1. About Us
Emerald Finance Limited (“Emerald Finance”, “we”, “us”, or “our”) is a microfinance institution incorporated in the Republic of Zambia and licensed by the Bank of Zambia. Our registered office is at Plot No. 5038 Kwacha Road and Parliament Road, Olympia, Lusaka, Zambia.
We are the data controller of the personal information described in this Policy and we comply with the Zambian Data Protection Act, No. 3 of 2021, the Bank of Zambia Act, the National Payment Systems Act, the Financial Intelligence Centre Act, and other applicable laws.
2. Scope of this Policy
This Policy applies to personal information we collect or process when you:
- visit emeraldfinanceltd.com or any of our subdomains;
- apply for, hold, or repay any loan or other financial product we offer;
- use our mobile application, USSD short-codes, or mobile money integrations on Airtel Money and MTN Mobile Money;
- communicate with us via WhatsApp, SMS, voice calls, email, social media or our customer service line (111);
- interact with our agents, merchants, or any partner acting on our behalf.
3. Information We Collect
3.1 Information you provide to us
- Identity data: full name, date of birth, gender, nationality, National Registration Card (NRC) number or passport number, photograph, signature.
- Contact data: residential and postal address, mobile phone number(s), email address, next of kin details.
- Financial data: employment status, monthly income, bank account or mobile money wallet details, transaction history, repayment behaviour, existing debt obligations.
- KYC documents: copies of your NRC, proof of address, payslips, bank statements, business registration documents and any document required by law to verify your identity or assess affordability.
- Communications: the content of messages, calls, voice recordings, WhatsApp chats, SMS, emails and chatbot conversations you exchange with us.
3.2 Information we collect automatically
- Device and usage data: IP address, device identifier, operating system, browser type, app version, language, time zone, log data and pages visited.
- Location data: approximate location derived from your IP address or, with your permission, more precise location from your device.
- Cookies and similar technologies — see Section 14.
3.3 Information we receive from third parties
- Mobile network operators (Airtel and MTN) for mobile-money transaction confirmation and airtime/data-usage scoring where you have consented.
- Licensed credit reference bureaus operating in Zambia (e.g. TransUnion Zambia, Credit Reference Bureau Africa) for credit history checks.
- Government agencies, regulators and law enforcement where authorised by law.
- Service providers and partners that help us deliver our services (payment processors, identity verification, cloud hosting, communications platforms).
4. How We Use Your Information
We use your personal information to:
- verify your identity and conduct Know-Your-Customer (KYC), anti-money-laundering (AML) and sanctions screening;
- assess your creditworthiness, set loan limits and price our products;
- disburse loans, collect repayments and process mobile-money transactions;
- operate, maintain and improve our website, mobile app, USSD service and customer-contact channels;
- send you service messages, payment reminders, statements, and respond to your enquiries;
- send you marketing communications about our products and partner offers where you have consented (you may opt out at any time);
- detect, prevent and investigate fraud, financial crime, security incidents and breaches of our terms;
- comply with our legal, regulatory and reporting obligations to the Bank of Zambia, the Financial Intelligence Centre, the Zambia Revenue Authority and the courts;
- perform analytics, research and training of AI models that improve our service quality — see Section 8.
5. Legal Basis for Processing
We process your personal information on one or more of the following bases under the Data Protection Act, 2021:
- Contract: processing necessary to enter into or perform a loan or service contract with you.
- Legal obligation: compliance with KYC, AML, tax, financial-reporting and other laws.
- Legitimate interests: running and securing our business, preventing fraud and improving our products, provided your rights are not overridden.
- Consent: for marketing communications, optional location data, certain cookies and any other processing that requires it. You may withdraw your consent at any time without affecting prior processing.
- Vital interests / public interest: where processing is necessary to protect life or comply with a public-interest mandate.
