Privacy policy

We care about your privacy, data protection and confidentiality. This Privacy policy (hereinafter – “Privacy policy”) states, what information we collect, for which purposes and means and what are your rights.

Your personal data controller is Mogo Loans - SMC Limited (hereinafter – “we”, “mogo”) as part of Eleving Group.

1. Definitions

Processing – any operation or set of operations which is performed on personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, etc.

Client – a person, who uses, has used or expressed interest to use any of our Services.

Eleving Group is Eleving Finance S.A., registered with the Luxembourg Trade and Companies Register under number B 174457 and all Eleving Finance S.A. affiliated companies and subsidiaries, including but not limited to AS Eleving Solis.

Services – any services provided by mogo as part of Eleving Group, including car leasing, rent, leaseback services, asset financing of motorcycles and mobile phones.

Personal data – any information directly or indirectly relating to the Client or information that could allow to directly or indirectly identify the Customer.

Personal data protection laws – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), Data Protection and Privacy Act 2019 of Uganda and other applicable data protection legal acts.

2. When is this Privacy policy applicable?

This Privacy policy applies when:

You use or have expressed the intention to use any of our Services;
You represent a Client (for example as a guarantor, the payer, authorized representative, etc.) or you have been indicated as the contact person for the Client;
You have used our Services in the past and we are required to retain this information;
You contact us or visit any of our representative and customer service offices;
You visit our website;
In any other way provide us with your personal data for any of the data processing purposes set in this Privacy policy.

3. What are the data processing purposes and legal basis?

We can process your personal data for various purposes and based on different legal grounds. Please note that we may process certain types of personal data for several purposes at the same time. We may receive your data from both you and external sources, such as public and private registries and other third parties.

3.1. Processing your application and concluding a Service contract

Mainly we process your personal data to provide you with our Services and carry out various pre-contractual activities and assessments, conclude the Service contract, fulfil it and terminate it. For this purpose, we will process information that allows us to identify you, verify the information you provide, and offer you the most appropriate Service. We may also process the data of persons related to you, such as your contact person, guarantor, the payer or the authorized representative. If you provide us with such contact details, you are required to notify this person that you have provided their details to us.

If you have submitted an application, which has not been finalized, we will process the information provided and, if reasonably required, contact you to obtain any additional information, which we require to enter into a Service contract with you.

Category of personal data

Legal basis

Your identification data (e.g., name, surname, personal ID number, date of birth, ID document data, driver's license data, information on family relations, if necessary),
Contact information (phone number, e-mail address, address),
Choice of language and form of communication,
Information on your vehicle (e.g., registration number, chassis number, brand, year, color, owner data, user data, fines, etc.)
Name, surname and contact information of your contact person or representative (payer, guarantor, authorized representative).

Processing is necessary for the performance of the Service contract or to take steps prior to entering into the Service contract.

3.2. Evaluation of your solvency and credit history

To provide you our Services, there are several assessments we are legally required to carry out, such as evaluations of your solvency, credit history and source of income. To comply with these requirements, we may process various data, which allows us to assess you as a customer, determine your solvency, sources of income, the amount of other liabilities, past liabilities, as well as comply with anti-money laundering requirements.

Category of personal data

Legal basis

Your identification data (e.g., name, surname, personal ID number, date of birth, ID document data, information on family relations, if necessary),
Contact information (phone number, e-mail address, address),
Information on your education and employment,
Financial data (e.g., information on your liabilities, income and other assets, dependents, etc.)
Information on the origin of funds (e.g., information about the employer, business partners, business, bank statements, or other data that allows us to verify your funds and prevent money laundering and terrorist financing, ascertain if you are a politically exposed person, etc.),
Data on your fulfillment of obligations (e.g., information on your previous and current financial obligations, payment discipline, failures to pay, etc.).

Processing is necessary for compliance with a legal obligation, which we are subject of.

Your consent provided to us to request specific information from public authorities’ database (such as the State Social Insurance agency).

3.3. Purchasing vehicle insurance policy on your behalf

If we have received a relevant request from you or you have not fulfilled your contractual duty to provide the vehicle insurance in due time, we can purchase the compulsory civil liability insurance policy on your behalf. For this purpose, we will process your and your vehicle's data.

Category of personal data	Legal basis
Your identification data (e.g., name, surname, personal ID number, date of birth), Contact information (phone number, e-mail address, address), Data on your vehicle (e.g., registration number, registration certificate).	Processing is necessary for the performance of the Service contract or to take steps prior to entering into the Service contract.

3.4. Processing of payments

To comply with our legal requirements, for example, for accounting, anti-money laundering, payment processing, processing prepayments and maintaining other payment-related documentation, we process your data related to your payments and fulfillment of your financial obligations towards us.

Category of personal data	Legal basis
Your identification data (e.g., name, surname, personal ID number, date of birth), Contact information (phone number, e-mail address, address), Information on the payments you have made to us and your bank account details.	Processing is necessary for compliance with a legal obligation, which we are subject of.

3.5. Marketing and promotional activities

We may process certain personal data to inform you about our news, lotteries, promotional activities and send you personalized offers. In the case of personalized offers and advertising, we may use profiling (for more details on profiling and automated decision making, see Section 7). We collect some of this data using cookies.

Category of personal data

Legal basis

Your identification data (e.g., name, surname, age),
Contact information (phone number, e-mail address),
Information on participation in lotteries, promotions, or other campaigns,
Information received from cookies and similar technology, which provide us data on user preferences and interests.

Your consent to receive marketing and promotional information.

Our legitimate interests to pursue direct marketing activities if you are using our Services.

3.6. Communication with you and providing customer service

To communicate with you, provide our customer service, consultations, resolve any issues in relation to our Services, we may process your data that we already have (such as your name, contact information and information about the Service you are using) and the data you provide to us during communication.

Category of personal data	Legal basis
Your identification data (e.g., name, surname, personal ID number), Contact information (phone number, e-mail address, address), Voice recordings, Other information, which you may provide to us during the communication (for example, data on your contract with us, your vehicle data, etc.).	Our legitimate interests to provide you with quality service and to solve any related problems.

3.7. Vehicle location data (GPS) processing

To monitor our vehicles during the rental time, we have equipped our rental cars with GPS tracking devices. These devices can record vehicle location information, driving habits, and other data related to the use of the car. Detailed information about the processing of your data for this purpose is provided to the Client when starting the car rental Service.

Category of personal data	Legal basis
Your identification data (e.g., name, surname, personal ID number), Contact information (phone number, e-mail address, address), Data on the monitored vehicle, Vehicle location data, Driver’s driving habits.	Our legitimate interests to ensure the protection of our vehicles and their use in accordance with the rent service agreement.

3.8. Defending our legal interests, including prevention of fraud, debt collection and assignment

In certain cases, we may process your personal data to pursue and defend our legal interests, such as to prevent fraud or attempted fraud, recover funds, pursue debt recovery, assert debts, prove your consent, resolve any disputes and conflicts, and raise and maintain legal claims.

For this purpose, we may ask you to provide the details of your additional contact person. We will use such information in cases where we are unable to contact you, and we need to provide you with information related to the Service or the agreement. If you provide us with such contact details, you are required to notify this person that you have provided their details to us.

Category of personal data

Legal basis

Your identification data (e.g., name, surname, personal ID number and other identifiable information),
Name, surname and contact information of your contact person,
Information on the Service you are using or have used,
Validity of phone number and/or email address you have provided,
Information on the consent you have provided,
Other information, which may be required for this particular data processing purpose.

Our legitimate interests to pursue and defend our legal interests, prevent fraud or attempted fraud, recover funds, pursue debt recovery, assert debts, prove your consent, resolve any disputes and conflicts, and raise and maintain legal claims.

3.9. Analysis and improvement of our Services

We may process your personal data to find out your opinion on our Services, as well as to analyze our Services, maintain client statistics and other analytical information for the purpose of assessing risks, improving the Service and avoiding deficiencies.

Category of personal data	Legal basis
Your identification data (e.g., name, surname, personal ID number, date of birth), Contact information (phone number, e-mail address) Information on your preferences and satisfaction of the Service.	Our legitimate interest to analyze and improve our Services.

3.10. Technical supervision and improvement of the Services

To monitor the use of our Services, as well as the operation of our information systems, including databases, websites and networks, we may process various technical data obtained from cookies, audit trails and other technical solutions.

Category of personal data	Legal basis
Your IP address, Information on your device, Type and version of your browser, Time zone, various metadata, information on access to the website, information on interaction with the website, data entry, modification, and other information for that purpose.	Our legitimate interests to ensure the safety and security of our Services and continuity of our business activities and technical assets.

4. From where do we receive your personal data?

Depending on the purpose of the data processing, we may receive your personal data from various sources:

from you when you apply for or show interest in our Services;
if you are indicated as the Client’s contact person or representative (payer, guarantor or authorized representative), we have received the data from the Client;
from third parties from whom we request information for the assessment of your solvency, credit history and origin of funds, such as credit bureaus, public authorities (such as the Uganda Registration Service Bureau, Uganda Revenue Authority, National Identification Registration Authority), debt history databases and other cooperation partners or third-party service providers who can provide the necessary information.

5. With whom do we share your personal data?

To provide our Services, we need to share some of your personal data with third-party service providers (hereinafter – Service Providers) and other data recipients, for example:

Other Eleving Group companies, who may provide us certain services or assist us with certain business processes;
public authorities and other institutions (such as the Uganda Registration Service Bureau, Uganda Revenue Authority, National Identification Registration Authority), as well as law enforcement authorities, sworn bailiffs, tax administrations, supervisory authorities and financial investigation authorities and third parties, which maintain various credit registers, government registers and commercial registers;
credit institutions, financial institutions, insurance service providers and financial intermediaries and other third parties involved in the provision of the Services and in the conclusion and/or performance of the contract, such as sellers of leasing objects and authorized persons related to their servicing, as well as fees and fines related to such objects;
Service Providers that provide AML and fraud detection tools, client identification tools, server co-location services as well as data and cyber security services, email and content delivery tools, postal, marketing, accounting, legal, audit, IT, web analytics, session recording, and online marketing services and other services that we may reasonably need;
debt collectors or other legal persons under assigned rights, courts, out-of-court dispute resolution bodies, bankruptcy or insolvency administrators as well as peer to peer loan investment platforms.

In certain situations, we have a legal obligation to share your information with third parties to comply with legal requirements or requests, as well as to protect our, or a third party’s legal interests. We will also disclose your information to third parties to the extent allowed by applicable law, including:

to a prospective purchaser or purchaser that acquires all or substantially all of us or our business;
to a third party if we sell or buy any business, assign or cede certain claim rights or undergo a merger, in which case we may disclose your information to the prospective buyer of such business; and
to a third party if we partner with other companies or businesses, undergo a reorganization, bankruptcy, or liquidation, or otherwise undertake a business transaction or sell some or all our assets. In such transactions, your information may be among the transferred assets.

When we share your personal data with the Service Providers, we comply with the requirements of applicable Personal Data Protection Law, namely:

We transfer only the minimum amount of data that is necessary for a particular Service Provider;
We only work with Service Providers who can ensure an appropriate level of personal data protection;
If the Service Provider acts as our processor of personal data, it may only process your data in accordance with our instructions and in accordance with a written agreement and may not use it for other purposes.

If any of the Service Providers are located outside Uganda, we will share your data in accordance with the requirements set in the applicable Personal Data Protection Law, including:

by using other appropriate grounds for data transfer provided by applicable Personal Data Protection Law such as data processing agreement, codes of conduct and certifications,
cooperating with Service Providers located in country, which offers an adequate level of data protection in accordance with the relevant adequacy decision.

6. Video surveillance

We conduct video surveillance in our client service centers, offices, car dealerships and other premises, where we operate. We process the data based on our legitimate interests to prevent and detect criminal offenses and to protect our property. Video surveillance is active 24 hours a day, 7 days a week. Data obtained during the video surveillance is retained for 90 days. After this period, data is deleted, if it is not reasonably required to retain it for other purposes such as investigation of criminal activities, the protection of our or third-party legal rights. When choosing the placement of video surveillance cameras, we have taken into consideration the following aspects:

Video surveillance area – the cameras record the areas required to achieve the purpose of video surveillance. Other buildings, areas outside the Company's premises and territories are not filmed;
Video surveillance quality – the cameras are positioned so that the captured image can be used for the intended purpose, the persons seen in the video are identifiable and the cameras are suitable for the surveillance area;
Data subject privacy – the cameras do not capture the areas, which are designed for private use (for example, lavatories, relaxation areas, etc.).

