Privacy policy

We care about your privacy, data protection, and confidentiality. This Privacy policy (hereinafter – “Privacy policy”) states, what information we collect, for which purposes and means, and what are your rights.
Your personal data controller is Mogo Auto Limited as part of Eleving Group to whom you have provided your personal data.

1. Definitions

Processing – any operation or set of operations that are performed on personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, etc.

Client – a person, who uses, has used, or expressed interest to use any of our Services.

Eleving Group – Eleving Finance S.A., registered with the Luxembourg Trade and Companies Register under number B 174457 and all Eleving Finance S.A. affiliated companies and subsidiaries, including but not limited to:

  • AS Mogo Africa;
  • Mogo Auto Limited; and
  • Mogo Kenya Limited.

Services – any services provided by Eleving Group, including car and motorcycle financing, leaseback services, and logbook financing.

Personal data – any information directly or indirectly relating to the Client or information that could allow to directly or indirectly identify the Customer.

Personal data protection laws – Data Protection Act, No. 24 of 2019 and the Regulations thereunder as read with the provisions of Article 31 (c) and (d) of the Constitution of Kenya , 2010.

2. When is this Privacy policy applicable?

This Privacy policy applies when:

  • You use or have expressed the intention to use any of our Services;
  • You represent a Client (for example as a guarantor, the payer, authorized representative, next of kin etc.) or you have been indicated as the contact person for the Client;
  • You have used our Services in the past and we are required to retain this information;
  • You contact us or visit any of our representative and customer service offices;
  • You visit our website;
  • In any other way provide us with your personal data for any of the data processing purposes set in this Privacy policy.

3. What are the data processing purposes and legal basis?

We can process your personal data for various purposes and based on different legal grounds. Please note that we may process certain types of personal data for several purposes at the same time. We may receive your data from both you and external sources, such as public and private registries and other third parties.

3.1. Processing your application and concluding a Service contract

Mainly we process your personal data to provide you with our Services and to carry out various pre-contractual activities and assessments, to conclude the Service contract, fulfill it, and terminate it. For this purpose, we will process information that allows us to identify you, verify the information you provide, and offer you the most appropriate Service. We may also process the data of persons related to you, such as your contact person, guarantor, next of kin, the payer, or the authorized representative.
If you provide us with such contact details, you are required to notify this person that you have provided their details to us.
If you have submitted an application, which has not been finalized, we will process the information provided and, if reasonably required, contact you to obtain any additional information, which we require to enter into a Service contract with you.

Category of personal data:

  • Your identification data (e.g., name, surname, personal ID number or passport number, date of birth, ID document or passport bio- data, driver's license data, information on family relations, if necessary),
  • Contact information (phone number, e-mail address, postal and residential address),
  • Choice of language and form of communication,
  • Information on your vehicle (e.g., registration number, chassis number, brand, year, color, owner data, user data, fines, etc.)
  • Name, surname, and contact information of your contact person or representative (payer, guarantor, authorized representative, next of kin).

Processing is necessary for the performance of the Service contract or to take steps prior to entering into the Service contract.

3.2. Evaluation of your solvency and credit history

To provide you with our Services, there are several assessments we are legally required to carry out, such as evaluations of your solvency, credit history, and source of income. To comply with these requirements, we may process various data, which allows us to assess you as a customer, determine your solvency, sources of income, the number of other liabilities, past liabilities, as well as comply with anti-money laundering requirements.

Category of personal data:

  • Your identification data (e.g., name, surname, personal ID number or passport number, date of birth, ID document or passport bio-data, information on family relations, if necessary),
  • Contact information (phone number, e-mail address, postal and residential address),
  • Information on your education and employment,

Processing is necessary for compliance with a legal obligation, which we are subject to.
Your consent provided to us to request specific information from public authorities’ databases (such as the State Social Insurance agency).

  • Financial data (e.g., information on your liabilities, income and other assets, dependents, etc.)
  • Information on the origin and source of funds (e.g., information about the employer, business partners, business, bank statements, or other data that allows us to verify your funds and prevent money laundering and terrorist financing, ascertain if you are a politically exposed person, etc.),
  • Data on your fulfillment of obligations (e.g., information on your previous and current financial obligations, payment discipline, failures to pay, etc.).

3.3. Purchasing vehicle insurance policy on your behalf

If we have received a relevant request from you or you have not fulfilled your contractual duty to provide the vehicle insurance in due time, we can purchase the compulsory civil liability insurance policy on your behalf. For this purpose, we will process your and your vehicle's data.

