Privacy notice

1. Who is responsible for your data

PataSimu is a smartphone instalment service operated by MovaPay. When you fill in a form on this website, PataSimu decides what happens to the details you give and is therefore responsible for them in law.

[Registered entity name, company registration number, registered office address, and the entity's data-controller registration particulars — legal to confirm before publication.]

[Name and contact details of the person or office responsible for data protection enquiries, and whether a data protection officer is appointed — legal to confirm.]

2. What we collect, and when

We only ask for what we need at the step you are on. Nothing on this website asks you for card details, a bank account, a PIN or a mobile-money payment, and it never will — if a page claiming to be PataSimu asks you for any of those, it is not us.

When you simply browse

Our servers record the technical details every website receives: the address your connection comes from, the page you asked for, the time, and what kind of browser you used. We use this to keep the site running and to spot attacks. This website does not carry advertising trackers or third-party analytics.

When you start an application

We ask for your full name and your phone number, because an agent has to be able to find you and call you. We invite, but do not require, your email address (only so we can reply to you by email) and your national ID number. The ID number is optional here on purpose: your identity is checked in person, from your original document, at a PataSimu shop. We also record the phone and plan you were looking at, your preferred colour if you gave one, and the fact that you ticked the consent box and when.

When we confirm your number

We send a one-time code by SMS and record that a code was issued, when it expires, how many times it was tried, and whether it was used. We do not store the code itself — only a one-way scrambled version of it, which cannot be turned back into the code.

When you sign in to check an application

The same one-time code process, using the number you applied with.

When you contact us

Whatever you choose to tell us in a message, a call or a WhatsApp conversation.

3. Why we use it

To contact you about the application you started, and to arrange your visit to a shop.
To work out an indicative instalment plan for the phone you chose. This is a calculation on a price, not a judgement about you — no automated decision is made about you anywhere on this website, and nothing here decides whether you can have credit.
To confirm that the phone number given to us really belongs to the person giving it.
To stop our one-time code system being abused, and to protect the site.
To keep the records we are required to keep.

We do not sell your details. We do not use them to advertise to you, and we do not pass them to anyone for their own marketing.

4. Our legal basis

We rely on your consent for the details you type into the application form — that is what the tick box records, and you can withdraw it at any time. We rely on our legitimate interest in keeping the service secure for the technical records described above, and on our legal obligations for records we must retain.

[Confirmation of the lawful basis relied on for each processing purpose under the Data Protection Act 2019, and the legitimate-interests assessment where that basis is used — legal to confirm.]

Your details are seen by the PataSimu agents and shop staff who handle your application, and by MovaPay, which builds and runs the platform the service sits on. To send you a one-time code we have to pass your phone number to a messaging provider. Where any of these act on our instructions, they may only use your details for the job we gave them.

[The list of processors and sub-processors, the written processing contracts required by the Data Protection Act 2019, and the position on any transfer of personal data outside Kenya including the safeguards relied on — legal to confirm.]

6. How long we keep it

If you start an application and never confirm your phone number, the part-filled record is deleted automatically after 30 days.
One-time code records are deleted within a day of the code expiring.
A completed application is kept while we are dealing with it and for as long as the law requires afterwards.

[The retention period for completed applications and for signed agreements, and the statutory basis for it — legal to confirm.]

7. Cookies and this website

This website sets one cookie, named psw_session. While you are filling in an application it holds a short reference to the part-filled record, so the site knows which one you are working on. While you are signed in to check an application it also holds the phone number you signed in with, so the site can show you your own applications and nobody else's. It is removed when you sign out, and we do not use cookies for advertising or for tracking you across other websites.

8. Your rights

Under the Data Protection Act 2019 you can:

be told what we hold about you, and get a copy of it;
have anything wrong corrected;
ask us to delete what we hold;
object to us using it, or ask us to restrict how we use it;
ask for it in a form you can take elsewhere;
withdraw the consent you gave, at any time. Withdrawing consent does not undo anything we did lawfully before you withdrew it, but it stops us going further.

Asking costs you nothing and you do not have to give a reason. You can see most of what we hold yourself, at any time, by signing in with your phone number.

To make a request, contact us using the details on our contact page. Please tell us the phone number you applied with so we can find the right record.

[The dedicated postal address and email address for data-subject requests, and the response time we commit to — legal to confirm.]

9. How we protect it

Access to application records is limited to the staff and agents who need it for their work. One-time codes are stored scrambled rather than in readable form. Because this website never takes a payment, it never holds a card number, a bank account or a mobile-money PIN, so there is nothing of that kind here to lose.

10. Children

PataSimu instalment plans are for adults. We do not knowingly collect personal data from anyone under 18 through this website. If you believe a child has given us their details, tell us and we will delete them.

11. Complaints

If you are unhappy with how we have handled your personal data, tell us first and give us a chance to put it right. If you are still not satisfied, you have the right to complain to the national data protection authority.

[Name, postal address, telephone number and email of the supervisory authority to which a data subject may complain, together with PataSimu's own internal complaints procedure and timescales — legal to confirm. Deliberately not named here: publishing a regulator's details before our own registration position is settled risks reading as a claim to be registered with them.]

12. Changes to this notice

When this notice changes we update the date at the top of the page. If a change affects how we use details you have already given us, we will tell you.

[Effective date, version control and the mechanism for notifying material changes to existing customers — legal to confirm.]