Privacy Policy

1. Introduction

This Privacy Policy explains how Overwood Capital collects, uses, discloses, stores, and protects your personal data when you visit our website, apply for loans or insurance products, use our services, contact us, or interact with us in any way.

We act as a data controller under the Data Protection Act, 2019. By using our services or providing us with your information, you consent to the practices described in this policy.

2. Personal Data We Collect

We may collect the following categories of personal data:

• Identity & Contact Information: Full name, national ID/passport number, date of birth, gender, marital status, phone number, email address, physical address, next of kin details.
• Financial Information: Bank account details, salary details, income sources, employment information, credit history, M-Pesa or other mobile money transaction data, loan purpose and amount requested.
• Collateral / Asset Information: Vehicle registration (logbook), logbook details, valuation reports (for logbook loans).
• Insurance-related Data: Health information (for medical insurance), occupation, beneficiary details, previous claims history (where applicable and with consent).
• Technical & Usage Data: IP address, browser type, device information, website usage patterns, location data (inferred from IP), cookies and similar technologies.
• Sensitive Personal Data: Where necessary and with your explicit consent — biometric data (e.g. fingerprints for verification), health data, ethnic origin (only as required by law or regulation).

3. How We Collect Your Data

We collect data:

• Directly from you (application forms, website, phone calls, emails, WhatsApp, in-person visits)
• From third parties (credit reference bureaus, employers for salary verification, previous financiers, CRB reports, government databases where permitted)
• Automatically (cookies, server logs, analytics tools when you visit our site)

4. How We Use Your Personal Data

We process your data for the following lawful purposes:

• To evaluate and process your loan or insurance applications
• To perform credit assessments and risk profiling
• To disburse funds and manage repayments/collections
• To underwrite and administer insurance policies
• To comply with legal and regulatory obligations (Central Bank of Kenya, Credit Reference Bureau regulations, AML/CTF laws, Data Protection Act)
• To communicate with you (updates, reminders, customer support)
• To improve our services, prevent fraud, and for internal analytics
• With your consent — for marketing of our products and services

5. Sharing & Disclosure of Your Data

We may share your personal data with:

• Credit Reference Bureaus (CRBs) as required by law
• Regulators and government authorities (Central Bank of Kenya, ODPC, law enforcement when required)
• Service providers (payment processors, IT/cloud providers, debt collectors, lawyers, auditors — under strict confidentiality agreements)
• Insurance partners/reinsurers (for insurance products)
• Employers (for salary verification – Mshahara loans)
• In case of merger, acquisition, or sale of business assets

We do not sell your personal data to third parties for marketing purposes.

6. International Data Transfers

Where we use cloud services or international partners, your data may be transferred outside Kenya. We ensure appropriate safeguards are in place (adequacy decisions, standard contractual clauses, or binding corporate rules) in line with the Data Protection (General) Regulations, 2021.

7. Data Security

We implement reasonable technical and organizational measures to protect your data against unauthorized access, loss, misuse, or alteration (encryption, access controls, firewalls, regular security audits). However, no method of transmission over the internet is 100% secure.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce agreements. Loan/insurance records are typically retained for 7–10 years after closure (or as required by CBK or other regulators).

9. Your Rights Under the Data Protection Act, 2019

You have the right to:

• Access your personal data
• Request rectification of inaccurate/incomplete data
• Request erasure (“right to be forgotten”) where lawful grounds no longer apply
• Object to processing (including for direct marketing)
• Request restriction of processing
• Data portability (where technically feasible)
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

To exercise these rights, contact us using the details below.

10. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to enhance user experience, analyze traffic, and for security. You can manage cookie preferences via your browser settings. Essential cookies cannot be disabled without affecting site functionality.

11. Changes to This Privacy Policy

We may update this policy from time to time. Changes will be posted on this page with an updated “Last updated” date. We encourage you to review it periodically.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact: