NexPesa

Privacy Policy

Last updated: 23 June 2026

This Privacy Policy explains how NexPesa ("we," "us," or "our") collects, uses, shares, and protects information when you use the NexPesa mobile application (the "Service"). By using NexPesa, you agree to the practices described in this policy.

1. Information We Collect

a) Information you provide directly

• Account information: full name, email address, phone number, and password (stored securely, hashed).
• Identity & financial details: Deriv account login ID (CR number), M-Pesa phone number, and transaction-related details necessary to process deposits, withdrawals, and currency exchange.
• Communications: messages, feedback, or support requests you send us.

b) Information collected automatically

• Transaction data: amounts, timestamps, status, and reference numbers for deposits, withdrawals, and exchanges processed through the app.
• Device information: device model, operating system version, and app version, used for diagnostics and security.
• Usage data: in-app activity such as screens visited and actions taken, used to improve the Service and detect fraud.

2. How We Use Your Information

• To create and manage your account;
• To process deposits, withdrawals, and currency exchange transactions;
• To verify your identity and prevent fraud, money laundering, or unauthorized account access;
• To communicate with you about your transactions, account status, or service updates, including SMS and push notifications;
• To respond to support requests and feedback;
• To comply with applicable legal and regulatory obligations.

3. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

Recipient	Purpose
Safaricom / M-Pesa	To process deposits and withdrawals via the M-Pesa payment network.
Deriv	To facilitate transfers to and from your linked Deriv trading account.
Service providers (hosting, SMS, analytics)	To operate, host, and maintain the app's infrastructure, acting solely on our instructions.
Regulators / law enforcement	Where required by law, court order, or to investigate suspected fraud or financial crime.

4. Data Retention

We retain account and transaction data for as long as your account is active, and for a reasonable period thereafter as required to comply with financial record-keeping obligations under applicable Kenyan law, resolve disputes, and prevent fraud. Transaction records in particular may be retained even after account deletion where required by financial regulations.

5. Data Security

We use industry-standard safeguards, including encryption of data in transit (HTTPS/TLS) and secure storage of credentials, to protect your information. No system is completely secure, and we encourage you to use a strong, unique password and to never share your login credentials or one-time codes with anyone.

6. Your Rights

• You may access and update your personal information within the app's profile settings.
• You may request deletion of your account and associated personal data — see our Account Deletion page for instructions.
• You may contact us at any time to ask what data we hold about you.

7. Children's Privacy

NexPesa is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a minor, we will take steps to delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes via the app or email. The "Last updated" date above reflects the most recent revision.