Skip to content
PesaRails
Legal

Requesting deletion of your data

You can ask us to delete the personal data we hold about you. This page explains exactly how to do that, how long it takes, and, just as importantly, the records Kenyan law does not let us delete.

Effective 1 August 2026

Start here: who holds your data

PesaRails builds the software that lenders use; we are not a lender. For borrower data, the institution that lent to you is the data controller and we act on their instructions. That affects where your request should go:

You borrowed from a lender that uses PesaRails
Contact that lender first. They hold the decision. If you do not know who they are, or they do not respond within 30 days, write to us and we will identify the controller and escalate on your behalf.
You messaged a PesaRails-powered WhatsApp number
Send us the request directly using the steps below. Include the phone number you messaged from, since that is how the record is keyed.
You submitted a demo or sales enquiry on this website
Send us the request directly. We are the controller for this data and can delete it outright.

How to make the request

  1. Email info@pesarails.com with the subject line Data deletion request.
  2. Tell us which channel your data came through (WhatsApp, the borrower portal, or this website) and include the phone number or email address associated with it.
  3. If you know the lender you dealt with, name them. It lets us go straight to the right records.
  4. We will ask you to verify your identity before we act. We will not delete data on an unverified request, because doing so on a stranger's say-so would itself be a security failure.

We acknowledge requests within 7 days and complete them within 30 days, as section 26 of the Kenya Data Protection Act 2019 requires. If a request is complex enough to need longer, we will tell you why before the 30 days are up.

Deleting data received through WhatsApp or Facebook

Where a lender runs its loan conversation on the WhatsApp Business Platform, we receive your phone number, your WhatsApp profile name and the messages you send. To have that removed:

  • Email us as described above, from or naming the WhatsApp number in question, and ask for deletion of your WhatsApp conversation data.
  • We delete the message history, the conversation state and the profile name held against that number, subject to the retention rules below.
  • We confirm in writing when it is done, with a reference you can quote if you need to follow up.

Removing the PesaRails integration from your Facebook or Meta account settings stops future data flowing to us, but it does not by itself delete what we already hold. Send the request so we can act on the existing records.

What gets deleted

  • Your WhatsApp conversation history and stored conversation state
  • Uploaded KYC documents: ID images, selfies, and next-of-kin or guarantor images
  • Uploaded M-PESA statements and the transactions parsed from them
  • Captured GPS location
  • Credit scores and the derived factors behind them
  • Portal account details, notifications and marketing or sales correspondence

What we cannot delete, and why

This is the part most deletion pages leave vague, so to be direct about it: if you have taken a loan, the record of that loan and the transactions on it cannot be erased on request while its statutory retention period is running.

Kenyan anti-money-laundering and financial-records law obliges regulated lenders to keep identity and transaction records for a set period, commonly seven years, after the relationship ends. Credit reference reporting carries its own obligations. A deletion request cannot override a legal duty that sits on the lender.

What we do instead, and will confirm to you in writing:

  • Delete everything not caught by a retention obligation
  • Restrict the rest so it is retained solely to satisfy that obligation and is not used for scoring, marketing, or any other purpose
  • Delete it in full once the retention period expires

If you have never taken a loan and only made an enquiry or an incomplete application, this does not apply to you. That data is deleted outright.

If you are not satisfied

You can complain to the Office of the Data Protection Commissioner of Kenya at odpc.go.ke. We would rather resolve it with you directly first.

Related

Our full privacy policy sets out what we collect, the basis we rely on, who we share it with, and the rest of your rights under the Data Protection Act.