Data Protection Policies

Policy 2

Data Processing Policy

Why we use personal data, on what legal basis, and which providers process it for us.

Purposes and legal basis

We never sell personal data, and we never use it for advertising by third parties.

Providers that process data for us

Each provider receives only what its task needs. We choose providers that commit to protecting the data and to using it only on our instructions.

Data outside Kenya

Our servers are in Germany, under the European Union's data protection law, and several providers above process data in other countries. We transfer data abroad only to providers that give appropriate safeguards for it, as the Kenya Data Protection Act requires, and only what the service needs.

Automated results and AI

Health Check scores, assessment bands and tool recommendations are calculated automatically from your answers. They are guidance only: they never decide whether you can use a service, get a price or receive credit. Sema, our assistant, uses Google's Gemini AI to answer chats on the website and to draft replies to emails you send us; a team member reads and approves every email draft before it is sent. Do not share bank or M-Pesa PINs, passwords or ID numbers with Sema; it never needs them. You can always ask a person to review a result or an answer.

Children

Accounts, purchases and coaching are meant for adults aged 18 and over. Younger learners use Money-Wise with a parent or guardian. If we learn that a child's data was collected without that, we delete it.

Policy 3

Data Access Policy

Who can see personal data, how that access is controlled, and how you can see what we hold about you.

Who can see what

• You: Everything in your account: profile, results, plans, courses, certificates and payments, from your dashboard and profile.
• The Money-Wise team (admin role): The admin workspace: members, enquiries, Discovery Calls, payments and the team inbox. Given only to staff whose work needs it, each with their own account.
• Coaches: Only their own clients, in the coach workspace: the client's profile, intake, goals, sessions and documents. Not other members.
• Consultants (specialists): Only the details of a client the team has matched them with, shared for that piece of work.
• Service providers: Only what their service needs (see the table above), under their contract with us.
• Authorities: Only when the law requires it, and only what the request lawfully covers.

How access is controlled

• Least access: each person gets the narrowest role their work needs. Coaches cannot open the admin workspace.
• Personal accounts only: no shared logins, so every action can be traced to one person.
• Access is granted by management and removed on a team member's last day, or straight away if a device or account may be compromised.
• Viewing the site as a member, to help with a problem, asks the team member to confirm first and is recorded in the audit log.
• Management reviews who holds admin and coach access at least every quarter.

Your rights

Under the Kenya Data Protection Act you can:

• Be told how your data is used, which this page and the Privacy Policy do;
• Get a copy of the personal data we hold about you;
• Have wrong or incomplete data corrected;
• Have your data deleted;
• Object to processing, including all marketing;
• Receive the data you gave us in a portable format;
• Complain to the Office of the Data Protection Commissioner (odpc.go.ke).

For a copy, a correction or an objection, email sema@moneywise.co.ke from the address we hold, or call +254 112 440 122. We confirm it is you, then reply within 7 days, and always within the time the law allows. Requests are free.

Your choice

Deleting your data