InstarCash

Introduction

Welcome to the Instar Cash APP! Instar Cash (hereinafter referred to as “we”) deeply understands the importance of personal information to you. Therefore, we highly value the protection of your privacy and personal information. We will explain how we handle your personal information when you use the products/services of the Instar Cash platform through the “Instar Cash Privacy Policy” (hereinafter referred to as “this Policy”), and how we provide you with access, update, deletion, and protection of this information in accordance with legal and regulatory requirements. [Special Reminder] Before you use the products/services of the Instar Cash platform, please be sure to read and fully understand this Policy, especially the terms in bold, which you should focus on reading. You should start using the products/services of the Instar Cash platform after confirming that you fully understand and agree to this Policy. If you or your guardian (if you are a minor) do not agree with any content of this Policy, you will not be able to use the products/services of the Instar Cash platform. If you have any questions, opinions, or suggestions about the content of this Policy, you can contact us through the contact information provided in Article 9 of this Policy.

Please pay special attention to the scope of application of this Policy: This Policy applies to all products and services provided by the Instar Cash platform. If the products/services of our company and affiliated companies use the products/services provided by the Instar Cash platform but do not have an independent privacy policy, this part of the products/services also applies to this Policy. If the products/services of our company and affiliated companies have an independent privacy policy, the independent privacy policy takes precedence. For matters not mentioned in the independent privacy policy but are covered by this Policy, this Policy shall apply.

Entry into force: 18 June 2024

Part One: Definitions

Instar Cash Loan/We: Refers to WHITEPATH COMPANY LIMITED, the company that develops and operates the Instar Cash loan platform [Registered Address:Britam Tower 3rd floor Longonot Rd, Nairobi, Kenya.].
Instar Cash app: Refers to the Instar Cash loan webpage and client (including App or H5 pages), applicable to terminal devices including but not limited to PCs, tablets, mobile phones, etc.
Affiliated Company: Refers to a company that is directly or indirectly controlled by one party; or directly or indirectly controls one party; or jointly controls a company or can exert significant influence on it with one party; or is controlled directly or indirectly by the same company as one party. This includes but is not limited to the parent company, subsidiaries, or subsidiaries controlled by the same parent company as one party; joint ventures, and associated enterprises of one party. Here, “institution” refers to any company, enterprise, or other legal entity; “control” refers to the ability to influence the management of the mentioned institution directly or indirectly through ownership, voting shares, contracts, or other ways recognized by the People’s Court.
User/You: Refers to natural persons who access or use the products/services provided by the Instar Cash loan platform, including registered and unregistered users.
Personal Information: Refers to various information recorded electronically or otherwise that can identify a specific natural person alone or in combination with other information or reflect the activities of a specific natural person.
Sensitive Personal Information: Refers to personal information that, if leaked, illegally provided, or misused, may endanger personal or property safety, and is highly likely to lead to personal reputation damage, physical and mental health damage, or discriminatory treatment. Sensitive personal information involved in this Policy includes personal basic information, occupational information, family relationships, contacts, financial account information, etc.
Personal Information Deletion: Refers to the act of removing personal information involved in daily business functions from the system, making it unsearchable and inaccessible.
Child: Refers to minors under the age of fourteen.
Minor: Refers to natural persons under the age of eighteen. Minors over the age of sixteen whose primary source of livelihood is their own labor income are considered persons with full civil capacity.

Part Two: Privacy Policy

This privacy policy aims to explain and help you understand the following:

How we collect and use your personal information
How we use cookies and similar technologies
How we share, transfer, entrust processing, and disclose your personal information
How we store your personal information
How we protect the security of your personal information
How we protect the personal information of minors
Your personal Information rights
Commitment to non-malicious software
How This Privacy Policy Is Updated
How to contact us

1. How We Collect and Use Your Personal Information

We may collect the following information about you:

Name
National ID
Gender
Birthday
Marriage Information
Education Information
Occupation Information
Address Information
Income Level
Debt Information
Social Information
Purpose of loan
Emergency contact information

When you use our products/services, you need to authorize or can choose to authorize us to collect and use your personal information in the following situations:

Basic Functions: To provide you with our products/services’ basic functions, you need to authorize us to collect and use necessary information. If you refuse to provide the necessary information, you will not be able to use our products/services properly.
Additional Functions: To provide you with additional functions of our products/services, you can choose to authorize us to collect and use information. If you refuse to provide such information, you will not be able to use related additional functions or achieve the intended functionality, but it will not affect your use of the basic functions of our products/services.

