KambaJá Privacy Policy

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the KambaJá mobile application ("KambaJá" or the "App"). KambaJá is operated by GRIDSPIRE TECHNOLOGY LTD ("we", "us", or "our Company"). It applies to information we collect when you apply for a loan, manage your account, or use related services.

Please read this Privacy Policy carefully. By using KambaJá, you agree to the collection and processing of your information as described in this policy. We take your privacy seriously and handle your information in a responsible and transparent way.

Information We Collect and Its Purpose

When you use KambaJá, we may collect information from you, from your device, or through permissions you choose to allow. We collect only what is needed for identity verification, credit assessment, account security, and running the loan service. This information falls into two groups: information required to provide the service, and information collected with your authorization.

1. Information Necessary to Provide the Service

We need the information below to create your account, review your application, and provide the loan service. If we do not have it, we cannot offer the service.

• Identity information: Full name, residential address, and official ID details (such as your National ID number), so we can confirm your identity, help prevent fraud, and meet KYC and AML requirements.
• Account information: Your mobile phone number, so we can create your account and send service messages about your application, account, and repayment.
• Work and financial information: Occupation, income level, education level, and bank account details, used to understand your financial situation, assess your ability to repay, and support credit-related decisions.

2. Information Collected with Your Authorization

Some information is collected from your device only after you clearly agree. You can turn these permissions off at any time in your device settings. If you refuse or later withdraw a permission, you may still use parts of the App, but features that depend on that permission (such as identity checks) may not work. We do not use these permissions to access unrelated files or personal conversations.

• Camera: We ask for camera access only during identity verification in the loan application. You use the camera to photograph your ID documents and complete a face check (liveness detection) so we can confirm it is you and meet KYC requirements. We do not access your photo gallery, videos, or other media stored on the device. Images collected in this step are encrypted and used only for verification, security review, and compliance.
• SMS: With your authorization, we may process SMS related to financial activity, such as transaction notices, payment records, and messages from banks or other financial institutions. We use this to support credit assessment, check repayment-related activity, protect account security, and help prevent fraud. We do not read or store your personal chat messages, and we do not use SMS for marketing. SMS data we process is stored in encrypted form, protected with access controls. You can withdraw this permission in your device settings, or contact us if you want us to delete this data sooner.
• Approximate location: With your consent, we may collect your approximate location (for example, the city you are in), not precise GPS tracking. We use this to follow local rules, reduce fraud, and add a security check on your account. You can turn location off in your device settings.
• Installed applications: With your consent, we may collect the list of apps installed on your device. We use this only for risk assessment and fraud detection (for example, to help identify unusual or high-risk activity). We do not use this list to advertise to you or to sell data. You can withdraw consent in your device settings.
• Device information: When you use the App, we collect basic technical details such as device model, operating system version, and network status. We use this to keep the App running reliably, improve compatibility, protect account security, and help detect suspicious or duplicate activity.

How We Use Your Information

We use the information we collect to operate KambaJá, keep the service secure, and meet our legal duties. We only use it for the purposes described in this Privacy Policy:

• Provide the loan service: Receive and review applications, complete required checks, decide on an offer, release funds if approved, and manage repayment.
• Verify identity: Confirm that the person using the App is who they say they are, and meet KYC and AML requirements.
• Communicate about the service: Create and maintain your account, send status updates and other service messages, and remind you about repayment.
• Assess risk and prevent fraud: Evaluate credit-related risk, detect unusual or unauthorized activity, and help protect you and the platform.
• Support your account: Answer questions, handle requests, and help you use the App.
• Improve the App: Fix problems, improve performance, and make the product easier to use. We do not sell your data.
• Comply with the law: Follow applicable laws, regulations, court orders, or requests from regulators, including tax, accounting, and anti-fraud rules.

We do not use your personal information for purposes unrelated to running, securing, and improving KambaJá, or to meeting our legal obligations.

Information Sharing and Disclosure

We take the security of your personal information seriously. We work to protect your data, and we never sell your personal data.

