Spellbound Credit Privacy Policy

Spellbound Credit Privacy Policy

Zimbabwe privacy notice for the Spellbound Credit mobile application and related services

Last updated: 16 April 2026

1. About this Privacy Policy

This Privacy Policy explains how Spellbound Credit collects, uses, stores, shares and protects personal information when you use the Spellbound Credit mobile application, website, customer support channels, agency or branch network, or any related lending, payment, account management and support services.

This policy is intended to reflect Zimbabwean privacy requirements, including the right to privacy under the Constitution of Zimbabwe, the Cyber and Data Protection Act and applicable regulations issued under that framework.

By using our services, creating an account, submitting an application, making a payment, communicating with us or otherwise providing information to us, you acknowledge this Privacy Policy and, where required by law, you consent to the processing described in it.

2. Scope

This Privacy Policy applies to personal information processed through:

• the Spellbound Credit mobile application and any connected website or customer portal;

• loan or credit application journeys, account onboarding and know-your-customer (KYC) checks;

• payment, repayment, collections, support, fraud prevention and complaints handling processes;

• communications sent by email, SMS, WhatsApp, push notification, telephone or in-app messaging; and

• our service providers, partners, agents and contractors where they process personal information on our behalf.

3. The Information We Collect

Depending on the service you use, we may collect and process the following categories of personal information:

4. How We Collect Information

We collect personal information:

• directly from you when you register, apply for credit, upload documents, contact us or make payments;

• from your device or browser when you use our app, portal or website;

• from employers, referees, merchants, service providers, payment channels or agents where you authorise this or where the law allows it;

• from public sources or lawful third-party sources for identity verification, fraud prevention, debt recovery, sanctions screening or compliance checks; and

• from cookies, software development kits, analytics tools and security tools used in our digital services.

5. Lawful Grounds for Processing

We process personal information on lawful grounds recognised under Zimbabwean law. Depending on the circumstance, we may process your information because:

• you have given consent, including written consent where required for sensitive, biometric or similar categories of information;

• the processing is necessary to take steps at your request before entering into an agreement or to perform our contract with you;

• the processing is required to comply with a legal or regulatory obligation;

• the processing is necessary to protect your vital interests or those of another person;

• the processing is necessary for a task carried out in the public interest or under lawful authority; or

• the processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms.

Where we rely on consent, you may withdraw that consent at any time for future processing, subject to any processing already lawfully carried out and subject to the limits of our legal or contractual obligations.

6. How We Use Your Information

We may use personal information to:

• create and manage your account;

• verify identity, assess eligibility, evaluate affordability and process applications for credit or financing;

• detect, prevent and investigate fraud, abuse, money laundering, identity theft, cyber incidents and other unlawful activity;

• disburse funds, collect repayments, reconcile payments, manage arrears and support debt recovery processes where applicable;

• provide customer support, investigate complaints and improve our products and services;

• send transactional messages, reminders, statements, receipts, alerts and service announcements;

• comply with legal, regulatory, audit, risk management and record-keeping obligations;

• carry out internal reporting, security monitoring, analytics and product improvement; and

• send marketing or promotional messages where allowed by law and subject to your right to opt out.

7. Sensitive Information, Biometric Information and Credit Risk Checks

Some information handled by a credit platform may be sensitive. This may include identity document images, financial hardship information, biometric information used for verification, or other information treated as sensitive under Zimbabwean law.

Where we process sensitive, biometric or similar information, we will do so only where permitted by law and, where required, on the basis of your written consent or another lawful ground recognised by law.

If we use tools to support fraud screening, identity verification or credit risk assessment, we will apply reasonable safeguards and will not make legally significant decisions based solely on automated processing unless you have consented or the law otherwise permits it.

