Privacy Policy

This Privacy Policy applies to Amar Kash, a digital‑lending mobile application operated by EROMI WEBHOUSE AFRICA LTD (referred to as “we”, “us”, “our Company”). This document explains how we collect, handle, store, transfer, disclose and protect your personal data when you access our mobile application and official website: www.eromiwebhouseafrica.com.

By registering, logging‑in, downloading or using Amar Kash services, you acknowledge that you have read, understood and accept all clauses under this Privacy Policy. You consent to our collection and processing of your personal data as described herein. If you disagree with any part of this policy, you must stop using our services immediately.

Important note: You may withdraw your consent for data processing at any time. Withdrawal shall not affect the lawfulness of processing activities already performed before you withdrew consent. Certain device‑level permissions are required for core loan functions; revoking these permissions may make you unable to submit loan applications, complete identity verification or obtain credit services.

1. What information we collect

We gather personal data from three sources: information you actively submit, device‑generated technical information, and information obtained with your explicit permission after you grant system permissions. All data transmission between your device and our backend servers uses encrypted HTTPS channels. We follow the data‑minimization principle and only collect data necessary for operating credit‑lending services.

1.1 Information obtained with your device‑permission approval

1. Camera

   We request camera permission solely for KYC identity verification. You may take photographs of government‑issued ID documents and perform facial‑recognition liveness checks. We only process images captured within our App workflow. We cannot browse, scan or retrieve any existing photos or videos stored inside your device gallery. Without camera permission, you cannot finish identity verification and cannot proceed with loan application submission.

2. SMS messages

   With your explicit consent, we collect SMS metadata and message content only related to financial transactions, such as payment reminders, transaction alerts and billing notifications. Irrelevant SMS messages without risk‑assessment value will be filtered and discarded and will not be persisted in our database. SMS data supports credit scoring and anti‑fraud analysis. You can revoke SMS permission in system settings, but doing so may reduce our capacity to evaluate your application and may result in loan‑application rejection.

3. Approximate location data

   We collect coarse‑grained approximate location information, not precise GPS coordinates. Location data is used for account risk monitoring, detecting anomalous login behaviours and mitigating fraud. Location data will never be used for advertising or marketing targeting purposes. You are free to toggle location permissions in your device settings.

4. Installed‑application metadata

   Upon your approval, we read metadata of financial‑related applications installed on your mobile hardware. Collected fields include application package name, version code, installation timestamp and last‑updated timestamp. We do NOT read any user‑generated content inside third‑party applications. This dataset supports device‑risk evaluation for anti‑fraud workflows. Metadata for non‑financial applications will be ignored and will not be uploaded.

5. Normal system‑level permissions
   • ACCESS_WIFI_STATE: Obtain Wi‑Fi related metadata for risk‑behaviour analysis.
   • ACCESS_NETWORK_STATE: Collect network‑connection status information to diagnose service stability and identify suspicious network‑access patterns.
   • AD_ID (Google Advertising ID): Collect advertising identifier for attribution statistics and service‑usage analytics. You can disable personalized advertising from your Android system settings.
6. Emergency‑contact information

   Emergency‑contact details are voluntarily provided by you during the loan‑application workflow. Collected fields include contact person’s full name, mobile‑phone number and your relationship to that person. You can manually fill‑in these entries. We do not automatically scan your full address book without your explicit selection. Emergency‑contact records are only kept for account‑security and emergency‑communication scenarios.

7. Analytics & advertising identifiers from third‑party SDKs

   We integrate third‑party software development kits including AppsFlyer. Subject to your permission, we collect advertising IDs, install‑attribution data and usage statistics. All data flows run over encrypted channels. These datasets help us analyse campaign performance, diagnose product defects and detect potential fraudulent behaviours.

1.2 Personal data you voluntarily submit

You supply these data items during account sign‑up and loan‑application submission:

• Account information: Mobile‑phone number, registration profile content.
• Identity documents: Full legal name, government‑ID details, date of birth (mandatory for KYC compliance).
• Personal profile: Age, gender, educational background, email address, residential address.
• Employment & financial data: Occupation type, monthly‑income level, source‑of‑income description.
• Marital‑status information.
• Payment‑account details: Digital‑wallet or bank‑account credentials for loan disbursement and repayment processing.

1.3 Data obtained from authorised third‑party sources

Subject to your separate express consent, we may retrieve credit‑related records from licensed credit bureaus and identity‑verification service partners. Third‑party‑sourced data is processed under the terms of your agreements with those external organisations. We use such records to enrich your credit profile and improve risk‑assessment accuracy. We will not fetch third‑party information if you withhold consent.

1.4 Log information

When Amar Kash runs on your device, system‑generated log data may be collected in case of application crashes or runtime exceptions. Log entries contain device IP address, device model, OS version, operation timestamp and event statistics. Logs are utilised for troubleshooting and security‑incident analysis.

2. How we use your personal data

All personal‑data processing activities shall be limited to lawful purposes tied to our credit‑service operation:

1. Complete identity verification, fulfil statutory KYC obligations and validate authenticity of application materials.
2. Assess your loan eligibility, run credit‑risk scoring and process your loan application.
3. Maintain account safety, detect abnormal behaviours, implement anti‑fraud and risk‑control measures.
4. Manage full loan lifecycle: disburse funds, record repayment history, push billing and service‑related notifications.
5. Respond to user‑support tickets, resolve complaints and handle user enquiries.
6. Conduct aggregated, de‑identified internal analytics to optimise product features and service quality.
7. Comply with applicable legal requirements, regulatory orders and valid official requests from competent authorities.

