Privacy Policy

Yambukai Finance - Privacy Policy

1. Introduction

    This Privacy Policy outlines how Yambukai Finance (“Company”, “We”, “Us”, or “Our”) collects, uses, discloses, and safeguards your personal data when you use our services. It is prepared in accordance with the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe and applicable financial regulations.

    By using our services, you agree to the collection and use of your information as described in this policy.

    2. Information We Collect

    a. Personal Information

    We collect information including, but not limited to:

    • Full name and national ID/passport
    • Contact details (email, phone number, physical address)
    • Employment and income details
    • Credit history and loan records
    • Device information and usage data

    b. Sensitive Information

    We may also process:

    • Financial account or mobile money details
    • Creditworthiness or loan performance data

    3. How we collect Personal Information

    We collect personal information through our website to provide you with relevant financial services, improve your user experience, and fulfil legal and regulatory obligations. Here’s how we collect this information:

    Information You Provide Directly

    You may share personal information with us when you:

    • Fill out online application forms for loans or other financial services.
    • Request support or contact us through the website.
    • Subscribe to newsletters or alerts.
    • Participate in surveys or feedback forms.

    This information may include your name, contact details, ID numbers, financial information, and any documents you upload to support your application.

    Information Collected Automatically

    We use cookies and similar technologies to automatically collect certain information when you interact with our website. This includes:

    • Your IP address, browser type, and device information.
    • Pages visited, links clicked, and time spent on the website.
    • Technical data such as crash logs and diagnostics.

    We may also collect approximate location data based on your IP address. You can manage cookie preferences through your browser settings.

    Third-Party and Analytics Tools

    We may use third-party services such as Google Analytics to understand how users engage with our website. These services may collect and process your information according to their own privacy policies.

    4. Purpose of Data Collection

    We collect and process your personal data to:

    • Evaluate loan applications and verify identity
    • Fulfil contracts and process financial transactions
    • Meet our legal obligations (e.g., KYC and AML requirements)
    • Respond to your queries or provide customer service
    • Provide account-related updates and offers
    • Improve the security and usability of our services
    • To communicate with you about your account, services, updates, and promotions.

    5. Legal Grounds for Processing

    We process your personal data based on:

    • Your consent
    • Contractual necessity
    • Legal obligations under financial and data protection laws
    • Our legitimate interest in managing risk and delivering secure services

    6. Who we share your data with and why

    We may share your personal data with trusted third parties in limited circumstances, and always in accordance with applicable data protection laws. This is done to support our operations, comply with legal obligations, and provide you with financial services. Specifically, we may share your data:

    • With regulatory bodies such as the Reserve Bank of Zimbabwe – To comply with financial regulations, reporting obligations, and ensure lawful operation of our services.
    • With licensed credit reference bureaus – To assess your creditworthiness when you apply for our products.
    • With verified service providers for processing or analytics – To deliver our online services efficiently (e.g. data hosting, customer support, or analytics) while ensuring data security through contractual safeguards.
    • In response to a court order or legal request – When legally required to disclose information as part of an investigation, lawsuit, or regulatory process.
    • During mergers or corporate restructuring – To facilitate business continuity if we undergo a merger, acquisition, or other corporate change, provided the receiving party agrees to protect your data in line with this policy.
    • With your explicit consent – In situations where your personal data is required for a purpose not listed above, we will first ask for and obtain your permission.

    7. Data Transfers Outside Zimbabwe

    • In certain circumstances, we may transfer your personal data to countries outside of Zimbabwe. These transfers are necessary to provide you with the full range of our services.
    • When transferring your personal data across borders, we ensure compliance with the Cyber and Data Protection Act (Chapter 12:07) and take appropriate safeguards such as:
    • Binding Corporate Rules (BCRs): If applicable, we may use BCRs within our group of companies to govern the transfer and protection of personal data.
    • Standard Contractual Clauses (SCCs): These are legal agreements that ensure the protection of your personal data when transferred outside Zimbabwe.
    • Encryption: We encrypt personal data during transfers to ensure its security.
    • Data Processing Agreements: We enter into data processing agreements with third party service providers to ensure they meet the necessary data protection standards.

    8. Data Retention

    We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by the Microfinance Act, Money Laundering and Proceeds of Crime Act, tax and other microfinance-related legislation. After the retention period, your data will be securely deleted or anonymized.

      9. Your Data Protection Rights

      Under the Cyber and Data Protection Act of Zimbabwe, and other related data protection regulations, you have the following rights regarding your personal data:

      • Right to Access: You can request access to the personal data we hold about you.
      • Right to Rectification: You can request the correction of inaccurate or incomplete data.
      • Right to Erasure: You can request the deletion of your personal data, subject to certain legal exceptions.
      • Right to Restrict Processing: You can request the restriction of processing your personal data under specific circumstances.
      • Right to Object: You can object to the processing of your personal data in certain situations, such as for marketing purposes.

      To exercise these rights, please contact us using the contact details provided in Section 14

        10. Age Restrictions

        Our services are not intended for individuals under the age of 18. We do not knowingly collect or process data from anyone below this age. If you believe a minor has provided us with personal data, please contact us immediately. We will delete such information promptly unless required to retain it by law.

          11. Security Measures

          Whether you are using our website, mobile services, visiting our Branches or Agents, we apply reasonable and industry-standard security measures including physical, administrative, and technical safeguards to protect your data.

          12. Cookies and Tracking Technologies

          We use cookies and other tracking technologies to enhance your experience on our website and applications. These technologies help us to:
          a) Understand how you use our services.
          b) Improve the functionality and performance of our website.
          c) Personalize content and advertisements based on your preferences. You can control the use of cookies through your browser settings. However, please note that blocking certain cookies may affect your ability to use some features of our services.

          13. Changes to This Privacy Policy

            We may update this Privacy Policy periodically. Changes will be posted on our website and, where appropriate, notified by email or in-app messages. The “Last Updated” date at the top of this policy indicates the latest revision.

            14. Contact Us

              You may change your privacy preferences or withdraw previously given consent for the use of your personal data at any time. We are committed to handling all queries promptly, transparently, and in full compliance with applicable legal and ethical standards. If you have any questions, concerns, or requests regarding how we handle your personal data in line with Zimbabwe’s Cyber and Data Protection Act, please reach out to our designated Data Protection Officer (DPO) using the contact details provided below.

              Name: Euphrazia T Chingozi

              Designation: Data Protection Officer

              Email: dataprotection@yambukaifinance.co.zw

              Tel: (+263) 8688 008 501

              Office Address: Yambukai Finance, 5th Floor, Chiedza House Cnr 1st Street/Kwame Nkrumah Ave, Harare.

                15. Data Protection Authority

                If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Data Protection Authority, POTRAZ.