Category of personal data

  • Your identification data (e.g., name, surname, personal ID or passport number, date of birth),
  • Contact information (phone number, e-mail address, postal and residential address),
  • Data on your vehicle (e.g., registration number, registration certificate).

Processing is necessary for the performance of the Service contract or to take steps prior to entering into the Service contract.

3.4. Processing of payments

To comply with our legal requirements, for example, for accounting, anti-money laundering, payment processing, processing prepayments and maintaining other payment-related documentation, we process your data related to your payments and fulfillment of your financial obligations towards us.

Category of personal data

  • Your identification data (e.g., name, surname, personal ID and passport number, date of birth),
  • Contact information (phone number, e-mail address, postal and residential address),
  • Information on the payments you have made to us and your bank account details.

Processing is necessary for compliance with a legal obligation, which we are subject of.

3.5. Marketing and promotional activities

We may process certain personal data to inform you about our news, lotteries, promotional activities and send you personalized offers. In the case of personalized offers and advertising, we may use profiling (for more details on profiling and automated decision making, see Section 7). We collect some of this data using cookies.

Category of personal data

  • Your identification data (e.g., name, surname, age),
  • Contact information (phone number, e-mail address),
  • Information on participation in lotteries, promotions, or other campaigns,
  • Information received from cookies and similar technology, which provides us data on user preferences and interests.

Your consent to receive marketing and promotional information.
Our legitimate interests are to pursue direct marketing activities if you are using our Services.

3.6. Communication with you and providing customer service

To communicate with you, provide our customer service, consultations, resolve any issues in relation to our Services, we may process your data that we already have (such as your name, contact information, and information about the Service you are using) and the data you provide to us during communication.

Category of personal data

  • Your identification data (e.g., name, surname, personal ID or passport number),
  • Contact information (phone number, e-mail address, postal address),
  • Voice recordings,
  • Other information, which you may provide to us during the communication (for example, data on your contract with us, your vehicle data, etc.).

Our legitimate interests are to provide you with quality service and to solve any related problems.

3.7. Vehicle location data (GPS) processing

To monitor our vehicles during rental time, we have equipped our rental cars with GPS tracking devices. These devices can record vehicle location information, driving habits, and other data related to the use of the car. Detailed information about the processing of your data for this purpose is provided to the Client when starting the car rental Service.

Category of personal data

  • Your identification data (e.g., name, surname, personal ID or passport number),
  • Contact information (phone number, e-mail address, postal and residential address),
  • Data on the monitored vehicle,
  • Vehicle location data,
  • Driver’s driving habits.

Our legitimate interests to ensure the protection of our vehicles and their use in accordance with the rent service agreement.

3.8. Defending our legal interests, including debt collection and assignment

In certain cases, we may process your personal data to pursue and defend our legal interests, such as to prevent fraud or attempted fraud, recover funds, pursue debt recovery, assert debts, prove your consent, resolve any disputes and conflicts, and raise and maintain legal claims.

For this purpose, we may ask you to provide the details of your additional contact person. We will use such information in cases where we are unable to contact you, and we need to provide you with information related to the Service or the agreement. If you provide us with such contact details, you are required to notify this person that you have provided their details to us.

Category of personal data

  • Your identification data (e.g., name, surname, personal ID or passport number and other identifiable information),
  • Name, surname, and contact information of your contact person,
  • Information on the Service you are using or have used,
  • Information on the consent you have provided,
  • Other information, which may be required for this particular data processing purpose.

Our legitimate interests are to pursue and defend our legal interests, prevent fraud or attempted fraud, recover funds, pursue debt recovery, assert debts, prove your consent, resolve any disputes and conflicts, and raise and maintain legal claims.

3.9. Analysis and improvement of our Services

We may process your personal data to find out your opinion on our Services, as well as to analyze our Services, maintain client statistics and other analytical information for the purpose of assessing risks, improving the Service, and avoiding deficiencies.

Category of personal data

  • Your identification data (e.g., name, surname, personal ID or passport number, date of birth),
  • Contact information (phone number, e-mail address)
  • Information on your preferences and satisfaction with the Service.

Our legitimate interest is to analyze and improve our Services.

3.10. Technical supervision and improvement of the Services

To monitor the use of our Services, as well as the operation of our information systems, including databases, websites, and networks, we may process various technical data obtained from cookies, audit trails, and other technical solutions.

Category of personal data

  • Your IP address,
  • Information on your device,
  • Type and version of your browser,
  • Time zone, various metadata, information on access to the website, information on interaction with the website, data entry, modification, and other information for that purpose.

Our legitimate interests are to ensure the safety and security of our Services and continuity of our business activities and technical assets.

4. From where do we receive your personal data?

Depending on the purpose of the data processing, we may receive your personal data from various sources:

  • from you when you apply for or show interest in our Services;
  • from other Eleving Group companies, given that they may consider your application and make you an offer;
  • if you are indicated as the Client’s contact person or representative (payer, guarantor, next of kin, or authorized representative), we have received the data from the Client;
  • from third parties from whom we request information for the assessment of your solvency, credit history, and origin of funds, such as credit bureaus, public authorities (such as the Kenya Revenue Authority, National Transport and Safety Authority (NTSA)National Social Security Fund (NSSF), National Hospital Insurance Fund (NHIF), the Integrated Population Registration (IPRS), the Directorate of Criminal Investigations, etc.), debt history databases and other cooperation partners or third-party service providers who can provide the necessary information.

5. To whom do we share your personal data?

To provide our Services, we need to share some of your personal data with third-party service providers (hereinafter – Service Providers) and other data recipients, for example:

  • Other Eleving Group companies, for example, to offer the most suitable Services provided by another company in the Eleving Group;
  • public authorities and other institutions (such as the Kenya Revenue Authority, National Transport and Safety Authority (NTSA) the Integrated Population Registration (IPRS), the Directorate of Criminal Investigations), as well as law enforcement authorities, sworn bailiffs, tax administrations, supervisory authorities, and financial investigation authorities and third parties, which maintain various credit registers, government registers, and commercial registers;
  • credit institutions, financial institutions, insurance service providers and financial intermediaries, and other third parties involved in the provision of the Services and in the conclusion and/or performance of the contract, such as sellers of leasing objects and authorized persons related to their servicing, as well as fees and fines related to such objects;
  • Service Providers that provide AML and fraud detection tools, client identification tools, server co-location services as well as data and cyber security services, email and content delivery tools, postal, marketing, accounting, legal, audit, IT, web analytics, session recording, and online marketing services and other services that we may reasonably need;
  • debt collectors or other legal persons under assigned rights, courts, out-of-court dispute resolution bodies, bankruptcy or insolvency administrators as well as peer-to-peer loan investment platforms.

In certain situations, we have a legal obligation to share your information with third parties to comply with legal requirements or requests, as well as to protect our, or a third party’s legal interests. We will also disclose your information to third parties to the extent allowed by applicable law, including:

  • to a prospective purchaser or purchaser that acquires all or substantially all of us or our business;
  • to a third party if we sell or buy any business or undergo a merger, in which case we may disclose your information to the prospective buyer of such business; and
  • to a third party if we partner with other companies or businesses, undergo a reorganization, bankruptcy, or liquidation, or otherwise undertake a business transaction or sell some or all our assets. In such transactions, your information may be among the transferred assets.

When we share your personal data with the Service Providers, we comply with the requirements of the Data Protection Act, No. 24 of 2019 (the “Act”), namely:

  • We transfer only the minimum amount of data that is necessary for a particular Service Provider;
  • We only work with Service Providers who can ensure an appropriate level of personal data protection;
  • If the Service Provider acts as our processor of personal data, it may only process your data in accordance with our instructions and in accordance with a written agreement and may not use it for other purposes.

If any of the Service Providers are located outside Kenya, we will share your data in accordance with the requirements set in the Act, including:

  • by entering into data protection compliant Standard Contractual Clauses or by using other appropriate grounds for data transfer provided by the Act such as codes of conduct and certifications,
  • cooperating with Service Providers located in the country, which offers an adequate level of data protection in accordance with Kenya’s Data Protection Commissioner’s adequacy decision.

