Privacy Policy – Kenya

Effective Date: September 11, 2026

Who will process my data? With whom will my data be shared or disclosed?

1. Tala as a Data Controller. Tala (InVenture Mobile Limited) is the registered Data Controller responsible for processing your personal data when you use our services. Tala is a licensed Digital Credit Provider regulated by several government bodies, including the Central Bank of Kenya (CBK), the Financial Reporting Centre (FRC), and the Kenya Revenue Authority (KRA).
2. Tala as a Joint Controller. Tala may partner with other organisations (who are likewise data controllers) to provide integrated or embedded services to you. In such cases, your data will be processed in accordance with the privacy policies of each data controller.
3. Tala as a Data Processor. Tala may act as a data processor for a data controller with whom you have an account or contractual relationship. In such cases, Tala will act according to the instructions of the data controller and you may refer to the privacy notice or policy provided to you by the data controller.
4. Tala Platforms. Tala offers financial services through the Tala mobile app, the Tala websites, the Tala Biashara Club site, Unstructured Supplementary Service Data (USSD).
5. Tala’s Service Providers

   Tala engages service providers (data processors) that help us provide services to you. They include:

   • Financial services companies and payment service providers such as mobile wallets and banks, which allow transfers of funds and payments
   • Messaging services like telcos for SMS, online messengers for chat, or email platforms, which allow us to communicate with you
   • Third party services like customer support, collections, and marketing agencies, which allow us to address your concerns, collect your payments, and invite you to join promotional activities
   • Fraud prevention and identity verification platforms that allow us to review your information and keep the Tala platforms safe
6. Tala’s Partners

   Tala partners with other organisations to provide integrated or embedded credit services to individuals, either on Tala Platforms or on the partner’s platforms. Our partners may include:

   • Financial services companies and payment service providers such as mobile wallets and banks
   • E-commerce platforms that facilitate sales and purchases of goods and services
   • Other platforms that offer goods or services to customers and merchants
7. Protection of Tala’s Interests
   • Tala keeps your data and other customers’ data confidential. But in certain situations, we may need to share your data to other public or private third parties, such as law enforcement, legal counsel, auditors, and advisors, to exercise our rights or to protect other customers.
   • Tala is required by law to share your data with credit reference bureaus for credit reporting and the KRA for tax purposes.
   • We may also transfer or assign your balance to another company in cases like an acquisition of Tala or part of Tala’s assets or receivables. You will be notified if this happens.

What data will Tala collect and process about me?

1. ID Data. We need data to confirm your identity: your national ID number, full name, date of birth, birthplace, and photos of your likeness and your national ID.
2. Contact Details. We need data to get in touch with you: phone number, alternate number, SIM number, email address, home address.
3. Transaction and Session Data. We need data to process your Tala transactions: Tala platform logins, usage, requests, transfers, payments, account numbers.
4. Communication and Interaction Data. We collect and process data from your interactions with us and our agents, including SMS, chat messages, emails, call recordings, web form responses, and your participation in surveys, promotional activities, and contests.
5. Background Data. Tala will ask about your income, employment, loan purpose, education, device ownership. We may ask you to upload documents to support your financial background. We may also collect data about your financial or transaction history from credit reference bureaus, sanctions lists, and anti-money laundering databases.
6. Device Data. Tala will collect information about your device where the Tala App is installed such as: SIM number, IMEI, IP address, device type, operating system, network, settings, SMS keywords, contacts, device or account identifiers, location.
7. Third Party Data. Tala is required to verify your identity and keep your profile and information updated. You must keep us informed of changes to your personal data during the existence of your Tala account. Tala may also verify and update your data based on third party sources or publicly available sources.

Where does Tala get my data? What data does Tala access on my device?

1. Tala platforms – We collect your data when you install and use the Tala platforms. This includes data that you type, upload, or submit in the platform, data about your use of the platform, and data from the device where the platform is accessed.
2. Payment and fund transfer channels – We collect data about your Tala transactions (such as payments and fund transfers) from the channels that you use.
3. Tala agents – We collect data from your interactions with our agents, including your account service requests through calls, chat, email, message, or web form, and your participation at Tala surveys and events.
4. Credit reference bureaus – We may collect data about you from CRB or credit score providers.
5. Partners – We may enter into partnerships to allow Tala to offer services to the partner’s clients or users.
6. Device – Depending on the Tala platform that you are using and the operating system of your device, Tala may access Device Data once you have given the necessary permissions. For Android devices, you may refer to our Tala app Data Safety page for more information.

What happens if I refuse or fail to provide access to my data?

If you refuse or fail to provide the necessary data, or if you withdraw your consent for the processing of your data, Tala may be unable to deliver the services to you. We may have to decline your request, with notice to you.

What is the purpose for collecting and processing my data?