Please note that due to the variety of products and services we provide, we will collect and use your personal information based on the specific products/services you choose, adhering to the principles of “reasonableness, legitimacy, and necessity,” and only collecting and using the minimum necessary personal information required to provide you with products/services. Furthermore, you understand and agree that to provide you with better products and services, we may introduce new or optimized functions from time to time, which may involve the collection and use of personal information for new purposes, scopes, and methods. In such cases, we will notify you separately through updates to this policy, pop-ups, or in-app messages, explaining the purposes, scopes, and methods of collecting and using the corresponding information, and providing you with the option to agree or disagree. We will only collect and use the corresponding information after obtaining your explicit consent. During this process, if you have any questions, comments, or suggestions, you can contact us through the contact information provided in Article 10 of this policy.

1.1 Helping You Register and Manage Your Instar Cash Loan Account

1.1.1 Account Registration

If you want to use the products/services of the Instar Cash loan platform, you first need to register a Instar Cash loan account to become a member of the Instar Cash loan platform. To create an account on the Instar Cash loan platform, we need to collect your mobile phone number to identify your online identity on the Instar Cash loan platform. If you refuse to provide a mobile phone number, we will not be able to create an account for you on the Instar Cash loan platform and provide services. Under the same account, we may associate the information collected from your various devices to provide you with consistent services. If you refuse to provide the necessary information, you may not be able to use our services properly.

1.1.2 Account Login

When you first use a mobile phone number to log in to the Instar Cash loan platform, to comply with legal requirements and protect your account security, we will send you a one-time verification code to verify your identity.

1.1.3 Information Maintenance and Account Management

To maintain your personal information and enhance your service experience, we will keep your information confidential.

1.2 Providing Security Functions

1.2.1 Real-name Authentication and Management

When using Instar Cash loan services (including credit services, payments, and repayments), you need to provide and allow us to collect your identity information (including name, gender, nationality, occupation, residence, identification document type, number, marital information, work information, emergency contact information), bank card or third-party payment account information, and mobile phone number. We will submit this information to legal identity verification agencies to verify its accuracy. This information is considered sensitive. According to kenyan regulations on financial services, if you do not provide the required information for real-name authentication, you will not be able to use the products or services of the Instar Cash loan platform.

1.2.2 Security Guarantee

To ensure the stability and security of the system when you use our products/services, prevent unauthorized access to your personal information, more accurately prevent fraud, and protect account security, we need to collect your transaction information (transaction scenarios, transaction amounts, transaction times), log information, device application installation list, location information, Instar Cash financial account ID, IMEI, IMSI, Android ID, boot_id, device basic information (brand, model, system version, storage space, screen resolution), MAC address, network type/network status, device-connected wireless network information (SSID/BSSID/status/list), IP address, application running process information. If you refuse to provide such information, you may not be able to use our services properly.

1.2.3 Credit Assessment

When using credit services on the Instar Cash loan APP or applying for credit limits, to accurately assess your creditworthiness, repayment ability, and prevent fraud, you need to voluntarily provide your name, identification number, address, occupation and work information, education information, bank card number, mobile phone number, emergency contact information, income information, email address, marital status, and device information. If you refuse to provide such information, we cannot assess your eligibility, creditworthiness, and repayment ability, and thus cannot provide the required services.

1.3 Customer Service and Dispute Resolution

To ensure your account security, our customer service will use your account information (registered mobile number), identity information (name, identification number), and order information to verify your identity. When you need customer service related to your transactions, we will query your identity information, transaction information, behavior information, browsing information, commonly used device information, or software information from the backend, as well as any information you provide during contact with customer service. If you request customer service assistance in modifying information (such as personal information, contacts, or phone numbers), you may need to provide additional information. If you refuse to provide such information, you may not be able to use our services properly. When you contact us, we may keep a record of your communication/call and related information to contact you, help resolve issues, or record solutions and results. Such recordings will be automatically deleted after the minimum necessary retention period required by law (30 days), unless retention is required for compliance or legitimate interests.

1.4 Loan and Repayment Processing

When using Instar Cash loan services for borrowing or repayment, depending on the service, you need to provide bank card numbers or mobile phone account information. If you refuse to provide such information, you may not be able to use our services properly.

1.5 Providing Product/Service Information

We will send the latest information about products or services, including Instar Cash loan product information, promotional information, etc., via in-app messages, pop-ups, SMS, email, or phone. If you choose not to receive such information, you can turn off the notifications or contact customer service to cancel. Turning off notifications will not affect your use of the basic functions of the Instar Cash loan platform.

1.6 Order Management

When you are ready to order products/services on the Instar Cash loan platform, the system will automatically generate a loan order. During order management, we may collect the following information:

Information required for the loan product/service you selected;
Emergency contact name and phone number;
Order information generated during the use of Instar Cash loan platform products/services.

