1. DEFINITIONS

In this Policy, the following terms shall have the meanings assigned below:

• "Data Controller" means E2G HOLDINGS LIMITED trading as EaZy to Get (E2G), which determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on our behalf in accordance with our instructions.
• "Data Subject" means the individual to whom the personal data relates, i.e., you, the Customer.
• "Personal Data" has the meaning assigned to it under section 2 of the DPA, and includes any information relating to an identified or identifiable natural person.
• "Sensitive Personal Data"means data revealing race, health status, ethnic or social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of the person's children, parents, spouse or spouses, sex, or the sexual orientation of the Data Subject, as defined under the DPA.
• "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, storage, use, disclosure, or deletion.
• "IPRS" means the Integrated Population Registration System maintained by the Government of Kenya.
• "M-PESA" means the mobile money platform operated by Safaricom PLC.

2. IDENTITY OF THE DATA CONTROLLER

The Data Controller in respect of personal data processed through the Platform is:

• Company Name: E2G HOLDINGS LIMITED
• Registered Address: First floor, Red commercial complex, Mombasa Road, Embakasi, Embakasi East, Nairobi
• Email: info@eazy2get.com / customercare@eazy2get.com

The Company is registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC) pursuant to the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

3. PERSONAL DATA WE COLLECT

We collect the following categories of personal data in connection with your use of the Platform:

3.1 Identity and Registration Data

• Full name (as it appears on your National Identity Card)
• National Identity Card number
• Primary M-PESA registered phone number
• Secondary phone number (where provided)
• Email address
• Date of birth and gender (as verified through IPRS)

3.2 Financial and Transaction Data

• Deposit payment records and M-PESA transaction references
• Installment payment history and repayment behaviour
• Credit and eligibility assessment scores and outcomes
• Device financing agreement details, including plan terms and outstanding balances

3.3 Device and Technical Data

• IMEI number of the financed Device
• Device model (SKU) and activation status
• SIM card details associated with the Device
• Device lock and unlock event logs
• IP address, browser type, and operating system (where accessed via web interface)
• Platform usage logs and session data

3.4 Location Data

• Delivery address and nearest landmark (for door-to-door delivery)
• Safaricom M-PESA account location data (as provided by the payment processor)

3.5 Verification and Compliance Data

• IPRS verification records confirming identity match
• OTP issuance and verification logs
• Know Your Customer (KYC) documentation

3.6 Communications and Support Data

• Correspondence with our customer care team (calls, emails, chat logs)
• Product ratings and reviews submitted through the Platform
• Complaint and dispute records

We do not intentionally collect Sensitive Personal Data as defined under the DPA, except where required for identity verification through IPRS (which may incidentally involve data held in government records). Where Sensitive Personal Data is collected, we will obtain your explicit consent and apply enhanced safeguards.

4. LEGAL BASIS FOR PROCESSING

We process your personal data on the following lawful bases under section 30 of the DPA:

• Performance of a contract: Processing is necessary to fulfill your device financing agreement, process your order, arrange delivery, and administer your Installment Plan.
• Consent: Where you have expressly consented to processing, including for identity verification via IPRS and for marketing or service communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Compliance with a legal obligation: Processing is necessary to comply with applicable laws and regulatory requirements, including anti-money laundering obligations, tax legislation, and directives from regulatory authorities.
• Legitimate interests: Processing is necessary for our legitimate interests in preventing fraud, securing the Platform, managing credit risk, and improving our services, provided such interests are not overridden by your fundamental rights and freedoms.

5. PURPOSES OF PROCESSING

We process your personal data for the following specific purposes:

5.1 Account Registration and Identity Verification

To create and manage your account, verify your identity against the IPRS, issue and verify OTPs, and ensure the integrity of the registration process.

5.2 Credit and Eligibility Assessment

To carry out an automated assessment of your eligibility for device financing, determine the range of Devices for which you qualify, and monitor your eligibility score over time based on platform usage and repayment behaviour.

5.3 Order Processing and Fulfillment

To process your orders, coordinate delivery, issue Delivery Codes, activate your Device, and maintain the Order Trail for tracking purposes.

