External Data Protection and Privacy Policy
Your privacy, protected — transparently explained.
📅 Effective Date: 24 August 20261.0 INTRODUCTION
MustLink ("we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy and Security Statement outlines how we collect, use, store, and protect your data across all our products and services — including PESACCO and other platforms — in compliance with applicable laws, including the Data Protection and Privacy Act of Kenya.
2.0 INFORMATION WE COLLECT
We may collect the following types of personal data:
Personal identification
Name, contact information, national ID or passport details, and other identifying information required to provide our services.
Employment details
For employees and applicants, we may collect employment history, qualifications, and related professional information.
Usage Information
Information about how you interact with our platforms, including log files, error logs, and usage data — used solely to improve our services.
Digital identifiers
Device type, operating system, unique device identifiers, IP addresses, mobile network information, and similar digital identifiers to improve your experience and ensure security.
Location Information
With your consent, precise location data to provide location-based services such as finding nearby SACCOs or MFIs. You can control location tracking through your device settings.
3.0 HOW WE COLLECT YOUR DATA
We collect personal data through:
- Direct interactions: Information you provide when filling out forms, registering for our services, contacting customer support, or otherwise communicating with us.
- Automated technologies: Data collected automatically through cookies, system logs, and similar technologies when you use our websites and applications.
- Third parties: Information received from financial institutions, sponsor institutions (SACCOs, MFIs, VSLAs), service providers, and other partners in the course of delivering our services.
4.0 CONSENT
We always require your consent before collecting, processing, or sharing your personal data. By using our services, you explicitly agree to the terms outlined in this Privacy and Security Statement. Where required by law, we will obtain explicit consent before processing sensitive personal data. You may withdraw your consent at any time by contacting us, but this may affect our ability to provide certain services to you.
5.0 HOW WE USE YOUR INFORMATION
Your personal data is used for the following purposes:
Providing & Managing Services
To deliver, manage, and improve our products and services — including processing transactions, authenticating identity, performing credit scoring, and managing accounts.
Legal & Regulatory Compliance
To comply with applicable laws, regulations, and legal processes — including responding to lawful requests from regulatory and government authorities.
Product & Experience Improvement
To monitor usage patterns, identify technical issues, improve functionality, and develop new features and services relevant to our customers.
Communications
To send transaction notifications, service updates, and important communications about our products. Marketing communications are sent only with your consent and you may opt out at any time.
Security & Fraud Prevention
To protect against unauthorized access, fraud, and illegal activities — including monitoring for suspicious behaviour, identity verification, and compliance with anti-money laundering obligations.
6.0 DATA SHARING AND DISCLOSURE
We may share your data with:
Regulatory Authorities
We may disclose your data to regulatory authorities, including the Central Bank of Kenya and the Financial Reporting Centre (FRC), as required by applicable law.
Third-Party Service Providers
Trusted providers assisting in our operations — including licensed Credit Reference Bureaus for credit scoring purposes. All such providers are contractually obligated to maintain confidentiality and security of your information.
Affiliates & Business Partners
With your consent, we may share information with affiliates and partners where necessary to provide services or relevant offers. You may opt out of marketing-related sharing at any time.
Law Enforcement
In cases of fraud, security threats, or where required by law, we may share information with law enforcement agencies or other government bodies.
Merger or Acquisition
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to equivalent privacy protections.
We do not sell or rent your personal data to third parties.
7.0 DATA SECURITY
We implement robust security measures to safeguard your data, including:
- Encryption of sensitive data
- Access control mechanisms
- Regular security audits and monitoring
- Compliance with industry best practices for Cybersecurity
However, no method of transmission over the internet or electronic storage is 100% secure. You are responsible for maintaining the confidentiality of your login credentials and taking appropriate measures to secure your devices and accounts.
8.0 DATA RETENTION
We retain personal data only for as long as necessary to fulfill legal, regulatory, and operational requirements across all our services. When data is no longer needed, it is securely deleted or anonymized in accordance with applicable laws.
9.0 YOUR RIGHTS
You have the right to:
- Access and request a copy of your personal data
- Correct inaccurate or incomplete information
- Withdraw consent where applicable
- Request deletion of your personal data, subject to legal requirements
10.0 DATA BREACHES AND INCIDENT RESPONSES
In the event of a data breach, we have established procedures to:
- Assess and contain the breach
- Notify affected individuals where required
- Report significant breaches to regulatory authorities
- Implement corrective measures to prevent future incidents
11.0 COOKIES AND ONLINE TRACKING
Our websites and applications may use cookies and similar technologies to enhance your user experience, remember preferences, and analyse usage patterns. You can manage cookie preferences through your browser or device settings at any time.
12.0 CHANGES TO THIS STATEMENT
We may update this Privacy and Security Statement from time to time. Significant changes will be communicated through our website or other appropriate channels.
13.0 ESCALATION OF UNRESOLVED ISSUES
If you have engaged with us and feel your concerns have not been satisfactorily addressed, you have the right to escalate your complaint to the Personal Data Protection Office. You can file a formal complaint at:
For inquiries or to exercise your data rights, contact us at:
Joab Baryayaka
Data Protection Officer
Email: [email protected]
MustLink
Right Wing, 9 Kiambere rd, Nairobi, Kenya
P.O. Nairobi
Email: [email protected]
Phone: +256 312 316900 | +256 393 238278
14.0 CHANGES TO THIS STATEMENT
We may update this Privacy and Security Statement from time to time to reflect changes in our practices, technology, or legal requirements. Significant changes will be communicated through our website, applications, or other appropriate channels. Your continued use of our services following any update constitutes acceptance of the revised Statement.