We collect this information to help you complete transactions, payment settlements, receive notifications, help query and manage order information, and provide customer service. We will also use your order information to determine if there are any abnormalities in your transactions to protect your transaction security. For example, when using financial products and services, you need to provide and allow us to collect your identity information (which may include name, gender, identification document type), bank card or third-party payment account (mobile account) information, mobile phone number, and basic personal information according to loan product requirements. If you do not provide the required information for real-name authentication, you will not be able to use financial products or services. Further necessary information may be required to complete the use of loan products and services, and specific information will be displayed, prompted, or authorized in the loan process, so please read carefully.

1.7 Device Permission Instructions

To enhance the user experience, you can use additional functions based on the permissions of your mobile device’s operating system. If you do not enable these permissions or provide personal information collected through these permissions, you can still complete bookings and related services on the Instar Cash loan platform. Note that these permissions may vary depending on the mobile device’s operating system. Enabling any permission means you authorize us to collect and use relevant personal information to provide corresponding services. Disabling any permission means you cancel the authorization, and we will no longer collect and use corresponding personal information or provide services related to that permission. However, disabling permissions does not affect the information collected and used based on your previous authorization. You can check the permissions that the Instar Cash loan platform may request and use through the terminal device permission instructions.

Android System Application Permission Instructions:

Location

Collection of data content:

We need access to users’ rough location data to ensure the security of their accounts and our platform. By knowing a user’s rough location, we can identify and prevent potential offshore money laundering, illegal access, and other offences. This permission helps us to protect the privacy of our users by not accessing or storing their precise location information while securing our services.

Use of Data:

Account Security and Fraud Prevention

Preventing Unusual Logins and Accesses: When a user attempts to log in or access the service from a location different from their usual area of activity, the app can use rough location data to identify and flag these unusual behaviours. This helps prevent unauthorised offshore access, which in turn protects user accounts from fraud or hacking.

Detecting Multiple Accounts or Money Laundering: If a user exhibits inconsistent patterns of behaviour across multiple geographies, coarse location permissions can help identify potential multiple account operations or money laundering activities. These behaviours typically involve suspicious transactions or accesses being made simultaneously in different regions.

Regulatory and Compliance Requirements

Compliance with Geographic Restrictions or Legal Requirements: Use of the Services may be subject to legal or compliance requirements in Kenya. By collecting rough location information about users, the Application can ensure compliance with local laws and prevent users from using the Services in restricted areas.

Risk Management and Monitoring

Real-time Risk Monitoring: For certain high-risk activities, such as fund transfers, large transactions, etc., the app can utilise the Rough Location permission to monitor in real-time whether these operations are coming from the user’s regular activity area. If behaviour from unintended areas is detected, the app can take immediate action, such as freezing the account, sending an alert or requesting additional authentication.

Data Security:

User data is stored on our servers (https://app.instarcash.xyz) via Https encrypted transmission. We do not share it with any third party without the user’s explicit permission.

Calendar

Collection of data content:

We collect data from the user’s mobile phone calendar, including the calendar event title, calendar event description, and calendar event start and end times

Usage Data:

We collect the user’s calendar time in order to remind the user at the appropriate point in time to prevent the user’s credit from being adversely affected by forgetting to make a payment

Data Security:

User data is stored on our servers (https://app.instarcash.xyz) via Https encrypted transmission. We do not share it with any third party without the user’s explicit permission.

SMS Collection of data content: We collect all SMS data from users, but only focus on SMS related to their financial transactions. This includes information such as the content of the SMS, the number from which the SMS was sent, and when the SMS was sent. Use of data: We only read, screen, and analyse a user’s SMS data when we are assessing the user’s credit risk and conducting anti-fraud analysis. 1.Credit assessment: We will analyse finance-related SMS data to assess your credit score and repayment ability. This helps us to provide you with the right loan product and interest rate. 2. Operational processes and improve account security. Risk Management and Fraud Detection: We will use SMS data to detect possible unusual activity or fraud to help ensure the security of your account and personal information. Data security: User data is stored on our servers (https://app.instarcash.xyz) via Https encrypted transmission. We will not share it with any third party without the user’s explicit permission.
Application List Collection of data content: We collect information about third-party apps installed on the user’s mobile phone, including, but not limited to, app name, app package name, version information, date of installation, calendar of recent updates, list of permissions requested by the app, and other information. Usage Data:
1. to detect potential security threats: In order to protect the security of the User’s account, we collect and analyse the list of apps installed on the User’s device. This information helps us to identify possible malware or other suspicious apps on the device so that we can take the necessary protective measures to prevent these apps from posing a threat to the user’s personal data and account security.
2. Ensure app compatibility: We collect app list data also to ensure that our apps are compatible with other apps on the user’s device. By knowing what apps users have installed, we are better able to optimise our services, avoid possible conflicts and provide a smoother user experience. Data Security: User data is stored on our servers (https://app.instarcash.xyz) via Https encrypted transmission. We do not share it with any third party without the user’s explicit permission.
Contacts Collection of data content: Before providing information about an emergency contact, the user is required to confirm that consent has been obtained from the emergency contact. The information we collect includes the name and telephone number of the emergency contact provided by the user and their relationship to you. Use of data: We will only contact the user’s emergency contact in compliance with the requirements of relevant laws and regulations, for example, when the user is at risk of potential fraud, we will provide the user with the opportunity to be aware of the safety of their funds through the emergency contact. Data security: User data is stored on our servers (https://app.instarcash.xyz) via Https encrypted transmission. We will not share it with any third party without the user’s explicit permission.

