Privacy notice

Who is responsible for your data

Under the documented platform terms, Mtaji Technologies Limited, of Nairobi, Kenya, is registered with the Office of the Data Protection Commissioner (registration INST-8172862F99A) and is the data controller for the personal data it processes to run the platform: the data of participants’ users, directors and beneficial owners, processed to operate the platform, compute M-Scores and meet compliance obligations.

This notice covers this website, mtaji.co, and the personal data Mtaji Technologies processes as controller for the Ankara Platform. Where Mtaji runs a white-label deployment inside a bank’s own environment and processes data only on that bank’s instructions, it acts as the bank’s processor under a separate agreement. Each anchor and financier is a controller in its own right for the data it receives through the platform for its own credit, commercial and compliance purposes.

Our data protection officer is Patrick Nyakoria, reachable at [email protected].

Whose data, and whether you are a data subject at all

The Act protects natural persons. A limited company is not a data subject; the people who act for it (its users, directors and beneficial owners) are. A sole proprietor is a data subject in their own right, because the business and the person are the same legal object, and the full regime applies to them.

That is why Mtaji’s forms branch on legal form at the first question. The answer changes what is collected and how it is held, and it is asked once.

What this website collects

Browsing this website collects nothing that identifies you. It sets no cookies. If you tell it which side of an anchor you trade on, that preference is stored in your own browser and read back by this site only; it is one of a handful of fixed values and is not sent anywhere with your name.

Usage measurement is first-party and anonymous by construction: each page you open, without any query string; the kind of device and connection; which campaign link or kind of site brought you, such as a Mtaji post on LinkedIn or a search engine, but never the address you came from; and whether a step was completed or abandoned. Your IP address is not retained, no third-party analytics service is used, and every record is screened on arrival so that a value shaped like an e-mail address, a phone number, a tax PIN or a registration number is refused rather than stored. The only identifier is a random value that lives for one browser tab and cannot be linked to an account.

When you fill in a form, we collect what you type into it, and only that. Talk to a person takes your question and the email or WhatsApp number we should reply to. Asking about your anchor takes the company’s name, your business’s name and legal form, your name and work email (confirmed with a code), and your mobile number if you give it; if the company is not on Mtaji yet and you choose to, the names, roles and work contacts of people there we should speak to. A diligence or data room request takes your name, organization, work email and what you need.

Why personal data is processed, and on what basis

Kenyan law allows personal data to be processed only on a stated basis: your consent, performance of a contract with you, a legal obligation, or a legitimate interest that does not override your rights. Each purpose below rests on one of these.

Running the platform and your financing

Under the documented platform terms, onboarding, sign-in, trade execution, settlement and support, as performance of the agreements you or your business sign.

Meeting legal obligations

Under the documented platform terms, anti-money-laundering and counter-terrorist-financing checks, sanctions screening, tax, and the Data Protection Commissioner’s requirements.

Credit assessment

Under the documented platform terms, the M-Score is computed from supply chain, business and director-level data, which may include credit reference bureau reports, business and identity registry data (BRS and IPRS), the platform’s transaction history and, only with your consent, mobile money statements. This is part of performing the agreements; the mobile money part rests on consent.

Answering you

Replying to a question you send us, to a request about your anchor, or to a diligence or data room request, because you asked us to. Your contact is used for that reply and nothing else.

Contacting a company you told us about

When you give us the people to speak to at a company that is not on Mtaji yet, we write to them about a program, in our legitimate interest in bringing that company on. The first lines of every email say where their details came from and give a one-click way to stop, and we never tell them who you are unless you agree.

Security, fraud prevention and improvement

Under the documented platform terms, in our legitimate interest in keeping the platform secure, preventing fraud and improving the service. Analytics use aggregated or anonymized data only.

Marketing

People at anchors and financiers may receive email about Mtaji’s programs in our legitimate interest, without being asked first, and every such email carries a one-click way to stop; after a stop, none is ever sent again. Marketing by WhatsApp or text message needs your consent first. Suppliers and distributors receive no marketing from Mtaji at all.

Consents, never bundled

Where we ask for consent, each consent is asked for on its own, in its own wording, is recorded, and can be withdrawn without affecting your access to the platform. One qualification is set by the agreements: withdrawing data needed for a credit assessment may make some products unavailable to you.

Who we share it with

We do not sell personal data. We share it only where a purpose above needs it:

The parties to your program

Your anchor and the financier in your program, as each transaction requires; each is then a controller of what it receives.