We do not sell, rent, or trade your personal information to third parties. We share data only when it is needed to provide our service, complete a credit assessment, prevent fraud, or comply with applicable law. In those cases, we may share information with credit institutions, anti-fraud service providers, and security partners.

We may also disclose your information in these limited situations:

• Legal requirements: When applicable law or legal process requires it, such as a request from a regulator, law enforcement, or a government authority.
• Protecting rights and safety: When it is necessary to protect our legitimate interests, prevent fraud, or help keep our users and the public safe.

Technical services we need to run the App, such as cloud hosting, operate under strict confidentiality agreements. Those providers process data only on our behalf and may not use it for any other purpose.

Data Storage and Retention

Where we store data: Some processing happens on your device. The personal information we need to run your account and loan is sent using encryption (TLS) to servers controlled by GRIDSPIRE TECHNOLOGY LTD. We store that information only to provide the service and to meet legal requirements.

How long we keep data: We keep personal information only for as long as we need it for the purposes in this Privacy Policy, to meet legal duties (such as tax, accounting, and anti-fraud rules), and to resolve disputes. How long that is depends on the type of information, why we collected it, and what the law requires.

How we delete data: When we no longer have a lawful need to keep your data, we anonymize it or delete it securely. If you want us to delete your account and data sooner, contact us using the details in the "Contact Us" section.

Your Rights

Depending on the data protection laws that apply to you, you can ask us to take certain actions with your personal information. These rights may apply in different ways, depending on why we process the data and what the law requires. In practice, you can:

• Access your information: Ask us for a copy of the personal information we hold about you, and for a summary of how we use it. This helps you check what we have on file.
• Correct your information: If your name, contact details, or other information is wrong or incomplete, ask us to update it so we can keep your account and loan records accurate.
• Limit how we use your information: In some situations, you can ask us to pause or limit processing — for example while we look into a correction request, or if you believe we no longer need the data for the original purpose.
• Object to processing: You can object to certain uses of your information based on your particular situation. We will review your request. If we still need to process the data (for example to run your loan, prevent fraud, or meet a legal duty), we will explain why.
• Move your information: Where this right applies, you can ask us to send your personal information to you , commonly used, machine-readable format.
• Delete your information: In specific cases, you can ask us to delete your personal information — for example if we no longer need it for the purpose we collected it. We may keep some records if the law requires it, such as tax, accounting, or anti-fraud rules.
• Withdraw consent: Where we rely on your permission (including device permissions such as camera, SMS, location, or installed apps), you can withdraw that permission at any time in your device settings or by contacting us. Withdrawing consent does not affect processing we already carried out while your permission was in place.

To use any of these rights, email us using the details in the "Contact Us" section. Tell us which right you want to use and enough information for us to find your account. Before we act on a request, we may ask you to confirm your identity so we do not give your data to the wrong person. We will respond as soon as we reasonably can after verification. If we cannot fully meet a request, we will tell you why, including where the law requires us to keep certain information.

Need to close your KambaJá account? Use the account deletion request page. This request may still be subject to identity checks and lawful retention duties in Angola.

Data Security

We take the security of your information seriously. We use technical and organizational measures designed to protect it against unauthorized access, public disclosure, alteration, or destruction.

In particular, we:

• Encrypt data in transit: We use Transport Layer Security (TLS) when information is sent between your device and our systems, so it is harder for others to intercept.
• Control who can access data: Access to personal information is limited to authorized staff who need it for their work, such as customer support, risk review, or compliance. We use access controls to reduce the chance of internal misuse.
• Monitor for attacks: We use intrusion detection systems to help us notice suspicious activity and respond more quickly if something looks wrong.
• Review our controls: We regularly review and update our security practices so we can address new and emerging threats.

We work to protect your information, but you should also keep your device, login details, and verification codes safe. If you think someone else has used your account, contact us as soon as possible.

Children's Privacy

KambaJá is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and think a child has given us information, please contact us right away. We will delete that information as soon as we reasonably can.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make important changes, we will let you know in the App and update the "Last updated" date at the top of this page. Please review this policy from time to time. If you keep using KambaJá after a change takes effect, you accept the updated policy.

Contact Us