7. WhatsApp, SMS and Other Messaging Channels
We use the WhatsApp Business Platform (operated by Meta Platforms Ireland Limited) and licensed SMS gateways to communicate with you. By messaging us on WhatsApp or providing us with your mobile number, you consent to the following:
- We may send you transactional messages (loan confirmations, repayment reminders, account statements, appointment reminders, one-time passwords) using approved message templates.
- We may send you marketing messages where you have opted in. You can stop these at any time by any of the following:
- reply STOP to any SMS or WhatsApp message;
- dial *115# and follow: option 6 (Kongola) → option 2 (Kongola and Savings) → option 3 (Ka’Starta) → option 5 (About) → option 1 (OPT-OUT);
- call customer support on 111;
- email privacy@emeraldfinanceltd.com (see Section 17).
- Messages sent over WhatsApp are end-to-end encrypted in transit between you and Emerald Finance, but their content is also processed by Meta in line with Meta’s own privacy policy (whatsapp.com/legal/privacy-policy). We do not control Meta’s use of metadata such as your phone number, delivery receipts and message timestamps.
- Customer-service conversations on WhatsApp may be handled by both human agents and AI-powered assistants (see Section 8) and may be recorded or stored for quality, training and dispute-resolution purposes.
- Where you call us, our customer-contact-centre platform may record the call, transcribe it and analyse it using automated tools, in line with this Policy.
8. Automated Decision-Making and AI
To deliver faster, fairer service we use automated systems — including artificial-intelligence and machine-learning models — for:
- credit scoring and affordability checks;
- fraud and AML monitoring;
- routing, transcribing and responding to voice calls, WhatsApp and SMS conversations.
For decisions that produce a legal or similarly significant effect (for example, a loan-approval decision), you have the right to request human review, to express your point of view and to contest the decision. Please contact us using the details in Section 17.
9. How Long We Keep Your Information
We retain personal information only for as long as necessary for the purposes set out in this Policy and to meet our legal obligations:
- Customer and financial records: at least 10 years after the end of the customer relationship, in line with Bank of Zambia and Financial Intelligence Centre requirements.
- KYC documents: at least 10 years from the date of the last transaction.
- Call recordings and message logs: up to 24 months unless required for a longer period for dispute resolution or by law.
- Marketing-consent records: until consent is withdrawn plus a reasonable period to evidence the withdrawal.
- Website analytics and cookies: as described in our cookie notice (Section 13).
When the retention period ends we securely delete or anonymise the data.
10. How We Protect Your Information
We apply organisational, technical and physical safeguards aligned with industry standards, including:
- TLS 1.2/1.3 encryption for data in transit;
- encryption at rest for sensitive databases and document stores;
- role-based access controls, multi-factor authentication and audit logging;
- regular vulnerability scanning, penetration testing and staff security training;
- vendor due-diligence and written data-processing agreements with all processors.
No system is completely secure. If we become aware of a personal-data breach that is likely to result in a high risk to your rights, we will notify the Office of the Data Protection Commissioner and you, in line with the Data Protection Act.
11. International Data Transfers
Some of our service providers (including cloud hosting, communications, AI and analytics vendors) are located outside Zambia, in particular in the European Union, the United Kingdom, the United States and India. Where we transfer your personal information outside Zambia, we ensure that:
- the destination country provides an adequate level of protection; or
- the transfer is governed by appropriate contractual safeguards such as Standard Contractual Clauses; or
- you have given your explicit consent.
12. Your Rights
Subject to the Data Protection Act, 2021 and applicable financial-services regulations, you have the right to:
- Access the personal information we hold about you and obtain a copy.
- Rectify inaccurate or incomplete information.
- Erase your information where we no longer have a lawful basis to keep it.
- Restrict or object to certain processing, including direct marketing.
- Withdraw consent at any time where processing is based on consent.
- Data portability — receive your data in a structured, commonly used format.
- Lodge a complaint with the Office of the Data Protection Commissioner, Zambia, if you believe we have not handled your data lawfully.
To exercise any of these rights, contact us using the details in Section 17. We will respond within 30 days. We may need to verify your identity before fulfilling your request.
