Privacy Policy

Goodname Finance is the trading name of Alana Uganda Limited, a company incorporated in Uganda. We lend money as a money lender under the Tier 4 Microfinance Institutions and Money Lenders Act, 2016 and the Money Lenders Regulations made under it. Money lenders in Uganda are licensed and supervised by the Uganda Microfinance Regulatory Authority (UMRA).

This policy explains how we handle personal data under the Data Protection and Privacy Act, 2019 (the Act) and the Data Protection and Privacy Regulations, 2021. For the data described here, we are the data collector and data controller. The Regulations require us to register with the Personal Data Protection Office and keep that registration current.

This policy applies to everyone whose personal data we handle in our lending business:

• people who visit our website or use our client portal or mobile app;
• applicants, borrowers and former borrowers;
• people who recommend an applicant, such as local council and community leaders, religious leaders, employers and people who know the applicant well;
• guarantors, owners of collateral and next of kin named in an application;
• members and officials of savings groups, VSLAs, associations and other groups that borrow from us; and
• anyone who contacts us by phone, SMS, WhatsApp, email or in person.

Read this policy together with our Terms of Service, our Cookie Policy and our Anti-Money Laundering and KYC Notice. Our own employees' data is covered by a separate staff privacy notice.

We collect only what we need to register you, assess and pay out a loan, collect it and meet our legal duties. Depending on the product, this includes:

• Identity data: full name, date of birth, sex, nationality, photograph, signature, and your National Identification Number (NIN) and card number. If you are not a Ugandan citizen, your passport, refugee identity card or permit.
• Contact data: phone numbers, email address, home and work address, and the name and phone number of your next of kin.
• Income data: your employer or business, how much you earn, payslips, business records, and mobile money or bank statements you choose to give us.
• Recommendation data: the name, role and phone number of the person who recommended you, how they know you, and what they told us when we called them.
• Guarantor and collateral data: the identity and contact details of your guarantors, and documents for any security, such as a logbook, land title or valuation report.
• Group data: the group's name, constitution or registration, member list, officials and their roles, meeting resolutions, and the group's own account details.
• Onboarding fee data: how and when you paid the one-off registration fee, the amount and the receipt or mobile money reference.
• Loan data: each application, our assessment and decision, your loan account and schedule, repayments, arrears, top-ups and restructures.
• Payment account data: the MTN Mobile Money number, Airtel Money number or bank account we pay into and collect from, and the name registered on it.
• Credit data: your credit report and score from licensed credit reference bureaus.
• Communications: messages, call notes, support tickets and complaints.
• Technical data: device type, app version, IP address, browser, sign-in times and security logs.

The Act treats financial information as special personal data and gives it extra protection. We process it only where the Act allows, mainly because you asked us for a loan or because the law requires it.

We do not ask about your religion, political opinions, tribe or health. If you tell us about an illness or another hardship so that we can help with your repayments, we use that information only for that purpose.

What we never collect

Our mobile app does not read the contacts, text messages, call logs, photos or files on your phone. Our website does not use advertising trackers. We never ask for your mobile money PIN, bank PIN or password.

Most of your information comes from you, through your application, the documents you hand over or upload, the client portal, the mobile app or a conversation with one of our officers. We also receive information from:

• the person who recommended you, when we call them to confirm the recommendation;
• your employer, when it confirms your job and pay;
• your guarantors, and the officials of a group you belong to;
• licensed credit reference bureaus;
• the National Identification and Registration Authority (NIRA), when we verify your NIN;
• IOTec Pay, MTN, Airtel and banks, which confirm payments to and from you and the name registered on your account;
• public registers, such as the Uganda Registration Services Bureau; and
• your device, when you use our website, portal or app.

If you give us information about another person, such as a guarantor, a recommender or your next of kin, tell them you have done so and point them to this policy.