5.4 Device Financing Administration

To administer your Installment Plan, track payment obligations, enforce device control mechanisms (including remote locking) in the event of default, and manage the recovery of Devices where required.

5.5 Payment Processing

To initiate and confirm M-PESA STK Push payment transactions, process Deposit payments, and maintain payment records.

5.6 Customer Support and Aftersales

To respond to queries, manage warranty claims, process return requests, resolve disputes, and conduct follow-up satisfaction calls.

5.7 Legal and Regulatory Compliance

To comply with applicable laws and regulations, respond to lawful requests from regulatory and government authorities, and maintain records required under Kenyan law.

5.8 Security and Fraud Prevention

To monitor Platform activity, detect and prevent fraud, unauthorized access, and misuse, and protect the rights and property of the Company and its Customers.

5.9 Service Communications

To send transactional notifications (order confirmations, delivery updates, payment reminders), account-related communications, and where you have consented, service updates and product information.

5.10 Platform Improvement

To analyze usage patterns, improve Platform functionality, develop new features, and enhance the overall customer experience.

6. AUTOMATED DECISION-MAKING AND PROFILING

The Platform employs automated credit and eligibility scoring to determine whether you qualify for device financing and the range of Devices available to you. This constitutes automated decision-making within the meaning of the DPA.

You have the right, under section 32 of the DPA, to:

• request that a decision made solely by automated means be reviewed by a human;
• obtain an explanation of the logic involved in any automated decision that significantly affects you; and
• contest any automated decision that you believe is incorrect.

To exercise these rights, please contact us using the details in Clause 13 of this Policy.

7. SHARING AND DISCLOSURE OF PERSONAL DATA

We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients in the circumstances described below:

7.1 Logistics and Delivery Partners

We share your name, phone number, delivery address, and order details with our logistics partners (including Fargo Courier and other appointed couriers) solely for the purpose of fulfilling your order and arranging delivery.

7.2 Payment Processors

We share your phone number and transaction details with Safaricom PLC (as operator of M-PESA) to facilitate payment processing. M-PESA processes your data in accordance with its own privacy policy and terms of service.

7.3 Government and Verification Systems

We share your National ID number and related identity information with the IPRS and other lawful government verification databases for identity verification purposes, as authorized by applicable law.

7.4 Regulatory and Law Enforcement Authorities

We may disclose your personal data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where required by law, court order, or regulatory direction.

7.5 Group Companies and Affiliates

We may share your data with companies within the Onfon Group of companies where necessary for platform administration, compliance, and group-level risk management, subject to appropriate data sharing agreements.

7.6 Professional Advisers

We may share your data with legal, financial, and other professional advisers where necessary in connection with legal proceedings, regulatory enquiries, or business transactions.

7.7 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's business, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

All third parties to whom we disclose personal data are required to handle such data in accordance with the DPA and, where applicable, pursuant to a written data processing agreement.

8. CROSS-BORDER TRANSFERS OF PERSONAL DATA

The Platform is primarily operated and intended for use within the Republic of Kenya. Where we transfer your personal data outside Kenya, we will do so only in accordance with section 48 of the DPA, which requires that the recipient country provides an adequate level of data protection, or that appropriate safeguards are in place, such as standard contractual clauses approved by the Data Protection Commissioner, or where you have expressly consented to the transfer.

We will notify you of any proposed cross-border transfer that may materially affect your rights prior to undertaking such transfer.

9. DATA RETENTION

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention guidelines apply:

• Account and registration data: Retained for the duration of your account and for a period of seven (7) years following account closure, in accordance with statutory record-keeping requirements.
• Transaction and payment records: Retained for a minimum of seven (7) years as required under the Tax Procedures Act, 2015 and other applicable financial legislation.
• Device financing records: Retained for the duration of the Installment Plan and for a period of seven (7) years following completion or termination of the financing agreement.
• Customer support records: Retained for three (3) years following resolution of the relevant query, complaint, or dispute.
• Platform usage logs and technical data: Retained for a period of twelve (12) months, unless required for a longer period in connection with fraud prevention, security investigations, or legal proceedings.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with our internal data disposal procedures.

10. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, disclosure, or alteration. These measures include, but are not limited to:

• encryption of data in transit and at rest;
• access controls and role-based permissions restricting access to personal data to authorized personnel only;
• OTP-based authentication for account access and device delivery;
• regular security assessments and vulnerability testing of the Platform;
• staff training on data protection obligations; and
• data processor due diligence and contractual safeguards.

Notwithstanding the foregoing, no transmission of data over the internet or mobile network is entirely secure. We cannot guarantee the absolute security of data transmitted to or from the Platform and accept no liability for interception by unauthorized third parties where we have taken reasonable security precautions.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within seventy-two (72) hours of becoming aware of the breach, in accordance with section 43 of the DPA, and will communicate the breach to affected Data Subjects without undue delay where required.

11. YOUR DATA PROTECTION RIGHTS

Under the Kenya Data Protection Act, 2019, you have the following rights in respect of your personal data:

11.1 Right of Access

You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of the personal data we hold about you, together with supplementary information about how it is processed.

11.2 Right to Rectification

You have the right to request the correction of inaccurate or incomplete personal data that we hold about you.

11.3 Right to Erasure

You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn your consent (and there is no other lawful basis for processing), or where the data has been unlawfully processed. This right is subject to our legal and regulatory retention obligations.

11.4 Right to Object

You have the right to object to the processing of your personal data on grounds relating to your particular situation, in particular where processing is based on our legitimate interests. You also have the right to object to processing for direct marketing purposes at any time.

11.5 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or have objected to processing pending verification of our legitimate interests.

11.6 Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to request its transmission to another data controller.

11.7 Rights in Relation to Automated Decision-Making

As set out in Clause 6 above, you have the right to request human review of automated decisions, obtain an explanation of the decision logic, and contest decisions that affect you.

11.8 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time by contacting us using the details in Clause 13. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

11.9 Right to Lodge a Complaint

You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at any time. Details of the ODPC are available at www.odpc.go.ke.

To exercise any of the above rights, please submit a written request to us using the contact details in Clause 13. We will respond within the timeframe prescribed by the DPA and its regulations.

12. COOKIES AND TRACKING TECHNOLOGIES

The Platform may use cookies and similar tracking technologies (including session cookies, persistent cookies, and analytics tools) to improve your experience, maintain session integrity, and analyze Platform usage patterns.

You may manage cookie preferences through our Cookie Consent banner, the Cookie settings link in the website footer, or your browser settings. Disabling certain cookies may affect the functionality of the Platform. We do not use cookies for selling data to third-party advertisers.

Please see our full Cookie Policy for details on the types of cookies we use and how to control them.

13. CONTACT US / DATA SUBJECT REQUESTS

For any questions about this Policy, to exercise your data protection rights, or to raise a data-related concern, please contact:

• Data Controller: E2G HOLDINGS LIMITED
• Postal Address: P.O. Box 69825-00400
• Email: info@eazy2get.com / customercare@eazy2get.com
• Customer Care: 0709180500

We will acknowledge your request promptly and will respond within the timelines prescribed under the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021, or as otherwise required by law.

14. CHILDREN'S DATA

The Platform is intended for use by persons aged eighteen (18) years and above. We do not knowingly collect personal data from children under the age of eighteen (18). If we become aware that a minor has registered on the Platform, we will take immediate steps to delete the relevant account and associated personal data. If you believe that a minor's data has been submitted through the Platform, please notify us immediately at the contact details in Clause 13.

15. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites or services, including Safaricom's M-PESA platform and courier partner portals. This Policy does not apply to such third-party websites or services. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices of third parties.

16. AMENDMENTS TO THIS POLICY

We reserve the right to amend this Policy at any time. Any amendments will be posted on the Platform with an updated effective date. Where an amendment materially affects your rights or the manner in which we process your personal data, we will notify you via your registered email address or account inbox prior to the amendment taking effect.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.

17. GOVERNING LAW

This Policy is governed by and shall be construed in accordance with the laws of the Republic of Kenya, including the Kenya Data Protection Act, 2019 and its subsidiary legislation. Any disputes arising under this Policy shall be subject to the jurisdiction of the courts of Nairobi, Kenya.