Privacy Policy

Last updated: 30 June 2026

OnLink Africa (“OnLink”, “we”, “us”) provides a mobile and web banking experience in partnership with a regulated banking partner. This policy explains what personal and financial data we collect, how we use and share it, how long we keep it, and the rights you have over it. We act as a data controller under the Kenya Data Protection Act, 2019 and process your data in line with the Central Bank of Kenya’s regulations and our banking partner’s requirements.

Information we collect

We collect only the data needed to open and operate your account, comply with the law, and keep your money safe:

Account & identity data— your name, email address, phone number and the credentials you use to sign in.
Know Your Customer (KYC) data— government identity documents, identification numbers and a selfie or biometric image, collected and verified through our identity verification provider to satisfy anti-money-laundering and Central Bank of Kenya requirements.
Financial & transaction data— your account number, balances, transfers, payments and transaction history, held with and processed by our regulated banking partner.
Device & technical data— IP address, device and browser type, and security logs used to detect fraud and keep the service secure.
Communications— messages you send us for support, and records of those interactions.
Product usage data— collected only if you opt in to analytics (see below).

How we use your information

To create, operate and service your account.
To process transfers, payments and other transactions you request.
To verify your identity and meet our legal, regulatory and anti-money-laundering obligations.
To detect, prevent and investigate fraud and other security threats.
To provide customer support and respond to your requests.
To improve the product, where you have opted in to analytics.

Legal bases for processing

Under the Kenya Data Protection Act, we process your data on the basis of: the performance of our contract with you; compliance with legal and regulatory obligations; our legitimate interests in securing and improving the service; and your consent, where we rely on it (for example, analytics). You may withdraw consent at any time without affecting processing carried out before withdrawal.

How we share your information

We do not sell your personal data. We share it only with parties who help us operate the service or where we are legally required to:

Our banking partner, which holds your funds and processes your transactions under its banking licence.
Our identity verification provider, to confirm your identity during onboarding (KYC).
Cloud and infrastructure providers, who host the service and authenticate your sign-in on our behalf under strict confidentiality and security terms.
Regulators, law enforcement and courts, where disclosure is required by law or to protect against fraud.

Analytics

When you opt in to analytics, OnLink collects anonymised product usage data (pages visited, feature clicks, transfer outcomes) to help us improve the product. Account numbers, balances, card data, KYC document numbers, OTPs and PINs are never collected for analytics. You can change your choice at any time from Settings → Privacy.

International data transfers

Some of our service providers process data outside Kenya. Where data is transferred internationally, we put appropriate safeguards in place as required by the Kenya Data Protection Act to ensure it remains protected.

Data retention

We keep your data for as long as you hold an account with us and for as long afterwards as we are required to by law — financial and KYC records are typically retained for at least seven years after your account closes, in line with Central Bank of Kenya and anti-money-laundering requirements. When data is no longer needed, we securely delete or anonymise it.

How we protect your data

We protect your data with encryption in transit, strict access controls, audit logging and continuous security monitoring. Sensitive values such as passwords, PINs, OTPs and card numbers are never logged.

Your rights

Under the Kenya Data Protection Act you have the right to access your data, to correct inaccurate data, to request deletion, to object to or restrict certain processing, to data portability, and to withdraw consent. To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner.

Children’s privacy

OnLink is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app or by email.

Contact

Questions about this policy or your data? Email info@onlink.africa.