The Act allows us to process personal data with your consent. It also allows processing without consent where it is needed to perform a contract with you, to comply with the law, or to prevent or detect crime. We use your data as follows:

• To register you and run your loan (contract and consent): checking your identity and recommendation, recording your onboarding fee, assessing affordability, preparing your quote and agreement, paying out, collecting repayments, issuing receipts and statements, and handling top-ups and restructures.
• To meet our legal duties (legal obligation): identity checks and reporting under the Anti-Money Laundering Act, 2013, record keeping and tax rules, credit reporting, and lawful requests from UMRA, the Financial Intelligence Authority, the Uganda Revenue Authority, courts and the police.
• To prevent fraud and protect accounts (prevention and detection of crime): checking for impersonation, false or duplicate applications, unusual payments and unauthorised sign-ins.
• To recover money that is owed (contract): reminders, arrears follow-up, calling on a guarantor or security and, where necessary, court action.
• To send you service messages (contract): SMS, email and WhatsApp messages about your registration, application, payments, due dates, statements and changes to our terms.
• To tell you about new products (consent only): we send marketing only if you agreed to it, and you can stop it at any time.
• To improve our service (consent, or data that no longer identifies you): we study how our products perform using anonymised data wherever possible.

How decisions are made

Our credit tools combine the information above into a risk grade and a suggested limit. They help our staff; they do not decide on their own. A member of staff reviews every application, and the recommendation behind it is confirmed by a second member of staff. You may ask us to explain the main reasons for a decision about you and to have a person look at it again.

Before we lend, and from time to time while a loan is running, we may search your record at one or more licensed credit reference bureaus. A search may appear on your credit report.

We share your identity details and the history of each loan with those bureaus, including amounts, repayments, arrears, defaults, restructures and settlement. Paying on time builds a good record. Late payment and default are also reported and can make it harder to borrow elsewhere.

Before we report a default

We warn you in writing before we report a loan as in default. You may ask a bureau for a copy of your report and dispute any entry. If we supplied wrong information, we correct it with the bureau once we confirm the error.

All loan payouts and mobile money collections go through IOTec Pay, a payment service provider connected to MTN Mobile Money, Airtel Money and banks. To make or receive a payment we share your phone number or account details, the amount and a reference. We receive back the result, the operator's reference and the name registered on the account, which we use to confirm that the money reached the right person.

When we ask you to pay by mobile money, the request appears on your own phone and you approve it there with your PIN. We never see your PIN. Mobile networks and banks handle your data under their own privacy notices and the National Payment Systems Act, 2020.

Text messages are delivered by EgoSMS and emails by Brevo or Google. Documents you upload, such as identity cards and payslips, are kept in private storage provided by Cloudflare.

We do not sell your personal data. We share it only as needed with:

• Service providers who act on our instructions, including IOTec Pay, EgoSMS, Brevo, Google, Cloudflare and our hosting and backup providers, under contracts that require them to keep it confidential and secure;
• The person who recommended you, only so far as needed to confirm the recommendation. We do not tell them about your loan without your permission;
• Your guarantors: the amount they guarantee and, if you fall behind, what is overdue;
• Your group: for a group loan, the group's officials see each member's position on that loan;
• Your employer, where you have agreed that your employer will deduct repayments from your pay;
• Credit reference bureaus, as described in Part 5;
• Regulators and public authorities: UMRA, the Financial Intelligence Authority, the Uganda Revenue Authority, the Personal Data Protection Office, courts and the police, when the law requires it or a lawful order is served on us;
• Recovery partners: licensed advocates, collection agents, valuers, court bailiffs and auctioneers, only when a loan is in default and only what they need;
• Our auditors, insurers and professional advisers, who owe us a duty of confidentiality; and
• A buyer of our business, under the same protections as this policy.

Your contacts stay private

We never contact the people in your phone, your relatives, friends, neighbours or colleagues about your loan. The only exceptions are your guarantors, the officials of your group for a group loan, your employer where you agreed to salary deductions, and your next of kin in an emergency.

Some of our providers, including Cloudflare, Google and Brevo, store or process data in data centres outside Uganda. The Act allows this only where the receiving country has adequate protection for personal data, at least equal to the protection in Uganda, or where you have consented.

