Privacy policy.

1. Our role: controller and processor

For data you give us directly — when you book a demo, contact us, apply for a role, or administer an account — ResolveIT is the data controller.

For borrower, buyer and case data that a lender, SACCO or auctioneer uploads to operate a recovery case, ResolveIT acts as a data processor, handling that data only on the documented instructions of that institution (the controller) under a written data-processing agreement.

2. Personal data we collect

• Account and identity: name, work email, phone, institution, role, and authentication data for platform users.
• Recovery case data (as processor): borrower and counterparty identifiers, contact details, loan and collateral information, notices, consent records, offers and bids, provided by the originating institution.
• KYC / AML data: verification information for buyers, bidders and counterparties where required by law.
• Usage and technical: device, log, and cookie data needed to operate and secure the service.
• Communications: messages, enquiries and support requests you send us.

3. How we use personal data and our lawful basis

We rely on the lawful bases set out in the Act: performance of a contract; compliance with a legal obligation; your consent; and our legitimate interests (or those of the controlling institution), balanced against your rights.

Specifically we process data to provide and secure the platform, generate and track statutory notices, record consent, facilitate compliant resolution and auctions, meet AML/KYC and recordkeeping obligations, and respond to you. Lawful basis is recorded per event in our immutable ledger.

4. When we share personal data

We do not sell personal data, and we do not use it for advertising.

• With the institution that controls a given recovery case, and the counterparties to that case (lender, borrower, buyer, auctioneer) to the extent each needs to participate.
• With service providers who process data on our behalf under contract (for example hosting, communications, verification).
• With regulators, courts, and law-enforcement where required by law or to establish or defend legal claims.

5. Storage location and international transfers

Personal data is hosted in-country. Where any processing or transfer outside Kenya is necessary, we do so only with the safeguards required by sections 48 to 49 of the Act: an adequacy basis, appropriate contractual protections, or your explicit consent.

6. Retention

Recovery and compliance records are retained for the period required by applicable statutory recordkeeping and audit obligations, after which they are deleted or irreversibly anonymised. Account and marketing data is kept only as long as needed for the purpose collected. Controlling institutions set retention for case data under their processing agreement.

7. Security

We protect personal data with encryption in transit and at rest, role-based access with audit logging, and a tamper-evident event ledger. See our Security overview for detail. No system is perfectly secure, but we maintain controls proportionate to the sensitivity of the data we handle.

8. Your rights

Subject to the Act, you have the right to be informed; to access your data; to rectification; to erasure; to restrict or object to processing; and to data portability. Where we rely on consent, you may withdraw it at any time.

For case data we hold as a processor, we will route your request to the controlling institution. To exercise a right, contact our Data Protection Officer below; we respond within the timeframes set by the Act.

9. Automated decision-making

ResolveIT does not make decisions producing legal effects about you based solely on automated processing. Classification and provisioning figures shown in the platform originate from the controlling institution's systems; ResolveIT does not generate them.

10. Cookies

We use strictly necessary cookies to operate and secure the site, and limited analytics cookies where you consent. See our Cookie Notice for the full list and your choices.

11. Children

The platform is for institutional and professional users and is not directed at children. We do not knowingly collect data from anyone under 18.