By using our products/services, you consent to the collection and use of your information according to this privacy policy. If you have any questions or concerns, please contact our customer service team.

1.8 Improving Instar Cash Loan Platform Products/Services

(1) We may conduct de-identified research, statistical analysis, and predictions on the collected information to improve the content and layout of the Instar Cash loan platform, support product or service for business decisions, and enhance our products and services.

(2) We may use your order data for data analysis to understand your location, preferences, and demographic information, or to match it with data from other sources (including third parties) to develop and improve our products and services.

(3) We may invite you to participate in market surveys through the contact information you provide. Based on the information you provide in the market surveys, we will analyze and measure your interest in our products, services, and website, thereby developing and improving our products and services. If you choose not to participate in market surveys and provide relevant information (based on the specific market survey display page), it will not affect your use of the basic functions of the Instar Cash loan platform.

1.9 Special Instructions on Collecting and Using Your Personal Information

(1) If the information you provide contains personal information of other users, for example, when you order products/services for others through the Instar Cash loan platform, you need to submit the personal information of the actual orderer, or if the information you actively upload through the Instar Cash loan platform involves the personal information of other users, you must ensure that you have obtained their consent and that they are aware of and accept this policy before providing such personal information to the Instar Cash loan platform. If it involves the personal information of children, you need to obtain the consent of the corresponding child’s guardian in advance. Unless it meets the exceptions for obtaining authorized consent (see “I. How We Collect and Use Your Personal Information” in this policy), we will process sensitive personal information in certain scenarios in accordance with legal regulations and national standards, and obtain your separate consent through reasonable means. The specific method of separate consent will be displayed on the specific functional page.

(2) If we use the information for purposes not specified in this policy, or if we use the information collected for a specific purpose for other purposes, we will obtain your authorized consent again.

(3) With your consent, we may also obtain your personal information from affiliates, partners, credit agencies, and other third parties that legally hold your relevant information for the purposes of real-name management, security protection, and credit evaluation services. Since different products or services require different personal information, we will obtain your consent through page prompts, interactive processes, etc., before you use specific products or services. The scope of personal information obtained will be based on the specific product or service agreement or rules you agree to. For example, when you apply for a credit loan with our affiliates or business partners, our affiliates or business partners will pass your loan amount, interest rate, and approval progress to us so that we can promptly display the basic loan situation to you. We will require third parties to explain the source of your personal information before collecting it and confirm the legality and compliance of the source of such personal information. We will also understand the scope of authorization consent for the personal information collected by the third parties. If the purpose of collecting and using your information exceeds the scope of authorization obtained by the third parties, we will obtain your consent again before processing your personal information. As our products and services are continuously updated, if a product or service is not specified in the aforementioned content but collects your information, we will explain the information collection content separately through page prompts, interactive processes, website announcements, etc., to obtain your consent. This information is subject to the terms of this privacy policy.

(4) Exceptions to Authorized Consent

You fully understand that, according to legal requirements, we do not need to obtain your authorized consent for the collection and use of your personal information in the following situations:

Necessary for the performance of Instar Cash’s statutory duties or obligations;
Related to national security or national defense security;
Related to public safety, public health, or significant public interests;
Related to criminal investigations, prosecutions, trials, and enforcement of judgments;
Necessary for the conclusion or performance of a contract to which you are a party;
In emergency situations, necessary for protecting the life, health, and property of you or other individuals;
Personal information that is disclosed by the personal information subject to the public or other legally disclosed personal information;
Personal information collected from legally disclosed information, such as legal news reports, government information disclosures, etc.;
For public interest purposes such as news reporting and public opinion supervision, processing personal information within a reasonable scope;
Necessary for maintaining the safe and stable operation of the products or services provided, such as detecting and handling product or service failures;
Necessary for academic research institutions to conduct statistical or academic research based on public interests, and when providing academic research or descriptive results to the public, the personal information contained in the results is de-identified;
Other circumstances stipulated by laws, regulations, and national standards.

Please be aware that according to applicable laws, if we take technical measures and other necessary measures to process personal information so that the data recipient cannot re-identify a specific individual and cannot restore it, the use of such processed data does not require further notification and consent from you.