We choose providers that meet that standard, bind them by contract to protect your data, encrypt data in transit and limit what each one receives. You may ask our Data Protection Officer which providers hold your data outside Uganda.

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires:

• Identity, loan and transaction records: 10 years after the loan is settled or our relationship ends, as the Anti-Money Laundering Act, 2013 requires.
• Accounting and tax records: at least as long as the Tax Procedures Code Act, 2014 requires, and never less than the loan record they belong to.
• Applications that were declined or withdrawn: 2 years from the decision, unless anti-money laundering or fraud rules require longer.
• Complaints and correspondence: 6 years after the matter is closed, the period in which a claim may be brought under the Limitation Act.
• Marketing preferences: until you withdraw consent. We then keep only a note that you should not be contacted.
• Website, sign-in and security logs: up to 12 months, unless we need them to investigate an incident.

When a retention period ends, we delete the data or anonymise it so that it can no longer identify you. Copies in backups are overwritten on the normal backup cycle.

• Data is encrypted in transit, and passwords and provider secrets are protected at rest.
• Staff see only the records their role and branch need. Every staff sign-in needs a one-time code sent by SMS and email, on top of a password.
• Every view and change of a client record is written to an audit log that cannot be edited.
• Uploaded documents are held in private storage and opened only through short-lived links.
• Staff and providers are bound by confidentiality, and staff are trained on data protection.

If something goes wrong

If a security breach puts your personal data at risk, we notify the Personal Data Protection Office without delay, as the Act and the Regulations require. Where you are affected, we tell you what happened, what we are doing about it and what you can do to protect yourself.

Keep your codes to yourself

Goodname Finance will never ask you for your PIN, password or a one-time code, by phone, SMS, WhatsApp or in person. Anyone who asks is not acting for us.

Under the Act you have the right to:

1. Access the personal data we hold about you and get a copy, with the purposes we use it for and who we share it with.
2. Correct data that is wrong, out of date, incomplete or misleading.
3. Ask for deletion of data we no longer have a lawful reason to keep. Where the law makes us keep it, for example under anti-money laundering rules, we tell you and restrict how it is used.
4. Object to processing that causes, or is likely to cause, you unwarranted damage or distress.
5. Stop direct marketing at any time.
6. Ask for a person to review a decision based only on automated processing that significantly affects you.
7. Withdraw consent where we rely on it. This does not affect what we did before, and it does not cancel a loan agreement you have already signed.
8. Complain to the Personal Data Protection Office.

Send your request to our Data Protection Officer at privacy@goodnamefinance.com, raise it in the client portal, write to us at our address or tell your loan officer. Say which right you are using and what it concerns.

To protect you, we confirm your identity before we act, usually by checking your NIN and sending a code to the phone number on your account. Someone acting for you must show your written authority.

Our response times

We acknowledge your request within 2 working days and respond in full within 30 days. Requests are free. If we cannot do what you ask, we explain why and tell you how to complain.

We have a Data Protection Officer who oversees how we handle personal data. Contact them about anything in this policy.

Data Protection Officer
Alana Uganda Limited
WhatsApp: +256778461421
Email: support@goodnamefinance.com
Office hours: Monday to Friday, 8:00am to 5:00pm (EAT)

Our website and portals use a small number of cookies and browser storage items, mainly to keep you signed in securely and to remember your display choice. We do not use advertising cookies. Our Cookie Policy lists each one.

We do not lend to anyone under 18 and our services are not meant for children. We do not knowingly collect a child's personal data. If you believe we hold a child's data without a proper reason, tell our Data Protection Officer and we will delete it.

We review this policy at least once a year and whenever our services or the law change. The version number and effective date at the top show which version applies.

We tell you about important changes at least 14 days before they take effect, by SMS, email or a notice in the portal and app.

If you are unhappy with how we have handled your personal data, contact our Data Protection Officer first so that we can put it right. Our Complaints and Dispute Resolution procedure sets out our timelines.

If you are not satisfied with our answer, or at any time, you may complain to the Personal Data Protection Office, set up under the Act within the National Information Technology Authority, Uganda (NITA-U).