Data Privacy Policy

Effective date: 30 September 2026 · Entity: mBenki Solutions Zambia Ltd (“mBenki”, “we”, “us”, “our”)

1. Purpose and scope

This Policy explains how we collect, use, share, secure, keep and delete personal data across everything mBenki does: the website at mbenki.com; the public agent verification service at verify.mbenki.com; the mBenki Pro app used by Smart Agents; the mBenki Go app for customers (in development); the mBenki Nexus portal used by institutions, including CIMS (Customer Inquiry Management Solution) and Agency Ops Manager; and the field data collection we run for partners. It covers customers, Smart Agents, employees and agents of partner institutions, survey respondents, website visitors and anyone who contacts us.

2. Who we are and our registration

The company. mBenki Solutions Zambia Ltd is the operating company, registered in Zambia and run from Lusaka. mBenki, Inc., a Delaware company, provides technology, capital and partnerships. Where mBenki, Inc. or its contractors support the platform, they act on our instructions under written agreements and this Policy applies to them.

Our roles. We act as Data Controller for our own operations: the agent network, verification, marketing, security and the website. We act as Data Processor when we handle data on behalf of a partner institution, for example a customer’s application to that institution, an institution’s own agents in Agency Ops Manager, or a dataset a partner has commissioned.

Registration. mBenki is registered with the Office of the Data Protection Commissioner as both a Data Controller and a Data Processor under Section 19 of the Data Protection Act No. 3 of 2021. The registration certificate is shown at the top of this page.

3. Definitions

• Personal data: information that identifies or can identify a person.
• Controller: decides why and how personal data is processed.
• Processor: handles personal data for a controller under instructions.
• Processing: any operation on personal data: collecting, storing, using, sharing, deleting.
• Sensitive data: personal data that needs higher protection under the Act, such as national identity numbers, financial details and biometric data.
• Smart Agent: an independent, trained and certified agent who uses mBenki Pro.
• Partner institution: a lender, insurer, fintech or other organisation whose products are distributed through the network or which uses mBenki Nexus.

4. Data we collect, and from whom

Customers. Name, phone number, email and address; national ID details where a product legally requires them; what you asked about, what was offered, what you chose and why; eligibility information you or the institution provide; application status and outcome; consent records; and, if you rate an agent, the phone number used to send your one-time PIN.

Smart Agents. Identity and KYC documents at onboarding; photo; training and certification records; the products you present and the leads you submit; activity, productivity and quality reviews; customer ratings; commission records; and the location and time of field activity captured by mBenki Pro.

Agents and staff of partner institutions (Agency Ops Manager and white-label verification). Name, photo, contact details, approval status, activity and ratings, as supplied by the institution or captured through the apps, processed on the institution’s instructions.

Survey respondents and the public (field data collection). Answers to questionnaires; business names, locations and prices; photographs of shop shelves and stock; video of public places such as traffic circles; and the location and time each record was made. We do not deliberately collect names or faces of members of the public, and we blur or exclude identifiable individuals where a partner’s brief does not require them.

Website visitors and enquirers. What you type into the contact form; your IP address, device type and pages viewed; and cookie data as described in Section 12.

5. Why we use data, and the legal basis

• To deliver the service: match customers to products, check eligibility, submit applications, pay commission, and run the agent network. Basis: contract, and consent where the Act requires it.
• To record inquiries, including the ones that do not become a sale. CIMS keeps a structured record of each inquiry: the need, the offer, the outcome and the reason. Institutions use this to see demand they are serving and refusing. Basis: the institution’s legitimate interest and your consent, which the agent asks for at the start of the conversation.
• To publish agent verification. Every Smart Agent’s name, photo, agent code, status and customer rating are shown publicly at verify.mbenki.com so customers can check who they are dealing with. Basis: consent, given as a condition of joining the network, and the public interest in preventing agent fraud.
• To collect field data for partners. Surveys, price checks, shelf photographs and public-place video, to a partner’s written brief. Basis: the partner’s legitimate interest, respondent consent where individuals are identifiable, and the Act’s provisions on research.
• To provide analytics to institutions and partners: dashboards, conversion, demand and market insight. Where insight leaves the institution that collected the data, it is aggregated so no individual can be identified.
• To keep the platform safe: fraud prevention, security monitoring, complaints and legal obligations. Basis: legal obligation and legitimate interest.
• To communicate with you about the service and, only with your opt-in, marketing you can stop at any time.

6. How we collect data

• From you directly: the contact form, calls, WhatsApp, events, and conversations with a Smart Agent.
• Through our apps: mBenki Pro (agents) and, when launched, mBenki Go (customers, including documents you upload yourself).
• From partner institutions: product rules, eligibility inputs, application decisions, and their own agent lists.
• From the field: geotagged and time-stamped records made by agents during data collection.
• Automatically: cookies, app telemetry, device data and system logs (Section 12).

7. Who we share data with

• The institution you apply to. Your inquiry and application go to that institution so it can decide. It then handles your data under its own privacy policy.
• Anyone who checks an agent’s ID. The public verification page shows the agent’s name, photo, code, status and rating. It never shows an agent’s national ID number, phone number or address.
• Partners who commission field data. They receive the dataset they commissioned. Commissioned datasets belong to the partner. Where findings are published, for example local-content data along the Lobito Corridor, they are aggregated and released as agreed with the partner.
• Service providers. Hosting, video and content delivery, email, analytics and support, under written contracts. Our website and contact form run on Squarespace, and some page content is delivered through Cloudflare, so limited data is processed on their servers outside Zambia. If you accept marketing cookies, Meta Platforms receives limited browsing data through the Meta Pixel (Section 12).
• mBenki, Inc. and its contractors, for platform development and support, under written agreement.
• Regulators, courts and law enforcement when the law requires it, or to protect rights, safety and prevent fraud.
• A buyer or successor if we reorganise or transfer part of the business, with notice where appropriate.