This privacy policy only applies to situations where we need to process your personal information to provide you with Instar Cash loan APP products and services.

2. How We Use Cookies and Similar Technologies

(1) To ensure you can normally use our services or receive higher quality services, we will store small data files called Cookies on your device. When users visit a site that requires login for access to information or services, we will encrypt and store the user’s login name in the Cookie file on the user’s device. Since this is irreversible encrypted storage, even if others can use the user’s computer, they cannot identify the user’s username and password. Users do not need to do any extra work; all collection and storage are done automatically by the system. We will not use cookies for any purposes other than those described in this privacy policy.

(2) You have the right to accept or reject Cookies. If your browser automatically accepts Cookies, you can modify your browser settings to reject Cookies according to your needs. Please note that if you choose to reject cookies, you may not be able to fully use the services we provide to you.

(3) In addition to Cookies, we also use pixel tag technology on our website to monitor the effectiveness of ad placements. With pixel tags, we can better understand whether our ads have been viewed by users.

3.1.1 Processing Principles

We may share your order information, account information, and device information with third parties such as partners to ensure the smooth completion of the services we provide. However, we will only share your personal information for lawful, legitimate, necessary, specific, honest, and clear purposes, and will only share the personal information necessary for providing the service. We will evaluate the legality, legitimacy, and necessity of the third parties’ collection of your personal information, and require third parties to process your personal information within the scope of your authorization, taking necessary information management measures and technical means to prevent leakage, damage, loss, or tampering of your personal information. Third parties are not allowed to use the shared personal information for any other purposes; if they wish to change the purpose or method of processing personal information, they must obtain your renewed consent.

Unless it falls under the exceptions for obtaining authorization (see “How We Collect and Use Your Personal Information” in this policy), we will, in accordance with legal regulations and national standards, obtain your separate consent for sharing and provision of personal information in scenarios other than those mentioned above. Regardless of whether separate consent is required, we will reasonably inform you about the third-party suppliers providing the products/services involved and the purposes, methods, and categories of processing your personal information. The specific form of separate consent will be as displayed on the service page.

3.1.3 Our Partners Include the Following Types:

(1) Financial Institutions and Third-party Payment Institutions: When you generate a loan order or apply for a refund, we will share specific order information with financial institutions or third-party payment institutions. If we deem it necessary for fraud detection and prevention, we will further share other necessary information, such as IP addresses, with relevant financial institutions. When you use our credit products, we will share your identity information, contact details, bank account information, and other information required to meet the risk control requirements of partner financial institutions to provide the services you need. Before using such services, we will separately inform you of the relevant personal information sharing rules and obtain your consent through page prompts, interaction processes, or online agreements.

(2) Business Partners: We may share necessary personal information with partners to provide you with products or services, including courier services, communication services, customer service, marketing, advertising, technical services, real-name authentication services, consulting services, etc. For example, to provide you with better services, we may entrust advertising service partners with handling information related to ad coverage and effectiveness (such as unique device identifiers), but will not provide your personal identity information, or we will anonymize the information so that it does not identify you personally. These partners may combine this information with other legally obtained data to perform the advertising services we commissioned. To provide you with service information or commercial information pushes, we may provide your phone number and proposed push content to SMS service providers; of course, you can set to turn off commercial information push functions, and we will stop sending commercial information to you once the function is turned off.

(3) Affiliated Companies: We may share necessary personal information with our affiliated companies to provide you with travel-related or other products or services. They will take protection measures that are no less strict than those in this policy. Please note that for the purpose of preventing and detecting fraud, we may also cautiously provide necessary personal information to business partners and affiliated companies. This information sharing will undergo strict internal security assessments and approvals, and the use of this information will be limited by signing relevant agreements.

3.2 Information Transfer

We will not transfer your personal information to any company, organization, or individual except in the following cases:

(1) With your explicit consent or authorization in advance;

(2) As required by applicable laws, regulations, legal procedures, or mandatory administrative or judicial requirements;

(3) In the event of mergers, splits, acquisitions, asset transfers, or similar transactions involving personal information transfer, we will inform you of the name and contact details of the receiving company or organization before the formal transfer of information and require the new holder of your personal information to continue to be bound by this policy and to continue to fulfill the personal information processing obligations originally undertaken by us. Otherwise, we will require the company or organization to seek your authorization again.

3.3 Public Disclosure

We will only disclose your personal information under the following circumstances:

(1) At your request, with your separate consent, and according to the disclosure method you approve, disclose the personal information you designate;

(2) As required by laws, regulations, mandatory administrative enforcement, or judicial requirements, we may disclose your personal information according to the type and method of disclosure required. In compliance with laws and regulations, when we receive such disclosure requests, we will require the provision of corresponding legal documents, such as subpoenas or investigation letters.