13. How to Request Deletion of Your Personal Data
You have the right to ask us to delete your personal information. We have made the process simple and free.
Three ways to submit a data-deletion request:
- Email: privacy@emeraldfinanceltd.com with the subject “Data Deletion Request”.
- Call customer support: dial 111 from any Zambian network and ask the agent to log a Data Deletion Request on your behalf.
- USSD (to opt out of marketing): dial *115# → 6 Kongola → 2 Kongola and Savings → 3 Ka’Starta → 5 About → 1 OPT-OUT. This immediately stops all marketing SMS and WhatsApp messages. For a full account deletion please use one of the other methods.
- Visit us in person: Plot No. 5038 Kwacha Road and Parliament Road, Olympia, Lusaka. Please bring your NRC or passport.
13.1 What to include in your request
- your full name as registered with us;
- the mobile number(s) and/or email address linked to your account;
- your NRC or passport number for identity verification;
- whether you want us to delete all personal data or only specific items (e.g. WhatsApp messages, call recordings, marketing-consent records).
13.2 What happens next
- We will acknowledge your request within 2 business days.
- We will verify your identity to protect your account from fraudulent deletion requests.
- We will complete your request within 30 calendar days and write back to confirm exactly what was deleted.
- Where some data must be retained by law, we will tell you which records remain, the legal basis, and the retention period.
13.3 Data we will delete
- Profile information, contact details and next-of-kin records.
- WhatsApp chat history, SMS conversations, call recordings and chatbot transcripts held on our systems, where these are not subject to mandatory retention.
- Marketing-consent records once we have logged the withdrawal of consent.
- Optional information you provided (e.g. precise location, device identifiers, voluntary survey responses) where there is no continuing legal basis.
- Website cookies and analytics identifiers associated with your account.
13.4 Data we may be required to retain
Zambian financial-services law requires us to retain certain records even after you ask for deletion. These typically include:
- active or recently-settled loan and repayment records — at least 10 years from the date of the last transaction (Bank of Zambia and Financial Intelligence Centre rules);
- Know-Your-Customer (KYC) and Anti-Money-Laundering (AML) documents — at least 10 years;
- tax and accounting records, as required by the Zambia Revenue Authority;
- records needed to defend or pursue a legal claim, until the claim is finally resolved.
Retained data is locked down and accessible only by authorised compliance staff. It is never used for marketing, profiling or product development. Once the retention period expires, the data is securely deleted or anonymised.
13.5 Deleting your WhatsApp conversation with us
You can clear the WhatsApp conversation on your own device at any time by long-pressing the chat and selecting Delete. This removes the messages from your phone but not from our servers. To also delete the copy held by Emerald Finance, please submit a Data Deletion Request using one of the methods above. WhatsApp’s own retention of metadata (your phone number, delivery receipts, timestamps) is governed by Meta’s privacy policy (whatsapp.com/legal/privacy-policy).
13.6 Closing your account
You can also ask us to close your account entirely. Closing an account triggers a deletion request for all data that is not subject to mandatory retention, plus a permanent block on further marketing communications.
13.7 Right to complain
If you are not satisfied with our handling of your deletion request, you may lodge a complaint with the Office of the Data Protection Commissioner of Zambia.
15. Children
Our products and services are intended only for individuals aged 18 and above. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us so we can delete it.
16. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or business operations. We will post the updated Policy on this page and update the “Last updated” date above. Where the changes are material, we will notify you by email, SMS, WhatsApp, in-app message or other appropriate means.
17. How to Contact Us
If you have questions about this Policy or wish to exercise any of your rights, please contact our Data Protection Officer:
Emerald Finance Limited — Data Protection Officer
Plot No. 5038 Kwacha Road and Parliament Road, Olympia, Lusaka, Zambia
Email: privacy@emeraldfinanceltd.com
Customer support: 111
Phone: +260 96 9875058 · +260 96 9873678 · +260 77 2383806
Website: emeraldfinanceltd.com
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Zambia.