Privacy Policy

1. Who we are

Brisk Credit Limited ("Brisk", "we", "us" or "our") provides regulated credit and related customer services in Kenya.

This policy explains how we process personal data when you use our website, apply for or manage a credit product, communicate with us, or use a Brisk account or customer system. Brisk is the data controller for the personal data covered by this policy unless we tell you otherwise.

Our services are intended for adults. We do not knowingly offer credit services to anyone under 18 years old.

2. Personal data we collect

Depending on the service you use, we may collect:

• Identity information: name, national identification details, date of birth, photograph, signature and information used for identity or eligibility checks.
• Contact and account information: phone number, email address, physical or postal address, branch, username and customer or account identifiers.
• Application and financial information: requested amount, product, business or farming details, income and affordability information, M-Pesa or bank transaction information, repayment history and information required for credit assessment.
• Verification and security information: one-time password delivery and verification records, login activity, device information, fraud indicators and account security events. We do not store an OTP in readable form after it is no longer needed.
• Communications: calls, emails, WhatsApp or SMS messages, support requests, complaints and other interactions with Brisk.
• Technical information: IP address, browser and device type, pages viewed, referral information, cookies and similar website diagnostics.

We normally collect data directly from you. Where lawful and necessary, we may also receive information from authorised representatives, payment providers, credit reference bureaus, identity verification services, public records, regulators, service providers or other sources you have authorised.

3. Why and how we use personal data

We process personal data only where we have a lawful basis, including taking steps at your request before entering a contract, performing a contract, complying with legal obligations, pursuing legitimate interests that do not override your rights, or acting with your consent.

We use data to:

• receive and assess applications, verify identity and determine eligibility;
• open, secure and administer customer accounts;
• disburse credit, receive repayments, maintain records and provide statements or support;
• send login or transaction authentication codes through approved channels, including WhatsApp or SMS;
• prevent fraud, unauthorised access, money laundering and other unlawful activity;
• meet regulatory, reporting, audit, tax, consumer protection and legal requirements;
• improve our services, systems, customer support and website performance; and
• send service messages and, where permitted, relevant offers or updates. You may opt out of direct marketing.

Credit assessment and automated tools

We may use rules, scoring models or automated tools to assist with identity checks, fraud detection, affordability analysis and credit assessment. Where a decision is based solely on automated processing and significantly affects you, you may ask for information about the decision and request appropriate human review, subject to applicable law.

4. When we share personal data

We do not sell personal data. We may disclose only the information reasonably necessary to:

• authorised Brisk staff, branches and contractors who need it to provide the service;
• technology, cloud hosting, communications, identity verification, payment and professional service providers acting under appropriate confidentiality and data protection terms;
• M-Pesa, banks, payment networks and credit reference bureaus where necessary and lawful;
• the Central Bank of Kenya, the Office of the Data Protection Commissioner, courts, law enforcement or other authorities where disclosure is required or permitted by law; and
• a successor or participant in a lawful restructuring, merger or transfer, subject to appropriate safeguards.

Some providers may process data outside Kenya. Where this occurs, we use legally recognised safeguards and take reasonable steps to ensure that the data remains protected.

5. Security and retention

We use proportionate technical and organisational measures to protect personal data. These measures include access controls, authentication, encryption where appropriate, logging, staff confidentiality obligations, service-provider reviews and incident response procedures.

No system is completely secure. Please protect your phone, account details and authentication codes, and contact us immediately if you suspect unauthorised access.

We retain personal data only for as long as reasonably necessary for the purpose collected and to meet credit, tax, anti-money-laundering, regulatory, dispute-resolution and other legal obligations. When information is no longer required, we delete, anonymise or securely dispose of it.

6. Your data protection rights

Subject to the Data Protection Act, 2019 and lawful limitations, you may:

• be informed about how your data is used;
• request access to personal data we hold about you;
• request correction of inaccurate or misleading data;
• object to certain processing or withdraw consent where consent is the basis;
• request deletion of data that is inaccurate, unlawful or no longer required;
• request data portability where applicable; and
• request review of a qualifying decision based solely on automated processing.

To make a request, follow our data request and deletion instructions or contact us using the details below. We may verify your identity before acting on a request. Some information must be retained where required by law, an active agreement, a regulatory obligation or the establishment or defence of a legal claim.

7. Cookies and website analytics

Our website may use essential cookies needed for security and core functions, together with limited analytics or preference technologies. You can manage non-essential cookies through available website controls or your browser settings. Blocking some technologies may affect how parts of the website work.

8. Brisk in third-party AI assistants

Brisk may offer a public connector for services such as ChatGPT. Its first version provides public product facts, illustrative cost calculations and branch lists. A tool call may contain the selected product, illustrative amount, chosen Brisk region and ordinary protocol, security or hosting data.

The connector is designed not to request or retrieve your name, phone number, national ID, account details, statements, OTP, M-Pesa PIN or application documents. Do not place that information in an AI conversation. If you choose to continue an application, you will be sent to Brisk's secure website and this policy will apply to information you provide there.

The AI platform separately controls the conversation and may process it under its own privacy terms. Review the platform's notices and settings before use.

9. Changes, contact and complaints

We may update this policy when our services, technology or legal obligations change. The latest version will appear on this page with its effective date.

Questions and rights requests may be sent to info@briskcredit.co.ke. You may also complain to the Office of the Data Protection Commissioner if you believe your personal data has been processed unlawfully.