6. Video surveillance

We conduct video surveillance in our client service centers, offices, car dealerships, warehouses, storage yards, and other premises, where we operate. We process the data based on our legitimate interests to prevent and detect criminal offenses and to protect our property. Video surveillance is active 24 hours a day, 7 days a week. Data obtained during the video surveillance is retained for up to ninety (90) days. After this period, data is deleted, if it is not reasonably required to retain it for other purposes such as investigation of criminal activities, the protection of our or third-party legal rights. When choosing the placement of video surveillance cameras, we have taken into consideration the following aspects:

  • Video surveillance area – the cameras record the areas required to achieve the purpose of video surveillance. Other buildings, areas outside the Company's premises and territories are not filmed;
  • Video surveillance quality – the cameras are positioned so that the captured image can be used for the intended purpose, the persons seen in the video are identifiable and the cameras are suitable for the surveillance area;
  • Data subject privacy – the cameras do not capture the areas, which are designed for private use (for example, lavatories, relaxation areas, etc.).

7. When do we use profiling and automated decision-making?

Profiling is the evaluation of Clients according to certain parameters, such as economic situation, personal preferences, interests, behavior, etc., to classify Clients into one of our pre-defined client categories. Automated decision making is the ability to make decisions by technological, automated means, using the data provided by the Client or the information obtained as a result of profiling.

We may use profiling and make automated decisions to process your application for our Services, assess your creditworthiness and risks, evaluate the ability to provide you with our Services, determine the maximum loan amount, assess and prevent fraud risk, and fulfill our obligation to comply with money laundering and terrorist financing prevention rules.

Decisions to refuse to provide the Services to you are not made automatically without the involvement of our employees. We regularly review our algorithms and terms for providing our Services to prevent evaluation errors and inaccuracies. You have the right to request that your application be processed by an individual and not by an automated system, but a secondary evaluation of your application does not guarantee that the result will be different.

Additionally, we may use profiling and automated decision-making to offer you a more appropriate Service, personalized marketing, and commercial offers, including discounts and special conditions, and carry out customer analysis.

Our profiling and automated decision making are based on:

  • our legal obligation to assess the solvency of Clients and to comply with anti-money laundering and anti-terrorist financing rules;
  • Concluding the Service contract and taking pre-contractual measures, including to ensure a faster and more efficient contracting process;
  • Your consent or our legitimate interest in preventing the risk of fraud and providing you with more appropriate solutions, communications, and offers.

8. How long do we retain your personal data?

We will process your personal data as long as:

  • one of the above-mentioned legal bases for data processing exists and there is a purpose for your data processing, for example, the Service agreement you have entered into is in force or your consent to certain data processing is valid;
  • we are required by the applicable law to retain your personal data;
  • there is a need to pursue our legitimate interests, for example, raise and maintain legal claims.

When these conditions end, we will delete or anonymize your data.

9. Your rights

As a data subject, you have certain rights prescribed by Personal data protection laws. These rights provide that you can:

  • request access to your personal data and ask for details on its processing;
  • correct incorrect or inaccurate data;
  • ask to delete your data. Please note that we will not be able to delete data that we are required to process and retain in accordance with applicable laws or that may be necessary to defend our rights or bring a legal action if our rights have been infringed;
  • object to the processing of your personal data, which is based on our legitimate interests. In case of such an objection, we will no longer process your personal data unless, we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise, or defense of legal claims;
  • request to receive your data to transfer it to another data controller provided that this does not affect our legitimate interest in protecting our trade secrets or any other confidential information;
  • withdraw its consent to the processing of data based on prior consent. Consent can be revoked by:
    • using the unsubscribe option in our e-mail messages or SMS,
    • sending an e-mail to dataprivacy@mogo.co.ke or calling our customer service center 0768 469 112
    • on-site at our customer service centers.

Withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal. Please also note that the withdrawal of consent will not affect the processing of your personal data, which we process based on other legal grounds.
To exercise these rights, you can submit a written request to us by sending it to our e-mail address dataprivacy@mogo.co.ke or by submitting it in writing to the customer service center and identifying yourself. We will process the request within 30 days and provide you with an answer. When we receive your request for the exercise of your rights, we will verify your identity, evaluate the request and execute it in accordance with the applicable legal norms.
Please note that you have the right to lodge a complaint with the Office of the Data Protection Commissioner via https://www.odpc.go.ke

10. Links to third party websites

Our website may contain links to third-party websites. These third-party websites have their own terms of use and privacy policy, which we encourage you to read when you visit the website. We are not responsible for third-party websites and their content.

11. Changes to this Privacy Policy

We reserve the right to change this Privacy Policy. In case of any significant changes, we will notify you in advance. We recommend that you visit our website regularly for up-to-date information.

This Privacy Policy is effective as of 29 July 2021.