4. How We Store Your Personal Information

4.1 Storage Principles

We do not transfer your personal information to any company, organization, or individual except in the following cases:

(1) With your explicit consent, we transfer your personal information to others;

(2) As required by applicable laws, regulations, legal procedures, or mandatory administrative or judicial requirements;

(3) In the case of mergers, acquisitions, or bankruptcy liquidation, if personal information transfer is involved, we will require the new company or organization holding your personal information to continue to comply with this policy, or we will require that company or organization to seek your authorization again.

4.2 Storage Duration

We retain your information only for the period necessary for the purposes described in this policy and for the minimum duration (90 days), or within the time limits required by laws and regulations.

For example, when you use the registration function on the Instar Cash lending platform, we need to collect your phone number and retain it while you use the function to provide you with normal service, ensure the security of your account and system. After the above storage period has elapsed, or if you exercise your right to delete personal information or cancel your account, we will delete or anonymize your personal information.

However, in the following cases, we may adjust the storage time of personal information to comply with legal requirements:

(1) To comply with applicable laws and regulations;

(2) To comply with court judgments, rulings, or other legal procedures;

(3) To comply with the requirements of relevant government agencies or legally authorized organizations;

(4) For maintaining public interest, and protecting the personal and property safety or other legal rights of Instar Cash platform users, our company, our affiliated companies, other users, or employees.

4.3 Termination of Operations

If we cease operation of the Instar Cash lending platform products or services, we will promptly stop the collection of your personal information. We will notify you of the cessation of operations either individually or through announcements and will delete or anonymize the personal information we hold.

5. How We Protect Your Personal Information Security

5.1 Security Measures

We have implemented industry-standard security measures to protect the personal information you provide from unauthorized access, disclosure, use, modification, damage, or loss. We take all reasonable and feasible measures to safeguard your personal information, including but not limited to:

(1) Encryption Technology: When storing your information, we use encryption technology to ensure the confidentiality of the data and employ trusted protection mechanisms to prevent malicious attacks;

(2) Data Security in Use: When using your personal information, such as displaying it to you, assessing and analyzing it, or during internal data transfers, we use methods like content replacement and anonymization to enhance security;

(3) Data Encryption: When sharing your personal information externally, such as identity or bank card information, we use various data desensitization techniques for encryption based on the specific data being protected;

(4) Special Security Measures: Given the specific requirements for personal information security in the financial services sector, we ensure the safety of transactions and personal information through comprehensive security management, policies, processes, and network architecture.

5.2 Security Protocols

(1) Access Control: We implement access control mechanisms to ensure that only authorized personnel can access personal information and that they have signed confidentiality agreements;

(2) Monitoring and Logging: We strictly monitor processes and retain data access logs or other technical records for a reasonable period to track internal information security;

(3) Training and Audits: We conduct security and privacy protection training courses to enhance employees’ awareness of the importance of personal information protection and perform personal information security audits;

(4) Code and Log Analysis: We use code security checks and data access log analysis techniques for personal information security audits;

(5) Information Minimization: We take all reasonable and feasible measures to ensure that we do not collect irrelevant personal information. We retain your personal information only for the duration necessary to achieve the purposes described in this privacy policy, unless a longer retention period is required or permitted by law.

5.3 Incident Handling

In the event of a personal information security incident, we will handle it in accordance with legal requirements and follow these rules:

(1) Notification: We will promptly inform you of the basic situation and possible impact of the security incident, the measures we have taken or will take, suggestions for mitigating and reducing risks on your own, and any remedial actions;

(2) Communication: We will notify you of the incident details via email, letter, phone, push notifications, or other means. If it is difficult to individually inform all data subjects, we will use reasonable and effective methods to publish a notice;

(3) Reporting: We will also report the handling of the personal information security incident to the regulatory authorities as required;

(4) Service Termination: If we terminate services or operations, we will notify you at least thirty days in advance through an announcement and delete or anonymize your personal information after the termination of services or operations;

(5) Legal Liability: If your legal rights are harmed, we will assume corresponding legal responsibilities.

6. How We Protect the Personal Information of Minors

(1) Protection of Minors’ Information: Instar Cash values the protection of minors’ personal information. If you are under the age of 18, we will refuse to provide our services to you.

(2) Consent Verification: If it is proven that a minor has registered and used our services without parental consent, the guardian can contact Instar Cash customer service 011-566-2800. We will promptly delete the relevant personal information of the minor after verification.

(3) Contact for Concerns: If you have any questions, suggestions, or complaints regarding children’s personal information, please contact us using the details provided in the “How to Contact Us” section of this policy.