We will never repurpose your personal data for purposes incompatible with the original collection goal unless we obtain your fresh separate consent.

3. Sharing, disclosure and cross‑border transfer of personal data

We will not sell, rent or trade your personal data to marketing‑oriented third parties. Limited sharing may only occur in scenarios listed below:

1. Authorised service‑provider partners: We may share necessary datasets with vetted service vendors performing identity verification, cloud‑hosting, security‑analytics, payment processing and customer‑support work. All vendors sign strict data‑protection and confidentiality agreements. They may only process data strictly following our written instructions.
2. Legal‑compliance scenarios: We may disclose personal data when required by law, court order, judicial proceeding or formal demand issued by government regulatory authorities.
3. Protection of legitimate interests: We may disclose relevant information to defend platform security, investigate suspected fraud, protect user safety or enforce our service‑agreement terms.

Cross‑border data transfer: Most of your personal data is stored within our primary service region. In limited circumstances, data may be transmitted to overseas authorised subcontractors. In such cases, we implement contractual safeguards to guarantee overseas‑party data‑protection standards meet applicable regulatory requirements.

4. Data security safeguards

We adopt multi‑layer physical, administrative and technical security controls:

• All in‑transit data uses 128‑bit SSL / HTTPS encryption.
• Persistent stored personal data is protected by access‑control lists; only staff with legitimate business need can gain access. All relevant personnel are bound by confidentiality contractual clauses. Misconduct will trigger disciplinary sanctions including termination.
• We maintain operational procedures for responding to personal‑data‑security incidents. If a personal‑data breach occurs which poses risk to your rights and interests, we will follow regulatory rules to perform risk assessment and issue relevant notifications where legally required.
• We conduct periodic internal audits for our data‑processing workflows.

Despite industry‑standard safeguards, absolute 100 % security over internet data transmission cannot be mathematically guaranteed.

5. Data retention & account deletion rules

We retain your personal data only for the minimum period necessary to fulfil the purposes for which data was collected, and to satisfy applicable legal‑record‑keeping obligations.

• For active loan accounts: We keep data throughout the full loan lifecycle plus additional statutory archive retention term after loan settlement.
• After you close your account / settle all loans: We erase or anonymise most of your personal records, except records we are obligated to preserve for tax, anti‑money‑laundering, regulatory audit purposes.

Account‑deletion rules

You can locate the account‑deletion function inside Amar Kash App settings or submit a deletion request via our official website.

• Once account deletion completes, you lose access to all App services; deleted core personal records cannot be restored.
• If you have unsettled, overdue or ongoing loan orders, we cannot fulfil your deletion request. We hold your data until all liabilities are fully repaid and orders are finalised.
• After successful account deletion, you may re‑register using the same mobile‑phone number only after a 15‑day cooling‑off period.
• If one mobile‑phone number has triggered account‑deletion requests for three separate times, that number will be blocked from further re‑registration, as an anti‑fraud measure.

6. Your rights as a data subject

Pursuant to applicable personal‑data‑protection regulations, you hold the following rights:

1. Right to Access: Request copies and details of the personal‑data records we hold about you, including categories of data, processing purposes and recipient categories.
2. Right to Rectification: Demand correction or amendment of inaccurate or incomplete personal information.
3. Right to Erasure: Apply for deletion of your personal‑data under qualifying conditions. Please note legal‑mandated retention may block immediate full deletion.
4. Right to Restriction of Processing: Request us to limit how we process your personal‑data under conditions defined by law.
5. Right to Data Portability: Receive your personal data in structured, machine‑readable format for transfer to another service provider, where technically feasible.
6. Right to Object: Object against processing based on legitimate‑interest grounds or for direct‑marketing usage.
7. Right to Withdraw Consent: You can withdraw any previously‑given consent for data‑processing. Withdrawal does not affect processing performed prior to withdrawal.
8. Right to File Complaint: If you believe your data‑privacy rights have been infringed, you have the right to lodge a formal complaint with the competent local data‑protection regulatory authority.

To exercise above rights, send your request via our official email: contact@eromiwebhouseafrica.com. We will validate your identity before handling requests and respond within a reasonable regulatory‑compliant time frame.

7. Third‑party software development kits (SDKs) used in our App

Our application integrates third‑party SDKs for service operation and attribution‑statistics purposes:

• AppsFlyer (attribution & analytics)
• Google Play Services

These third‑party organisations follow their‑own independent privacy policies. We encourage you to review their respective privacy documents. We are not responsible for data‑handling practices purely controlled by those external third‑party entities.

8. Minor users

Amar Kash credit service products are exclusively intended for users aged 18 years old and above. We do not knowingly collect personal information of children or teenagers under 18. If we confirm personal data belonging to a minor has been submitted to our systems, we will take reasonable steps to delete those records. If you become aware a minor has supplied us personal‑data, please notify us through our official contact channels.

9. Amendment to this Privacy Policy

We may revise this Privacy Policy from time‑to‑time, responding to service‑updates, internal‑process adjustments or changes in applicable local laws. When material modifications are implemented, we will publish updated text on our official website and deliver in‑app notifications. Revised clauses take effect immediately upon online publication. Your continued use of Amar Kash after publication means you accept the updated Privacy Policy. We recommend reviewing this document periodically.

10. Contact information

Data‑controller entity: EROMI WEBHOUSE AFRICA LTD, operator of Amar Kash
Official email: contact@eromiwebhouseafrica.com
Official website: www.eromiwebhouseafrica.com

We will process all privacy‑related enquiries and formal requests and provide responses complying with applicable data‑protection rules.