8. Sharing and Disclosure of Information

We may share personal information only where necessary and lawful, including with:

• our employees, branches, authorised agents and affiliated entities on a need-to-know basis;

• payment processors, mobile money providers, banks, messaging providers, cloud hosting providers, security providers and other service providers acting under contractual controls;

• merchants, delivery partners, insurers, debt recovery agents, legal advisers, auditors and professional advisers where relevant to the service;

• law enforcement agencies, regulators, courts or public authorities where disclosure is required by law or to protect our legal rights; and

• a buyer, investor or restructuring party in the event of a merger, acquisition, reorganisation or sale of assets, subject to lawful safeguards.

We do not sell personal information. Any third party that processes information on our behalf must protect it and may use it only for authorised purposes.

9. Cross-Border Transfers

Some of our service providers or technology systems may store or process personal information outside Zimbabwe for instance ONFON Mobile based in South Africa. Where this happens, Spellbound Credit will take steps to ensure that the transfer is lawful and that an adequate level of protection is in place, including contractual controls, security safeguards, due diligence and any additional measures required by Zimbabwean law.

Where required, we will also obtain your consent or rely on another lawful basis before transferring personal information outside Zimbabwe.

10. Retention of Information

We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, or for longer where required by law, regulation, audit, dispute resolution, fraud prevention, debt recovery, litigation hold or legitimate business record-keeping requirements.

When information is no longer required, we will delete, anonymise, de-identify or securely destroy it in accordance with our retention and security controls.

11. Security of Information

We use reasonable technical, organisational and administrative safeguards designed to protect personal information against loss, misuse, unauthorised access, unauthorised disclosure, alteration and destruction.

• role-based access controls and confidentiality obligations;

• system monitoring, authentication controls and audit trails;

• data minimisation and need-to-know access practices;

• secure transmission and storage measures where appropriate; and

• vendor oversight and contractual controls for processors and service providers.

No system can be guaranteed to be completely secure. You should also protect your account credentials, device access and one-time passwords, and contact us immediately if you suspect unauthorised use.

12. Data Breaches

If we become aware of a personal data breach affecting personal information, we will investigate it, contain it, take remedial action and make notifications required by Zimbabwean law. This may include notifying the relevant authority within 24 hours of becoming aware of the breach and, where the breach is likely to create a high risk to individuals’ rights and freedoms, notifying affected individuals within 72 hours.

13. Children’s Information

Spellbound Credit’s services are generally intended for adults. We do not knowingly provide credit services to children, except where the law allows the relevant service and the required parent or legal guardian involvement exists.

Where children’s information must be processed, we will require the consent of a parent or legal guardian and apply additional safeguards appropriate to the child’s rights and best interests.

14. Your Rights

Subject to Zimbabwean law, you may have the right to:

• be informed about how your personal information is used;

• request access to personal information held about you;

• object to the processing of all or part of your personal information in appropriate circumstances;

• request correction of false, incomplete or misleading personal information;

• request deletion of false or misleading personal information where the law allows;

• withdraw consent where we rely on consent for processing;

• opt out of direct marketing communications at any time; and

• raise a complaint with us or with the relevant regulator.

15. Automated Decision-Making and Profiling

Spellbound Credit may use scoring models, fraud rules, verification tools and other analytical processes to support onboarding, security and account management. Where a decision produces legal effects or similarly significant effects for you, we will apply human oversight or another lawful safeguard unless the law allows the decision to be made solely on an automated basis or you have expressly consented.

16. Marketing and Communications

We may send service-related communications that are necessary for your account or transaction. We may also send promotional or educational communications where this is permitted by law. You can opt out of marketing messages by using the unsubscribe method in the message, updating your preferences in the app, or contacting us using the details below.

17. Contact Us and Complaints

If you are unhappy with how we handle your personal information, please contact us first so that we can try to resolve the issue. You may also lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which is the designated data protection authority under Zimbabwean law.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, security practices or operating model. The latest version will be made available through the app, website or another appropriate channel, and the effective date will show when the update takes effect.

Effective Date

16 April 2026