7. Your Personal Information Rights

In accordance with relevant laws and regulations in Kenya, we guarantee your rights to your personal information, including the following:

7.1 Access and Query Your Personal Information

You have the right to access your personal information, except in cases where exceptions are provided by law. If you wish to exercise your right to access, you can do so by:

Accessing and viewing your account’s billing information by following the path “【Homepage】—【Billing】.“

7.2 Correct Your Personal Information

If you find any errors in the personal information we process about you, you have the right to correct it. You can contact us via customer service 011-566-2800, and we will verify and process your request within fifteen working days.

7.3 Change the Scope of Your Authorization or Withdraw Your Authorization

You can change the scope of your authorization for us to continue collecting your personal information by disabling certain device functions (such as SMS, contacts) through the following path: “【Homepage】—【Profile】—【Settings】—【Privacy Settings】—【Permission Management】.” You can also withdraw your authorization by canceling specific products or your Instar Cash loan account. Please understand that each business function requires some basic personal information to be completed. After withdrawing authorization, we will not be able to continue providing the corresponding services. However, your decision to withdraw authorization will not affect previous personal information processing based on your authorization. If the services you use are not yet concluded, such as an outstanding loan, you may not be able to withdraw your authorization until the service ends.

7.4 Delete Your Personal Information

(1) If you need to change your bank card information, you can contact us via customer service 011-566-2800 to correct it.

(2) You can request the deletion of your personal information by contacting customer service if:

Our processing of personal information violates laws and regulations;
We collect or use your personal information without your consent;
Our processing of personal information violates our agreement with you;
You no longer use our products or services, or you have canceled your account;
We terminate services and operations.

If we decide to respond to your deletion request, we will also notify the entities that have obtained your personal information from us to delete it unless otherwise provided by laws and regulations or authorized independently by you. Once you delete information from our services, it may not be immediately removed from backup systems, but it will be deleted during backup updates.

7.5 Cancel Your Instar Cash Loan Account

You can cancel your account through the Instar Cash loan app by following the path “【Homepage】—【My】—【Account and Security】—【Account Closure】” or by contacting customer service. We will verify and process your request within fifteen working days. After canceling your account, we will delete or anonymize your personal information, except for information that must be retained according to laws, regulations, or regulatory requirements. During the period of service use, we will continue to store and process information as required by law and cooperate with authorized bodies for inquiries.

7.6 Unsubscribe from Service Notifications

(1) To keep you informed about the status of Instar Cash loan services, we will send you service reminders. You can unsubscribe by contacting customer service. For security and credit protection purposes, business notification messages cannot be unsubscribed.

(2) We may comprehensively analyze and process your information to improve our service quality and provide you with better services, or to help us evaluate, improve, or design products, services, and marketing activities. We may send you marketing notifications, commercial electronic information, or advertisements. If you do not wish to receive such information, you can unsubscribe by contacting customer service.

(3) In certain business functions, after notifying you and obtaining your consent, we may make decisions based solely on automated decision-making mechanisms, including information systems and algorithms. If you believe these decisions significantly affect your legitimate rights and interests, you have the right to raise your concerns through the contact methods provided in section 9 of this policy. We will respond to your request within fifteen working days.

7.7 Obtain a Copy of Your Personal Information

If you need a copy of your personal information, you can contact us through the contact methods provided in section 9 of this policy. After verifying your identity, we will provide you with a copy of your personal information in our services (including basic information and identity information), unless otherwise provided by laws and regulations or this policy.

7.8 Transfer of Personal Information

If you need to transfer your personal information to a designated personal information processor, you can contact us through the contact methods provided in section 9 of this policy. After verifying your identity, if the transfer meets the conditions specified by the national cybersecurity authorities, we will provide a means for transferring your personal information. We will also take necessary information management measures and technical means to ensure the safety of the transfer process, preventing leaks, damage, loss, or alteration of your personal information.

7.9 Responding to Your Requests

For any inquiries, suggestions, opinions, and complaints, you can contact our customer service through the customer hotline 011-566-2800. We will process your request after necessary identity verification, and the verification and processing will be completed within fifteen working days at the latest. For reasonable requests, we generally do not charge fees. However, according to relevant laws, regulations, and national standards, we will not be able to respond to your request in the following situations:

(1) Related to national security and defense security;

(2) Related to public safety, public health, and major public interests;

(3) Related to criminal investigations, prosecutions, trials, and judgments;

(4) There is sufficient evidence that you have subjective malice or abuse of rights;

(5) For the protection of your or other individuals’ life, property, and other significant legitimate rights and interests where it is difficult to obtain your consent;

(6) Responding to your request will cause serious damage to the legitimate rights and interests of other personal information subjects or individuals and organizations;

(7) Involving commercial secrets.