7. When do we use profiling and automated decision making?

Profiling is the evaluation of Clients according to certain parameters, such as economic situation, personal preferences, interests, behavior, etc., to classify Clients into one of our pre-defined client categories. Automated decision making is the ability to make decisions by technological, automated means, using the data provided by the Client or the information obtained as a result of profiling.

We may use profiling and make automated decisions to process your application for our Services, assess your creditworthiness and risks, evaluate the ability to provide you with our Services, determine the maximum loan amount, assess and prevent fraud risk, and fulfill our obligation to comply with money laundering and terrorist financing prevention rules.

Decisions to refuse to provide the Services to you are not made automatically without the involvement of our employees. We regularly review our algorithms and terms for providing our Services to prevent evaluation errors and inaccuracies. You have the right to request that your application be processed by an individual and not by an automated system, but a secondary evaluation of your application does not guarantee that the result will be different.

Additionally, we may use profiling and automated decision making to offer you a more appropriate Service, personalized marketing and commercial offers, including discounts and special conditions, and carry out customer analysis.

Our profiling and automated decision making is based on:

our legal obligation to assess the solvency of Clients and to comply with anti-money laundering and anti-terrorist financing rules;
Concluding the Service contract and taking pre-contractual measures, including to ensure a faster and more efficient contracting process;
Your consent or our legitimate interest in preventing the risk of fraud and providing you with more appropriate solutions, communications and offers.

8. How long do we retain your personal data?

We will process your personal data as long as:

one of the above-mentioned legal basis for data processing exists and there is a purpose for your data processing, for example, the Service agreement you have entered into is in force or your consent to certain data processing is valid;
we are required by applicable law to retain your personal data;
there is a need to pursue our legitimate interests, for example, raise and maintain legal claims.

When these conditions end, we will delete or anonymize your data.

9. Your rights

As a data subject, you have certain rights prescribed by Personal data protection laws. These rights provide that you can:

request access to your personal data and ask for details on its processing;
correct incorrect or inaccurate data;
ask to delete your data. Please note that we will not be able to delete data that we are required to process and retain in accordance with applicable law or that may be necessary to defend our rights or bring a legal action if our rights have been infringed;
object to the processing of your personal data, which is based on our legitimate interests. In case of such an objection, we will no longer process your personal data unless, we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims;
request to receive your data to transfer it to another data controller, provided that this does not affect our legitimate interest in protecting our trade secrets or any other confidential information;
withdraw its consent to the processing of data based on prior consent. Consent can be revoked by:
- using the unsubscribe option in our e-mail messages or SMS,
- sending an e-mail to info@mogo.co.ug
- calling our customer service center 0200405800 /0312405800 /0312405800,
- on-site at our customer service centers.

Withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal. Please also note that the withdrawal of consent will not affect the processing of your personal data, which we process based on other legal grounds.

To exercise these rights, you can submit a written request to us by sending it to our e-mail address info@mogo.co.ug or by submitting it in writing to the customer service center and identifying yourself. We will process the request within 30 days and provide you with an answer. When we receive your request for the exercise of your rights, we will verify your identity, evaluate the request and execute it in accordance with the applicable legal norms.

Please note that you have the right to lodge a complaint with a supervisory authority National Information Technology Authority Uganda, P.O Box 33151, Kampala-Ug, info@nita.go.ug.

10. Links to third party websites

Our website may contain links to third party websites. These third-party websites have their own terms of use and privacy policy, which we encourage you to read when you visit the website. We are not responsible for third party websites and their content.

11. Changes to this Privacy Policy

We reserve the right to change this Privacy Policy. In case of any significant changes, we will notify you in advance. We recommend that you visit our website regularly for up-to-date information.

This Privacy Policy is effective as of 15 December, 2023.