Last updated: January 2, 2026
We will disclose information upon your authorisation and instruction to your advisers (such as accountants, lawyers, financial or other professional advisers). It may be necessary for us to disclose an individual’s data to third parties in a manner compliant with applicable Kenyan laws during the course of our business operations, including processing activities such as verification, due diligence, website hosting, data analytics, and payment processing through Lockpesa and M-PESA services.
We may disclose your data to credit reference agencies and verification partners for the purposes of verifying your identity and M-PESA account information. We will not disclose or sell an individual’s data to unrelated third parties under any circumstances unless we engage other companies to perform tasks on our behalf and need to share your information with them in order to provide products and services to you, and we have obtained your consent to do so.
There are certain circumstances in which we may disclose an individual’s information:
When you have given us explicit permission
Where we reasonably believe that an individual may be engaged in fraudulent, deceptive, or unlawful activity that a governmental authority should be made aware of;
As required by any applicable law, regulation, court order, or legal process in Kenya;
To provide individuals and customers with information about other goods and services we may offer that are similar to those that you have used or enquired about with Lockpesa;
As required by Kenyan and overseas regulators and authorities in connection with their duties, including regulators or authorities having access to payment details (including information about others involved in the payment);
Fraud prevention agencies. In particular, we will always notify fraud prevention agencies if you provide false or fraudulent information. These agencies may also allow other organisations (within Kenya or abroad), including law enforcement agencies, to access this information for the purposes of preventing and detecting fraud, money laundering, or other crimes;
In connection with the sale, merger, acquisition, financing, liquidation, or transfer of our business assets, where personal data may be transferred to a new owner or successor entity.
We will not disclose an individual’s data to any entity outside Kenya unless adequate safeguards are in place to ensure that personal data is protected in accordance with the Kenya Data Protection Act, 2019, and any other applicable privacy laws. We will take reasonable steps to ensure that any disclosure to an entity outside Kenya will not occur until that entity has agreed in writing to safeguard personal data in a manner consistent with this Privacy Policy.
If the Company becomes involved in a merger, asset sale, financing, liquidation, bankruptcy, or acquisition of all or part of the business by another company, we may share information with that company before and after the transaction closes.
Here is your revised version with “Trustap” replaced by “Lockpesa” in Kenya and reference to M-PESA included where relevant:
An individual may opt to not have us collect their data and communicate with them at certain times. This may prevent us from offering them some or all of our services and may terminate their access to Lockpesa, or other services they access with or through us.
Opt In: Where relevant, the individual will have the right to choose to have information collected and/or receive information from us.
Opt Out: Where relevant, the individual will have the right to choose to exclude himself or herself from some or all collection of information and/or receiving information from us. An individual may revoke their consent at any time, and the decision to opt out will be made through the same media by which the individual opted in.
If an individual believes that they have received information from us that they did not opt in or out to receive, they should contact us using the details below.
We will take all reasonable precautions to protect an individual’s data from unauthorised access. This includes appropriately securing our physical facilities and electronic networks.
The security of online transactions, including payments made via M-PESA or other electronic means, and the security of communications sent electronically or by post cannot be fully guaranteed. Each individual that provides information to us via the internet or by post does so at their own risk.
We cannot accept responsibility for misuse, loss, or unauthorised access to data where the security of information is not within our control. We are not responsible for the privacy or security practices of any third party (including third parties that we are permitted to disclose an individual’s data to in accordance with this policy or any applicable laws).
If an individual suspects any misuse, loss, or unauthorised access to their data, they should notify us immediately. We are not liable for any loss, damage, or claim arising from another person’s use of the data where we were authorised to provide that person with the data.
The applicable data protection laws give you the right to request from us the data that we have about you.
If an individual cannot update their own information, we will correct any errors in the data we hold promptly after receiving written notice. It is the individual’s responsibility to provide accurate and truthful data. We cannot be liable for incorrect information provided to us.
Where updates are made, we may require further verification, including from third parties such as financial service providers or payment systems like M-PESA.
We may charge a reasonable fee for data access requests, not exceeding the equivalent of €10 per request. Information will be provided within 40 calendar days of receipt of the request.
You have the right to object to us processing your information in relation to:
Processing based on legitimate interests or public interest tasks (including profiling)
Direct marketing
Processing for scientific, historical research, or statistical purposes
If an individual has a complaint about our handling of their data, they should submit it in writing using the contact details below.
You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been infringed.
If a dispute arises, both parties will first attempt to resolve it directly. If we become aware of any unauthorised access to data that may pose a high risk to individuals, we will notify affected individuals without undue delay.
We may update this policy from time to time to comply with legal obligations or changes in our practices. Any updates will take effect once we notify users.
If we make material changes, we will inform users and publish updates on our Platform at: www.lockpesa.com/privacy
It is the user’s responsibility to review this policy regularly. We may also take additional steps to comply with applicable data protection laws, and nothing in this policy limits those obligations.
All correspondence relating to privacy should be addressed to:
