Privacy Policy

Information we collect

We collect only the data needed to open and operate your account, comply with the law, and keep your money safe:

• Account & identity data— your name, email address, phone number and the credentials you use to sign in.
• Know Your Customer (KYC) data— government identity documents, identification numbers and a selfie or biometric image, collected and verified through our identity verification provider to satisfy anti-money-laundering and Central Bank of Kenya requirements. We keep a copy of the identity images and details you submit during onboarding — including where an application is not completed or is declined — so we can review and resolve verification problems and improve the accuracy of our checks.
• Financial & transaction data— your account number, balances, transfers, payments and transaction history, held with and processed by our regulated banking partner.
• Device & technical data— IP address, device and browser type, and security logs used to detect fraud and keep the service secure.
• Communications— messages you send us for support, and records of those interactions.
• Product usage data— collected only if you opt in to analytics (see below).

How we use your information

• To create, operate and service your account.
• To process transfers, payments and other transactions you request.
• To verify your identity and meet our legal, regulatory and anti-money-laundering obligations.
• To detect, prevent and investigate fraud and other security threats.
• To provide customer support and respond to your requests.
• To review, troubleshoot and improve identity verification, including investigating why a verification did not pass.
• To improve the product, where you have opted in to analytics.

Legal bases for processing

Under the Kenya Data Protection Act, we process your data on the basis of: the performance of our contract with you; compliance with legal and regulatory obligations; our legitimate interests in securing and improving the service; and your consent, where we rely on it (for example, analytics). You may withdraw consent at any time without affecting processing carried out before withdrawal.

How we share your information

We do not sell your personal data. We share it only with parties who help us operate the service or where we are legally required to:

• Our banking partner, which holds your funds and processes your transactions under its banking licence.
• Our identity verification provider, to confirm your identity during onboarding (KYC).
• Cloud and infrastructure providers, who host the service and authenticate your sign-in on our behalf under strict confidentiality and security terms.
• Regulators, law enforcement and courts, where disclosure is required by law or to protect against fraud.

Analytics & advertising

When you opt in to analytics, OnLink collects anonymised product usage data (pages visited, feature clicks, transfer outcomes) to help us improve the product. Account numbers, balances, card data, KYC document numbers, OTPs and PINs are never collected for analytics. You can change your choice at any time from Settings → Privacy.

On our public marketing pages only, and only after you opt in, we also use the LinkedIn Insight Tagprovided by LinkedIn. It allows us to measure how our LinkedIn advertising performs and to show relevant ads to people who have visited our site. LinkedIn may process your IP address, the page you are viewing, your device and browser, and a LinkedIn cookie for this purpose. The tag is never loaded on sign-in, registration or any signed-in banking page. You can withdraw consent at any time from Settings → Privacy, and manage LinkedIn ad settings in your LinkedIn account.

On the same public marketing pages, and only after you opt in, we also use the Meta (Facebook) Pixelprovided by Meta Platforms. It allows us to measure how our Meta advertising performs. Meta may process your IP address, the page you are viewing, your device and browser, and Meta cookies for this purpose. If you arrived from a Meta ad and opted in, we additionally record which campaign brought you here and, when you open an account, tell Meta that a sign-up happened using irreversibly hashed contact details — never your financial data. The pixel is never loaded on sign-in, registration or any signed-in banking page. You can withdraw consent at any time from Settings → Privacy, and manage your ad settings in your Facebook account.

International data transfers

Some of our service providers process data outside Kenya. Where data is transferred internationally, we put appropriate safeguards in place as required by the Kenya Data Protection Act to ensure it remains protected.

Data retention

We keep your data for as long as you hold an account with us and for as long afterwards as we are required to by law — financial and KYC records are typically retained for at least seven years after your account closes, in line with Central Bank of Kenya and anti-money-laundering requirements. When data is no longer needed, we securely delete or anonymise it.

The identity images captured during onboarding — including for applications that are not completed or are declined — are held only as long as needed to review and resolve verification issues, and in any case are securely deleted within 90 days. This is separate from the KYC records held for account holders, which we and our banking partner retain for the longer periods required by law (typically at least seven years after an account closes).

How we protect your data

We protect your data with encryption in transit, strict access controls, audit logging and continuous security monitoring. Sensitive values such as passwords, PINs, OTPs and card numbers are never logged. Stored identity images are encrypted at rest and access to them is restricted to authorised staff and logged.

Your rights

Under the Kenya Data Protection Act you have the right to access your data, to correct inaccurate data, to request deletion, to object to or restrict certain processing, to data portability, and to withdraw consent. To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner.

Children’s privacy

OnLink is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app or by email.

Contact

Questions about this policy or your data? Email info@onlink.africa.