Legal

Data protection notice

Last updated 3 October 2026. Written in plain language on purpose. Where a word has a legal meaning, we say so.

Practical details for a business that wants to know exactly how its records are protected, kept and returned. This supplements the privacy notice and forms part of the terms.

Roles

For client records, the lending business is the controller and Koneza is the processor. We act only on the business's instructions, which are given through the app. For user accounts and billing, Koneza is the controller.

Separation between businesses

Every record is tagged with the business it belongs to. The database enforces row-level security, meaning queries from one business cannot return another business's rows even if the application layer has a fault. Platform staff work through a separate, audited bypass that is logged.

Encryption

In transit: all traffic uses TLS.
At rest: database and backups are encrypted by the hosting provider.
Provider keys (SMS, email) are encrypted with a separate key before storage.
Passwords are stored as salted hashes and are never recoverable.

Access

Only named Koneza staff can access production systems, with two-step sign-in, and only for support, maintenance or legal reasons. Access is logged.

Retention

Client, loan and payment records: while the account is open, then 7 years, then deleted.
Audit log: 7 years.
Messages sent (SMS and email content): 2 years.
Sign-in and security logs: 1 year.
Registration documents (licences, IDs): until the registration is decided plus 90 days, then deleted. Approved businesses may ask us to keep them longer.
Backups: rolling 30 days.

Getting your data back

Statements and reports export as CSV and PDF from the app at any time. On closing an account, an admin can request a complete export of clients, loans and transactions within 30 days. We provide it as CSV files.

If something goes wrong

If we become aware of a breach affecting your records, we will tell the account admins within 72 hours with what happened, what was affected and what we are doing. We will support you in notifying your clients or authorities where that is required.

Sub-processors

Hosting: Railway (application and database), Vercel (web pages). Email: SendGrid. SMS: Africa's Talking, Twilio. We will update this list before adding a new one and tell account admins by email.

International transfers

Servers are in the EU and the US. Where data leaves the country it was collected in, we rely on standard contractual clauses with our providers.