Last updated: 30 June 2026
1. Who we are
Invictus Finance Africa Ltd is a Kenyan company providing structured SME financing solutions. We are the data controller for personal data collected through this website, our enquiry forms, client onboarding, credit assessment, servicing, collections and related communications.
This public Privacy Notice summarises how we process personal data. It should be read together with any product application form, facility documentation, consent wording, and regulatory disclosures provided to you.
2. Personal data we collect
We collect only what is necessary for the purpose for which it is collected. Depending on your relationship with us, this may include:
Identity and contact information Name, business name, role, email, telephone number, address and official identification details where required.
Business and financial information Business registration details, KRA PIN, bank or M-Pesa records, invoices, sales and purchase records, tax compliance and financial information.
Credit, KYC and security information Credit reference information, beneficial ownership, guarantor details, sanctions or PEP screening, security documents and related verification information.
Website and enquiry information Information you submit through our Google Form, website usage information, cookie preferences and communications with us.
3. How we collect data
We may collect personal data directly from you, through the relationship with you, from your authorised representatives, from verification sources, credit reference bureaus, sanctions and screening providers, regulators, public registries, service providers, and from our website or enquiry tools.
4. How and why we use personal data
We process personal data only where there is a lawful basis. Our lawful bases may include consent, performance of a contract, legal obligation, legitimate interests, legal claims, vital interests or public interest where applicable.
- To respond to enquiries and manage relationships with prospects, clients, guarantors, partners and suppliers.
- To assess applications, verify identity, conduct KYC/CDD, screen sanctions and PEPs, evaluate credit risk and make or review credit decisions.
- To provide, administer, monitor and recover facilities, including communications, collections, enforcement and legal claims where applicable.
- To meet AML/CFT/CPF, tax, CRB reporting, regulatory, audit, governance and record-keeping obligations.
- To protect the security of our systems, detect fraud, improve our website and maintain accurate records.
5. Google Forms and website enquiries
Our contact form is hosted through Google Forms. Information submitted through the form is processed to respond to your enquiry and may be stored or transmitted through Google’s infrastructure. Please avoid submitting sensitive information unless we have requested it through official channels.
The embedded Google Form is treated as functional third-party content and is not loaded automatically unless functional cookies are accepted. You may also open the form directly using the button on the contact section.
6. Sharing personal data
We share personal data only where lawful, necessary and disclosed. We do not sell personal data.
| Recipient | Purpose |
|---|
| Credit reference bureaus | Credit assessment, monitoring and accurate reporting where applicable. |
| Verification and service providers | KYC, screening, IT, hosting, payment, professional, legal, audit or operational support. |
| Guarantors and transaction counterparties | To administer guarantees, assigned receivables or related facility arrangements where applicable. |
| Regulators and authorities | Where required by law, including FRC, ODPC, KRA, CBK, courts and other competent authorities. |
We do not disclose a client’s debt to family, friends, employers or social contacts, except where the person is a signed guarantor, authorised representative, or disclosure is otherwise lawful and necessary.
7. Retention, security and transfers
We retain personal data only for as long as necessary for the purpose collected, and for legal, AML, tax, audit, credit, dispute-resolution and regulatory retention requirements. We apply appropriate administrative, technical and organisational safeguards to protect personal data against unauthorised access, loss, misuse or disclosure.
Where personal data is transferred outside Kenya, we do so only on a lawful basis and with appropriate safeguards where required.
8. Your rights
Subject to applicable law, you may have the right to be informed, access your personal data, request correction, request erasure where there is no lawful reason to retain it, restrict or object to certain processing, request portability where applicable, withdraw consent, ask for human review of certain automated decisions, and lodge a complaint with us or the ODPC.
9. Privacy contact
For privacy questions or data-subject requests, contact us through:
Email: hello@invictusafrica.io
Phone / WhatsApp: +254 768 499 714
WhatsApp Channel: Join our WhatsApp Channel
Address: Micasa, Cedar Road, Westlands, Nairobi, Kenya
Website: www.invictusafrica.io
You may also raise a data-protection complaint through our Complaints page.