7.10 Your Right to Know

You have the right to know how your personal data is being shared. We will notify you in the following situations:

Prior Notification: We will notify you in advance and obtain your consent before sharing your data with new types of third parties or using your data in new ways.
Privacy Policy Update: If there are significant changes in our data-sharing practices, we will update this privacy policy and notify you through our app or other appropriate means.

7.11 Exercising Your Right to Refuse

You have the right to refuse the following processing activities of your personal data:

Targeted Advertising: If you do not wish for your data to be used for targeted advertising, you can opt-out by contacting us.
Data Sharing: You can refuse us from sharing your personal data with certain third parties, unless such sharing is necessary to provide services or required by law. Send email to whitepath2022@gmail.com. specifying the data processing activities you wish to refuse.
By Phone: You can contact our customer support team by calling 011-566-2800 to submit your refusal request.

Commitment to non-malicious software

We understand the importance of user privacy and data security, and we assure you that our App is not malicious software. Our App will not engage in the following activities:

Collecting Data Without User Consent: We will not collect or store any personal data without the user’s explicit consent.
Sharing Data Without User Consent: We will not sell, rent, or share users’ personal data with any unauthorized third parties without user consent.
Malicious Behavior: Our App will not perform any malicious activities, such as stealing data, damaging devices, displaying malicious ads, or engaging in any other form of malicious behavior.

We are committed to maintaining the highest standards of security and privacy for our users, ensuring a safe and trustworthy experience.

9. How This Privacy Policy Is Updated

We may modify this Privacy Policy when necessary. Please understand that we may revise this policy from time to time, and we will indicate the date of the most recent update and make it effective after public announcement. We will not reduce your rights under this policy without your explicit consent. For significant changes, we will provide more prominent notices (including, for certain services, email notifications detailing the specific changes to the privacy policy). Please frequently review this policy to read the latest version. Significant changes referred to in this policy include but are not limited to:

Significant changes in our service model, such as changes to the purpose of processing personal information, the types of personal information processed, and the ways in which personal information is used.
Major changes in our ownership structure, organizational structure, etc., such as business adjustments, bankruptcy, mergers, and acquisitions leading to owner changes.
Changes in the main recipients of personal information sharing, transfer, or public disclosure.
Major changes in your rights and the way you exercise them regarding personal information processing.
Changes in the department responsible for handling personal information security, contact methods, and complaint channels.
When a personal information security impact assessment report indicates a high risk.

10. How to Contact Us

If you have any questions about this policy or any complaints or comments regarding the handling of your personal information, please contact us through our customer hotline or by sending an email to our customer service email. We will complete the verification and processing within fifteen working days.

Company: WHITEPATH COMPANY LIMITED

Address: Britam Tower 3rd floor Longonot Rd, Nairobi, Kenya.

Customer Hotline: 011-566-2800

Customer Service Email: whitepath2022@gmail.com

Please feel free to reach out to us with any concerns or inquiries. We are here to help and ensure that your personal information is handled securely and appropriately.

Attachment

Instar Cash Borrowing Account Notice

Before you cancel your Instar Cash Borrowing account, please read, understand, and agree to the following terms:

Account OwnershipThe account you are applying to cancel must be your own. You should follow our prescribed procedures or the prompts on the client side to cancel the account.
Service TerminationAccount cancellation will result in the termination of services provided by this client (except those that cannot be terminated as per other terms of this notice or by their nature). This will also invalidate any exchange codes (points, coupons, etc., virtual assets or rights, if any) obtained in this account. Please follow the specific product page instructions or call the Instar Cash customer service hotline.
Account Cancellation Conditions(1) The account you are applying to cancel should be in normal status. Accounts with outdated, missing, incorrect information, potential risks, or frozen accounts cannot be canceled.(2) The account you are applying to cancel should not have any outstanding debts, e.g., if you have any unsettled debts in our credit products, the account cannot be canceled until the debt is cleared.(3) The account you are applying to cancel should not have any unresolved disputes.If you have any questions or cannot cancel your account due to not meeting the above conditions, please contact our customer service for assistance.
Account VerificationIf you apply for account cancellation while we are still verifying or need to verify your related transactions or account, we have the right to continue freezing your account or part/all of the orders in the account for continued verification. We also have the right to report fraud or illegal activities to regulatory or judicial departments if necessary.
Customer Service VerificationOur customer service will call or email you to confirm that the cancellation request is initiated by you and to verify your true identity to ensure the security of your account information.
Account Re-login RestrictionAfter completing the account cancellation process, please do not log back into your account, as this may cause the cancellation to fail and reactivate your account. The login restriction period is 30 days.
Unaddressed MattersFor matters not covered in this agreement, refer to the “User Service Agreement.”

If you need any assistance or have further questions, please do not hesitate to contact our customer service team.