1. There are legal obligations that apply to Tala as a Digital Credit Provider.
   • We confirm your identity and contact details. We conduct KYC (know-your-customer) screening and monitoring to comply with anti-money laundering laws, and we submit reports to the FRC.
   • We submit positive and negative credit data to credit reference bureaus.
   • We remit taxes to the KRA.
   • We comply with all other orders issued by regulatory authorities.
2. Tala will process your data to start, fulfill, or enforce our contract with you.
   • We check if you are eligible for Tala’s services.
   • We maintain your account and process your requests such as loans, payments, cash in, cash out, transfers, and tickets.
   • We operate the Tala app, fix errors, install updates, and secure it against fraud and illegal uses.
   • We train our agents to contact you, remind you about repayment, and resolve your concerns.
3. Tala may process your data based on our legitimate interest.
   • We study your use of the Tala platforms to help improve our services.
   • We conduct research, surveys, and studies with recorded responses.
   • We send you offers, updates, and promotions.
4. Tala may process your data with your consent.
   • We may publish content and materials with your image, likeness, and voice or video recording.
5. Tala may process your data to comply with our role as a data processor, to fulfil our contractual obligations to our partners and to allow our partners to fulfil their contractual obligations to you.

Will my personal data be transferred outside the country?

Tala will process your data in electronic form and we use cloud or online storage with servers in South Africa and in the United States. We conduct processing online in different countries where members, staff, and agents of Tala are present, including locations outside of Kenya. We make sure that wherever the processing is done, your data will be protected with adequate safeguards, including encryption in transit and at rest.

What are my rights over my personal data?

You have the following data subject rights:

1. Right to be informed. You must be given details, in clear and plain language, about how your data is collected and used, the lawful basis for processing your data, where your data may be transferred or shared, details about automated processing, and your data subject rights.
2. Right to access. You may ask for a copy of the personal data that we hold about you, as well as details on how it has been processed and who may have received copies of it.
3. Right to object. You may ask us to stop processing your data if our basis for doing so is your consent or our legitimate interest.
4. Right to correction. You may ask us to correct or rectify any personal data about you that is not accurate. We may ask you to provide supporting evidence for the request.
5. Right to deletion. You may ask us to delete your personal data if it is inaccurate, or the collection or processing was unlawful, or your rights were violated, or if we no longer need it for the purpose for which it was collected, and no other basis can apply. You may request the deletion of your Tala account here.
6. Right to data portability. You may ask us to give you a copy of your data in a structured, common, and machine-readable format, or to have it transmitted to another data controller.
7. Rights in relation to automated decision making. You have a right not to be subject to a decision based solely on automated processing, including profiling, except when such automated processing or profiling is necessary for the performance of a contract with you, or when it is authorised by law, or when you have given your consent.

Does Tala use automated processing and decision making?

1. Yes. Here are the uses of automated processing at Tala:
   • Scoring. Tala uses automated processing, including machine learning and data science, in our operations. When you open a Tala account and apply for a loan, our automated system will determine the amount that you can borrow, based on your profile and the data that we collect from you. We conduct thorough research and testing to keep our systems as fair and accurate as possible.
   • Fraud detection. Our systems are also used to detect and prevent fraud or other illegal uses of the Tala platforms. We may conduct further investigations on fraud patterns and potential unlawful activity. We may exercise all remedies available to us, including filing cases with courts or agencies.
   • Account Services. We may also use automated tools to manage your account, such as scheduled messages, auto dialers, pre-recorded calls, robocalls, chatbots, and self-service menus. We constantly work to improve these tools.
2. By expressing your acceptance of Tala’s Privacy Policy, you confirm that automated processing is necessary for Tala to perform its financial services contract with you, and you consent to such automated processing.
3. If Tala receives a request from you to reconsider an automated decision, we may evaluate your request and any supporting information or document that you are able to provide. Tala cannot guarantee that the decision will change.

How can I exercise my data subject rights? Where can I submit complaints related to data protection?

You (or your authorised representative) may send your data subject requests to ke-dpo@tala.co or hellokenya@talamobile.com. Each request is subject to review and evaluation. In some cases, we may ask for supporting documents. If you wish to withdraw your consent from processing or object to the automated processing of your data, Tala may not be able to provide you with our services. We may also close your Tala app account, with notice to you. We may deny your request if we have valid grounds, such as: if we need to comply with a legal obligation; if you have unpaid loans; or if we need to protect the rights of Tala or a third party. We will endeavor to resolve your requests within the time frame allowed under the regulations.

For how long will Tala retain my data?

• Tala will retain your personal data as long as your Tala account remains open.
• Tala may retain your personal data after your Tala account is closed. Being a registered reporting institution under the Proceeds of Crime and Anti-Money Laundering Act, as amended (POCAMLA), Tala has the obligation to retain certain records for a period of at least seven (7) years or such longer period as the FRC may require, from the date of the transaction or following the termination of an account or business relationship with Tala. To ensure Tala’s ability to comply with this obligation, Tala will retain relevant personal data associated with your account for a period of ten (10) years from the date of the closure of your Tala account.
• When the retention period expires, we will delete personal data. Tala may continue to store data in an anonymised form.
• We may keep your personal data for a longer period if we need to comply with a legal obligation or if we need to defend the rights of Tala or a third party.
• Tala may anonymise your information such that it will no longer be personal data. In such cases we may use anonymised information for any legitimate purpose.

Does Tala collect data of children?

No. Tala’s Services are not intended for children below the age of eighteen (18). We do not knowingly process data relating to children.

How does Tala protect my data?

• Tala implements an information security management system and privacy information management system that meets global standards. This includes policies, procedures, and practices that protect personal data.
• We enforce strong security measures across our company and our teams. We make sure that the tools and platforms that we use are secure and respectful of privacy.
• Our staff is trained and required to follow privacy principles in every data processing activity.