Our service providers

Hosting, the SMS and USSD gateway, identity verification and credit reference bureaux, under contract. The current list of these sub-processors is published, and material changes are notified thirty days in advance.

Authorities

Regulators and law enforcement, when the law requires it.

Automated decisions, and what they cannot do to you

The readiness check on this site is advisory and non-determinative. It is not a credit decision, no financier is bound by it, and no facility is declined on it alone. It returns reasons you can act on (a gap list) rather than weights, it never returns a bare "not eligible", and you can ask for a person to review any result.

Under the documented platform terms, where the platform uses automated scoring, no solely automated decision producing legal or similarly significant effects is made about you. You are told at onboarding that automated scoring is used, what kinds of data it uses and how it works in general terms. Some results are referred to a person as standard. If you are declined, you may ask for a person to reconsider, give your point of view and contest the decision through the platform, and you will have an answer within fourteen days. If you show that information from a third party, such as a credit reference bureau, is wrong, reliance on it is suspended while it is checked with its source.

Where your data is hosted

Under the documented platform terms, production runs on Hetzner Online GmbH in the European Union with backup infrastructure at DigitalOcean in the Netherlands. White-label deployments may instead run inside the partner institution’s own environment, as stated in that program’s terms sheet.

Both named hosts are outside Kenya. Transfers out of Kenya are made under section 48 of the Act, on appropriate safeguards: hosting in jurisdictions with comprehensive data protection law, contracts with each provider, and notification to the Data Protection Commissioner where required. This is a statement about safeguarded transfer, not a statement that your data never leaves the country.

How long it is kept

Under the documented platform terms, personal data is kept only as long as its purpose and the law need, then deleted or irreversibly anonymized.

Transaction and anti-money-laundering records

Seven years, as Kenyan law requires.

The platform’s audit records

At least seven years.

A question to Talk to a person

The contact you leave is deleted thirty days after your request is closed.

A request about your anchor

Your contact details are deleted seven days after the request if you never confirm your email, and thirteen months after it once you have. The request itself is then anonymized: your business name and registration number are removed.

People you name at a company

Deleted thirteen days after you give them if we have not written to them, and ninety days after our last email to them if we have.

Website usage records

Ninety days, then kept only as totals, and any total covering fewer than five businesses is suppressed.

If something goes wrong

Under the documented platform terms, a personal data breach that presents a real risk of harm is notified to the Data Protection Commissioner without undue delay and within seventy-two hours, and to the people affected where required. A record is kept of every breach, notifiable or not.

Under the documented platform terms, bank account details can only be changed inside the platform, never by email or phone. While any financing is outstanding the change is blocked outright, and otherwise it needs a second approver, a call-back to a number held before the request was made, an independent administrator’s approval and a cooling-off period.

So nobody from Mtaji, on any channel, will ask you to send or confirm account details by message. A request that does is not from us.

Your rights

The Act gives you these rights, and we honor them for this website and for the platform. Requests are handled without undue delay and within any period the law sets.

To be informed

What is collected, why, on what basis, and for how long, which is what this notice is for.

To access

A copy of the personal data held about you.

To correct

Inaccurate or out-of-date data, corrected.

To delete

Data that is no longer needed for its purpose or held without a lawful basis. Records the law requires us to keep are kept, and we will tell you which law rather than cite "regulatory requirements" at you.

To restrict

To have processing paused while a correction or an objection is looked into.

To object

To processing on legitimate-interest grounds, and to direct marketing at any time, with immediate effect.

Not to be subject to a solely automated decision

Where a decision with legal or similarly significant effect on you would be automated, you may ask for a person to review it and to express your point of view.

To portability

Your data in a structured, commonly used format where it was processed by automated means on the basis of consent or contract.

To withdraw consent

At any time, for anything that rests on consent, without affecting what was done before.

To complain

To the Office of the Data Protection Commissioner, at any time, without first raising it with us, though we would rather hear it first.

Children

Mtaji’s services are for businesses and the adults who act for them. They are not directed at anyone under eighteen, and we do not knowingly collect a child’s personal data; if we learn that we have, we delete it.

How to exercise a right or ask a question

Write to our data protection officer at [email protected], or use Talk to a person on the channel you already use. Say which right you are exercising and which account or relationship it concerns. Expect your identity to be confirmed before any data is released, for the same reason account details are never changed on request by message.

Changes to this notice

This notice is revised when what we do changes, and the date below changes with it. A change that affects your rights is brought to your attention rather than slipped into a footer.

Last updated: 11 November 2026.