Data Deletion Instructions

1. Make a data request

You may ask Brisk Credit Limited to access, correct, restrict or delete eligible personal data.

Email info@briskcredit.co.ke with the subject Data deletion request. Include:

• your full name;
• the phone number or email associated with your Brisk account;
• the last four digits of your national ID, where relevant;
• your relationship with Brisk, such as applicant, customer or website visitor; and
• a clear description of the data or account you want us to review or delete.

2. Identity verification

We must protect customers from fraudulent deletion requests. Before acting, we may contact you using information already associated with the account and request proportionate evidence to confirm your identity or authority.

An authorised representative may submit a request, but we will require proof of authority and may still verify the identity of the person whose data is involved.

3. What happens after a request

1. We acknowledge the request and check whether additional information is needed.
2. We identify the relevant systems, records, service providers and lawful retention requirements.
3. We delete, anonymise, correct or restrict eligible data as appropriate.
4. We confirm the outcome and explain any information we could not delete.

We aim to respond within the period required by Kenyan data protection law. Complex requests, requests involving several systems, or requests requiring legal review may take longer, and we will communicate where an extension is lawful and necessary.

4. Information we may need to retain

A deletion request does not automatically erase every record. Brisk may retain limited information where necessary to:

• perform or enforce an active agreement or resolve an outstanding balance;
• meet credit, tax, accounting, anti-money-laundering, regulatory or reporting duties;
• maintain accurate credit and transaction records where required by law;
• prevent fraud, protect account security or document a previous deletion request; or
• establish, exercise or defend a legal claim.

Where deletion is not permitted, we will limit use of the retained information to the applicable lawful purpose and dispose of it when that purpose ends.

5. Access, correction, objection and complaints

The same contact process may be used to request access, correction, portability, objection to certain processing, withdrawal of consent or review of a qualifying automated decision.

Read our Privacy Policy for more information. If you are dissatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner.