Exercise your rights under the Kenya Data Protection Act 2019. We make it simple.
The Kenya Data Protection Act 2019 grants you the following rights in relation to your personal data held by Endelea Finance Limited:
There are two ways to submit a data request:
Most requests can be handled directly inside the Endelea Finance app:
For formal written requests or matters not covered by the in-app tools, email our Data Protection Officer:
Please include your full name, the phone number or email address registered with your Endelea account, the nature of your request, and any specific data or time period your request relates to. We will acknowledge your request within 2 working days and respond fully within 30 days.
You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data along with information about how it is used.
What your access request will include:
What is not included: Aggregated, anonymised data that cannot be linked back to you; data held for fraud prevention that disclosure might compromise; data relating to other users.
Access requests submitted via email will be fulfilled by sending a secure download link to your registered email address within 30 days.
You can request your data in a portable, machine-readable format. This is useful if you want to switch to another service or keep your own records.
Available export formats:
Data exports can be initiated directly from Settings → Privacy → Export My Data in the app. You will receive an email with a secure download link within 24 hours. The link expires after 7 days for security reasons. If you need the export resent, simply repeat the process.
If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. Most profile data (name, phone number, email, preferences) can be updated directly in the app under Settings → Profile.
For data that cannot be self-corrected in the app — such as historical transaction records that were incorrectly auto-captured, or organisation details — please submit a written request to dpo@endeleafinance.com with the specific data that requires correction and the correct information.
Note that transaction data captured from M-Pesa SMS reflects what Safaricom transmitted. If the underlying M-Pesa record is incorrect, you will need to raise that directly with Safaricom. We can update the categorisation or notes on your end.
You have the right to request deletion of your personal data. You can initiate account deletion directly in the app from Settings → Privacy → Delete My Account.
What happens when you request deletion:
Deletion is irreversible. If you only want to pause access, consider cancelling your subscription instead — your data will be retained for 90 days before automatic deletion, giving you the option to reactivate.
We may decline a deletion request in limited circumstances where retention is required by law, or where the data is necessary to establish, exercise, or defend legal claims.
You may request that we restrict (limit) how we process your data in the following circumstances:
During a restriction period, we will continue to store your data but will not process it for any purpose other than storage, unless you provide consent or it is required for legal claims. Submit restriction requests to dpo@endeleafinance.com with details of your circumstances.
You have the right to object to processing based on our legitimate interests or for direct marketing purposes.
Marketing communications: You can opt out of all marketing emails at any time by clicking "Unsubscribe" in any email, or by going to Settings → Notifications → Marketing in the app. We will stop marketing communications within 48 hours of your request.
AI model improvement: You can opt out of your anonymised usage data contributing to model improvement at any time from Settings → Privacy → AI Data Contribution in the app.
Other legitimate interest processing: If you wish to object to other processing based on our legitimate interests, please contact dpo@endeleafinance.com explaining your specific grounds for objection. We will assess whether our legitimate interests are overridden by your interests and respond within 30 days.
We are committed to responding to all data requests promptly:
All responses are provided free of charge. If a request is manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or refuse to act, but we will explain our reasons clearly.
To protect your data and prevent unauthorised access, we are required to verify your identity before fulfilling any data request submitted by email. We will ask you to confirm:
We will never ask for your M-Pesa PIN, Endelea password, or any payment card details during the verification process. If you receive a request for such information purportedly from us, please report it immediately to security@endeleafinance.com.
If you are unhappy with how we have handled your data request, or if you believe we have mishandled your personal data in any way, please contact us first so we have the opportunity to resolve the matter:
If you remain unsatisfied after raising a complaint with us, you have the right to lodge a formal complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya: