Loan Agent Platform — Powered by InnBucks MicroBank

DATA PROTECTION & PRIVACY POLICY

Effective Date: June 2026

1. Introduction

21st Financial Solutions (Private) Limited, trading as 21st Loans (“21st Loans”, “We”, “Us”, “Our”), is committed to protecting the privacy and security of personal data it collects and processes in connection with its loan facilitation platform.

This Data Protection and Privacy Policy outlines our practices regarding the collection, use, storage, and disclosure of personal data, in compliance with the Cyber and Data Protection Act [Chapter 12:07] and the Cyber and Data Protection Regulations, Statutory Instrument 155 of 2024.

We collect your personal data solely for the purpose of facilitating loan applications on your behalf to InnBucks MicroBank Limited, our partner lending institution. We do not sell your data.

2. Definitions

“Personal Data” means any information relating to an identified or identifiable natural person collected through the Platform.
“Processing” means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
“Data Controller” means 21st Financial Solutions (Private) Limited, responsible for determining the purposes and means of processing your personal data.
“Data Processor” means a third party that processes personal data on our behalf, including InnBucks MicroBank and our technology service providers.
“Data Subject” means the Borrower to whom the personal data relates — You.
“Platform” means the 21st Loans mobile application and associated systems.

3. Data We Collect

3.1 Personal Information

Full legal name (including middle name where provided).
National Identity Card number.
Date of birth.
Place of birth.
Gender.
Marital status.
Number of dependants.
Level of education.
Mobile phone number.
Home telephone number (where provided).
Email address (where provided).
Residential address (house number, street, suburb, town, country).

3.2 Employment Information

Name of employer/ministry/department.
Employee code number.
Department number and station code.
Date of employment commencement.
Gross and net salary.
Employer contact details.
Employer physical address.

3.3 Financial Information

Loan amount requested.
Loan purpose.
Repayment period.
FCA bank account details (bank name, account number, branch).
InnBucks wallet account number.
Monthly stop order deduction amount.

3.4 Next of Kin Information

Name, surname, and relationship of next of kin.
Next of kin contact details.
Next of kin national ID number.

3.5 Biometric and Signature Data

Electronic signature captured during the stop order signing process within the Platform.

3.6 Application Data

Application reference number and status.
Date and time of application submission.
Device information and IP address (for security purposes).

4. Why We Collect and Process Your Data

21st Loans collects and processes your personal data for the following purposes:

To verify your identity and confirm your eligibility for a Loan.
To complete and submit your Loan Application to InnBucks MicroBank on your behalf.
To facilitate the execution of the Stop Order and Loan Agreement documents.
To communicate with you regarding your Application status, account, and any required follow-up.
To comply with legal, regulatory, and anti-money laundering obligations.
To detect, prevent, and investigate fraud and other criminal activity.
To improve and maintain the Platform.
To respond to regulatory requests from the Reserve Bank of Zimbabwe or other lawful authorities.

We will not use your data for any purpose other than those stated above without your explicit consent.

5. Informed Consent

By registering on and using the Platform, you give your informed consent to the collection and processing of your personal data as described in this Policy.

You are informed that:

Your consent is voluntary and may be withdrawn at any time by contacting us.
Withdrawal of consent may affect our ability to facilitate your Loan Application.
Some data processing may be required by law regardless of your consent.

Your electronic signature on the Stop Order within the Platform constitutes your signature-based consent to the processing of your data for the purposes of the Loan Agreement.

6. Data Sharing and Disclosure

21st Loans may share your personal data with the following parties:

6.1 InnBucks MicroBank Limited

As our partner lending institution, InnBucks MicroBank will receive your full Application data for the purposes of credit assessment, Loan agreement execution, and disbursement. InnBucks MicroBank is bound by its own data protection obligations as a licensed deposit-taking microfinance institution.

6.2 The Salary Service Bureau

Your payroll deduction (Stop Order) information will be submitted to the Salary Service Bureau of Zimbabwe to enable salary deductions for Loan repayments.

6.3 Technology Service Providers

We use third-party technology providers for cloud hosting, database storage, and application infrastructure. These providers process data on our behalf and are contractually bound to maintain appropriate data protection measures. Current providers include Supabase Inc. (database and storage infrastructure).

6.4 Regulatory and Law Enforcement Authorities

We may disclose your data to the Reserve Bank of Zimbabwe, POTRAZ, law enforcement agencies, or courts where required by law or a valid court order.

6.5 We Do Not Sell Your Data

21st Loans does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes.

7. Data Security

21st Loans implements appropriate technical and organisational measures to protect your personal data, including:

End-to-end data transmission encryption using HTTPS/TLS protocols.
Database-level row security policies ensuring you can only access your own data.
PIN-based authentication with hashed PIN storage — we cannot see your PIN.
Access controls ensuring only authorised 21st Loans staff can access application data.
Supabase Storage security policies for all uploaded documents and signatures.
Regular security reviews of our Platform infrastructure.

Despite our best efforts, no system is completely secure. You use the Platform at your own risk and should notify us immediately if you suspect any unauthorised access to your account.

8. Data Retention

21st Loans retains your personal data for a minimum period of 7 years from the date of your last Loan application or the settlement of your last Loan, whichever is later. This is to comply with:

Anti-money laundering record-keeping requirements under the Money Laundering and Proceeds of Crime Act [Chapter 9:24].
Financial record-keeping requirements applicable to loan agents.
Any period prescribed by the Reserve Bank of Zimbabwe.

Upon expiry of the retention period, your data will be securely deleted from our systems unless we are required by law to retain it further.

9. Your Rights

As a Data Subject under the Cyber and Data Protection Act [Chapter 12:07], you have the following rights:

Right to be informed of the purposes for which your personal data is collected and used.
Right to access your personal data held by 21st Loans.
Right to object to the processing of your personal data.
Right to correction of inaccurate or misleading personal information.
Right to deletion of false or misleading data about you.

To exercise any of these rights, please contact us using the details in Section 11. We will respond within 30 days of receiving your request.

10. Cross-Border Data Transfers

Your data is stored on infrastructure operated by Supabase Inc., which may be hosted in data centres outside Zimbabwe. We ensure that appropriate safeguards are in place, including standard contractual clauses, to protect your data when it crosses national borders.

By using the Platform, you consent to the transfer of your data outside Zimbabwe for the purposes described in this Policy.

11. Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way we handle your personal data, please contact:

Data Controller: 21st Financial Solutions (Private) Limited

Trading as: 21st Loans

Website: www.21st.co.zw

Platform: 21st Loans Mobile Application

If you are not satisfied with our response, you have the right to lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the Data Protection Authority of Zimbabwe.

12. Policy Updates

This Policy may be updated from time to time to reflect changes in law, regulation, or our business practices. We will notify you of any material changes through the Platform. Your continued use of the Platform after notification constitutes your acceptance of the updated Policy.

Last updated: June 2026