We do not sell personal data.

8. Where data is kept and cross-border transfers

Platform data is stored in Zambia or in cloud regions selected for security and reliability. Where data leaves Zambia, including website, form and video hosting, we rely on written agreements with the provider that require equivalent protection, and we comply with the Act’s conditions for cross-border transfer. Sensitive data receives heightened protection wherever it is processed.

9. Security

• Access: least privilege, strong authentication for privileged roles, periodic access reviews.
• Protection: encryption in transit; proportionate encryption and key management at rest.
• Verification records are held on mBenki’s servers, never on the printed card, so a card cannot be altered or copied to gain access.
• Monitoring: audit logs for sensitive actions, anomaly detection, secure engineering practice.

No system is impenetrable. We review and improve our controls continuously.

10. How long we keep data

• Inquiry and application records: for the life of the service and any contractual or statutory period, then deleted or anonymised.
• Agent records: for the engagement plus statutory labour and tax periods. An agent’s public verification record is removed or marked inactive when the agent leaves the network.
• Ratings: kept while the agent is active; the phone number used for the PIN is deleted once the rating is confirmed.
• Field data: delivered to the partner, then held by mBenki only as long as the brief or the law requires.
• Logs and telemetry: generally up to 12 months, then deleted or aggregated.
• Financial records: as required by law and tax rules.
• Backups: rotated on scheduled cycles and never used for active processing.

11. Your rights

You can ask to see the data we hold about you, correct it, delete it, object to certain processing, or withdraw consent where we rely on it. Smart Agents can ask what appears on their public verification record and challenge a rating they believe is false or abusive.

How: email information@mbenki.com or write to the address in Section 19. We verify your identity and respond without undue delay. Where we act as Processor, we pass your request to the institution or partner and help them respond.

Complaints: if you are not satisfied, you may complain to the Office of the Data Protection Commissioner.

12. Cookies and tracking

What we use. Strictly necessary cookies that make the site work; analytics cookies that tell us which pages are used; and, if we run campaigns, marketing cookies to measure them. Video on the site is streamed from our hosting provider and may set a functional cookie when you press play.

Meta Pixel. For advertising measurement, our website uses the Meta Pixel, a tool from Meta Platforms, to count visits from our ads and taps on our WhatsApp and Google Play buttons. It does not receive what you type into the contact form. You can opt out by declining marketing cookies in the cookie banner, by changing your ad preferences in your Facebook or Instagram settings, or by blocking third-party cookies in your browser.

Your choice. Optional cookies run only after you accept them in the cookie banner. You can change your choice at any time from the banner or your browser settings. We honour browser-level opt-out signals where technically possible.

Apps. mBenki Pro records location and time during field work and may use call and message capture for quality and compliance, with notice in the app and access limited to authorised staff.

13. Smart Agents: your duties with data

• Consent first: ask for the customer’s consent before recording an inquiry, and tell them what will be recorded and why.
• Minimum necessary: collect only what the product journey or the brief requires; give a clear notice before capturing sensitive data or documents.
• Device hygiene: lock your phone; keep the app updated; never keep customer photos or documents outside mBenki Pro; never share your login.
• Field work: when collecting data for a partner, follow the brief, do not film or photograph identifiable people without their agreement, and respect private property.
• Incidents: report a lost device, a suspected breach or a complaint immediately through the agent support channels.
• Leaving the network: delete all mBenki and institutional data from your devices as directed; your public ID is withdrawn.

14. Third-party platforms

We use Google Play to distribute mBenki Pro, and a Facebook group and a WhatsApp Community to support agents. Anything you post or share on those platforms is governed by their privacy policies, not this one. We do not receive your Facebook or WhatsApp data beyond what you choose to share with us there.

15. Children

Our services are for adults and businesses. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it.

16. If something goes wrong

We detect, contain, investigate and fix incidents, and we document what we learn. Where we act as Processor we notify the institution first. We notify the Commissioner and affected people when the law or a contract requires it.

17. Our suppliers

We assess a supplier’s privacy and security before using it. Contracts require confidentiality, security, help with rights requests and prompt notice of breaches. We keep a list of processors and tell institutions of significant changes where their contract requires it.

18. Deleting your data

Customers: email information@mbenki.com. We remove your data from active systems; copies in backups are placed beyond use until they are overwritten on schedule. We also ask the institution and any partner holding a copy to delete it where we are able to.

Smart Agents: choose “Close account” in mBenki Pro, or email us. Some records must be kept for the periods in Section 10.

19. Contact and company details

• Data protection contact: Pamfred Hasweeka, Chief Executive Officer
• Email: information@mbenki.com
• Telephone / WhatsApp: +260 773 158 012
• Legal name: mBenki Solutions Zambia Ltd
• PACRA registration no.: 120230053952
• Registered address: Plot No. 20436, Yotam Muleya Road, Libala South, Libala Mall, Lusaka, Zambia
• Directors: Pamfred Hasweeka (CEO), Chris Sinchende (COO), Javier Cerdas (CTO)

20. Changes to this Policy

We post updates here with a new effective date, and tell agents and institutions directly when a change matters to them. This version replaces the policy dated 15 August 2025.