THE GENIUS FRIENDS LIMITED

Genius Hire Purchase System ("Genius HPS")

PRIVACY POLICY

Effective Date: 1 July 2026

Applies to: thegeniusfriends.co.ke, the Genius App, and all associated marketing materials and communication channels

1. INTRODUCTION

The Genius Friends Limited ("Genius Friends" "Genius, "we", "us", "our") is committed to protecting the privacy of everyone who uses the Genius Hire Purchase System ("Genius HPS", "the Platform"), comprising the website thegeniusfriends.co.ke, the Genius mobile application, and related marketing and communication channels. This Privacy Policy explains what personal data we collect, why we collect it, how it is used and shared, and the rights available to you under the Data Protection Act, 2019 (Kenya).

This Policy applies to Clients, Dealers, Agents, and Partners who interact with the Platform, and should be read alongside our Terms and Conditions and any Hire Purchase Agreement you enter into with us.

2. WHO WE ARE

The Genius Friends Limited is the data controller responsible for personal data processed through the Platform. Our registered office is at Highlands Mall, Ground Floor, Eldoret–Uganda Road, Nairobi, Kenya. Queries about this Policy or your personal data can be directed to us using the contact details in Section 12.

3. INFORMATION WE COLLECT

3.1 Information You Provide

•         Identity information: full name, National ID number, date of birth, and a copy or scan of your ID document;

•         Contact information: phone number, email address, and physical or delivery address;

•         Next of kin details: name and contact information, used for verification purposes;

•         Mobile network information: confirmation of an active Safaricom line and its tenure;

•         Payment information: M-Pesa transaction details, payment references, and account/paybill activity connected to your instalments;

•         Dealer, Agent, and Partner details: business or personal registration information, banking details for commission payment, and referral records.

3.2 Information Collected Automatically

•         Device information: device make, model, and unique identifiers (such as IMEI) for Devices supplied under a Hire Purchase Agreement, used to operate the device-locking and restriction functionality;

•         App and website usage data: log-in activity, app interactions, pages visited, and approximate location where permitted by your device settings;

•         Technical data: IP address, browser type, and device operating system, collected through the website and app.

3.3 Information From Third Parties

•         Referral information submitted by a Dealer or Agent who onboards you as a Client;

•         Verification information from mobile network operators or payment providers (such as Safaricom/M-Pesa) to confirm identity or transaction status;

•         Information from credit reference bureaus or similar verification services, where used to assess an application.

4. HOW WE USE YOUR INFORMATION

We process personal data for the following purposes:

•         To assess and process applications for a Device on hire purchase, including verifying identity and eligibility;

•         To process deposits and instalment payments, and reconcile these against your Account;

•         To operate the PAYGO device-management system, including remotely restricting or reactivating a Device based on payment status;

•         To contact your next of kin for verification purposes or in the event of default, loss, or theft of a Device;

•         To provide customer support and respond to queries submitted via the Genius App, phone, WhatsApp, or email;

•         To detect, investigate, and prevent fraud, misuse of the Platform, or breaches of our Terms;

•         To calculate and pay commissions or incentives owed to Dealers, Agents, and Partners;

•         To send you service messages, including payment reminders and account status updates;

•         To send marketing communications about our products and offers, where you have not opted out;

•         To comply with applicable legal, regulatory, and tax obligations.

5. LEGAL BASIS FOR PROCESSING

We process personal data on one or more of the following legal bases under the Data Protection Act, 2019: performance of the Hire Purchase Agreement and Terms and Conditions you have entered into with us; your consent, where sought (for example, for marketing communications); compliance with a legal obligation; and our legitimate interests in operating, securing, and improving the Platform, including fraud prevention and portfolio management, balanced against your rights and interests.

6. HOW WE SHARE YOUR INFORMATION

We do not sell personal data. We may share personal data with:

•         Payment partners, including Safaricom M-Pesa, to process deposits and instalment payments;

•         Dealers and Agents, limited to the information needed to confirm onboarding, delivery, or referral outcomes;

•         Partners and investors, generally in aggregated or portfolio-level form for reporting purposes, unless a specific transaction requires otherwise;

•         Your next of kin, for verification or in the event of default, loss, or theft of a Device;

•         Credit reference bureaus or similar verification services, where used as part of our lending assessment;

•         Service providers who support our operations, such as IT hosting, app infrastructure, and customer support tools, under confidentiality obligations;

•         Regulators, law enforcement, or courts, where required by law or to protect our legal rights.

7. DEVICE LOCKING AND MONITORING

Devices supplied under the PAYGO model include software that enables Genius Friends to verify payment status and restrict or restore access to the Device accordingly. This functionality is limited to enforcing the hire purchase arrangement and does not extend to monitoring the content of your calls, messages, or personal files. This functionality remains active until the Device has been fully paid for and ownership has passed to the Client.

8. DATA RETENTION

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, including the duration of your Hire Purchase Agreement and a reasonable period thereafter to meet legal, accounting, dispute-resolution, and fraud-prevention requirements. Where data is no longer needed, we take reasonable steps to delete or anonymise it.

9. DATA SECURITY

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration, including access controls, encryption of sensitive data where appropriate, and restricted staff access on a need-to-know basis. No system is completely secure, and we encourage Users to safeguard their own login credentials and to report any suspected unauthorised access to their Account immediately.

10. YOUR RIGHTS

Under the Data Protection Act, 2019, you have the right to:

•         Be informed of how your personal data is used;

•         Access the personal data we hold about you;

•         Request correction of inaccurate or incomplete data;

•         Request deletion of your data, subject to our legal and contractual retention obligations;

•         Object to or restrict certain processing, including direct marketing;

•         Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal;

•         Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

To exercise any of these rights, contact us using the details in Section 12. We may need to verify your identity before actioning a request, and note that some requests (for example, deletion of data needed to service an active Hire Purchase Agreement) may not be actionable until the underlying obligation is settled.

11. MARKETING COMMUNICATIONS

We may send you information about new devices, offers, and promotions via SMS, WhatsApp, email, or in-app notification. You can opt out of marketing communications at any time by following the unsubscribe instructions provided, using in-app settings, or contacting customer support. Opting out of marketing does not affect service messages relating to your Account or repayments, which we will continue to send as necessary.

12. CONTACT US AND COMPLAINTS

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

The Genius Friends Limited

Highlands Mall, Ground Floor, Eldoret–Uganda Road, Nairobi, Kenya

Email: info@thegeniusfriends.co.ke  |  Phone/WhatsApp: 0798 900 126

If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner, Kenya.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated Policy will be posted on the website and/or made available within the Genius App, together with the effective date. We encourage you to review this Policy periodically.