we collect

We store your national ID number in a protected form and show only its last four digits in the app.

3. Where your data comes from

• You, when you register, sign in or use the service.
• A SACCO official who registers you in the Redemptor app with your consent.
• Your SACCO, which confirms your membership and shares your savings balance.
• Lenders and merchants, which tell us about purchases, repayments and payouts linked to your account.

4. How we use your data, and why

Where we rely on your consent, you can withdraw it at any time. This will not affect anything we did before you withdrew it, but we may no longer be able to provide credit to you.

5. Automated decisions

Your credit limit is calculated automatically from your SACCO savings and your repayment history. We also use automated tools to read the details on your ID card and to help check that your photos and documents match. A person reviews registrations before they are approved. If you disagree with a decision about your limit or your registration, you can ask for it to be reviewed by a person by contacting us.

6. Who we share your data with

• Your SACCO: to confirm membership, approve your registration, and follow up on missed payments.
• The lender funding your credit (a SACCO or licensed financier): the details it needs to lend to you and track repayment.
• Merchants: only what they need to complete your purchase, such as your name and the amount.
• Service providers who work for us under contract: cloud hosting, SMS delivery, payment processing, and document-reading services. They may use your data only to provide their service to us.
• Authorities: where the law requires it, or to protect our rights, our users or the public.

We do not sell your personal data and we do not share it for advertising.

7. Transfers outside Kenya

Some of our service providers, including our hosting provider, may store or process data outside Kenya. When this happens we make sure there are appropriate safeguards in place, as required by the Data Protection Act.

8. How long we keep your data

We keep your data for as long as your account is active. After it closes, we keep credit and payment records for up to seven years to meet financial record-keeping and legal requirements, then delete or anonymise them. Registrations that are rejected are kept for a shorter period, to prevent duplicate or fraudulent applications, and then deleted.

9. How we protect your data

Data is encrypted in transit (HTTPS). Access is limited by role: SACCO officials see only their own SACCO's members, and lenders see only their own customers. PINs and ID numbers are stored in protected form. We keep test (demo) data completely separate from real customer data, and we log access to sensitive records.

10. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• be told how your data is used (this policy);
• access the personal data we hold about you;
• have wrong or incomplete data corrected;
• have your data deleted, where we no longer need to keep it by law;
• object to or restrict certain processing;
• receive your data in a portable format; and
• withdraw consent you have given.

To use any of these rights, email privacy@redemptor.co.ke from, or quoting, the phone number on your account. We may ask you to confirm your identity. We aim to respond within 7 days and will do so within the time the law allows. If you are unhappy with our response you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

Deleting your account

You can ask us to close your account and delete your data at any time. If you still owe money, we will need to keep the records linked to that balance until it is settled, and financial records for the period the law requires.

11. The app and device permissions

Redemptor (the Android app, ke.co.redemptor.app) needs only an internet connection. It does not ask for access to your camera, location, contacts, microphone or files. SACCO officials who sign in to the officials' section can take ID and face photos when registering a member; the app hands this to your phone's own camera app and uploads the photo to Redemptor for verification. If the phone is offline, the registration (details and photos) is kept on the phone in encrypted storage and uploaded automatically as soon as it is back online, then deleted from the phone. It keeps your sign-in on your phone in encrypted storage until you sign out or change your PIN, and shows your SACCO credit, amounts due, activity, vouchers and the messages Redemptor has sent you. To ask us to delete your account, see redemptor.co.ke/delete-account.

The older Redemptor Admin app (used by some SACCO officials) opens the same officials' section on your phone. It asks to use your camera only when you or a SACCO official choose to photograph an ID card or take a selfie during registration. Photos are uploaded to Redemptor for verification and are not used for anything else. The app may store registrations on the phone temporarily when there is no internet connection, and uploads them when the connection returns.

12. Children

Redemptor is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "last updated" date and, if the changes are significant, let you know in the app or by SMS.

14. Contact us