Privacy Policy

Dottra is the trading name of Dottra Lending Services Limited, a Zambian company providing a digital revolving credit line service.

This Privacy Policy explains how and why we collect, access, use, store, protect, disclose, and otherwise process your personal information when you use the Dottra mobile application, access our credit services, communicate with customer support, or otherwise interact with us.

We are responsible for making decisions about how personal information under our control is processed.

If you have questions about this Policy or the way your information is handled, you may contact our Data Protection Officer at dpo@dottra.co.

We collect information you provide when registering, completing identity verification, applying for or using credit, making repayments, or communicating with us.

Account and identity information may include your full legal name, display name, phone number, email address, date of birth, National Registration Card number, authentication information, and other registration details.

Identity verification information may include photographs of identification documents, a live selfie, student verification documents, employment verification documents, and payslips.

For salaried customers, we may collect information including employer name, job title, monthly income, pay frequency, expected pay date, and employment category.

For student customers, we may collect information including university, student number, programme of study, expected graduation information, and sponsorship details.

Financial information may include bank account information required for repayment mandates, mobile money account information, repayment details, transaction history, amounts drawn, amounts repaid, and outstanding balances.

We may also collect emergency contact information where you voluntarily provide it and where use of that information is permitted by law.

Information you provide when contacting support may include support messages, complaints, documents, and information about problems you are experiencing.

When you use Dottra, we may automatically collect limited technical and usage information necessary to operate, secure, troubleshoot, monitor, and improve the Service.

This may include device model, manufacturer, operating system, application version, device identifiers, network information, IP address, application activity, feature usage, session information, error reports, and performance information.

Where you enable push notifications, we may store a device push-notification token so that account, transaction, repayment, security, and service notifications can be delivered to you.

We may receive limited information from third parties where necessary to verify your identity or eligibility, process transactions, administer repayment arrangements, prevent fraud, or comply with law.

These third parties may include government verification systems, employers, educational institutions, banks, mobile money operators, payment and collection providers, identity verification services, and other authorised service providers.

We process personal information where necessary to provide and administer the Dottra Service, perform our agreement with you, comply with legal obligations, protect legitimate interests, prevent fraud, maintain security, or where you have provided consent and consent is the appropriate legal basis.

We may use your information to create and manage your Account, authenticate you, complete identity verification, assess eligibility for credit, establish and manage Credit Limits, process Draw requests, disburse funds, collect and record repayments, issue receipts and statements, provide customer support, communicate important service information, investigate disputes, detect fraud, apply account controls, comply with regulatory obligations, and improve the Service.

Credit decisions may take into account verified employment, income, sponsorship, repayment behaviour, account activity, and other information relevant to responsible credit-risk management.

Where we use aggregated or anonymised information to understand how the Service is used or improve our systems, we take reasonable steps to ensure that information is no longer directly attributable to an identifiable individual.

We only share personal information where reasonably necessary to provide the Service, operate our business, protect users, comply with law, or where you have authorised the disclosure.

Information may be shared with payment gateways, banks, mobile money operators, direct debit and collection providers, identity verification providers, cloud infrastructure providers, database and authentication providers, communication providers, security providers, professional advisers, auditors, and other service providers acting on our behalf.

We may disclose information to regulatory authorities, law-enforcement agencies, courts, government agencies, or other competent authorities where required or permitted by law.

Information may also be disclosed in connection with a lawful merger, financing, restructuring, acquisition, or transfer of all or part of Dottra's business, subject to appropriate confidentiality and data protection safeguards.

We do not sell your personal information to third parties for advertising or marketing purposes.

Dottra may use approved artificial intelligence or machine-learning tools to assist with limited operational activities such as customer support triage and document analysis.

AI-assisted support may help categorise routine enquiries, prepare suggested responses, or route complex matters to an appropriate human agent.

Where an approved third-party AI provider processes information on our behalf, only information reasonably necessary for the relevant task should be shared and the provider must process that information subject to appropriate contractual and security safeguards.

You may request human assistance when using AI-assisted customer support.

AI-assisted systems do not independently make final decisions about your Credit Limit, Draw eligibility, or material Account status. Material credit and account decisions remain subject to Dottra's authorised decision-making processes.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy and for any longer period required by applicable law, regulation, accounting rules, dispute-resolution requirements, fraud prevention needs, or legal obligations.

Financial transaction records and ledger entries may be retained for at least ten (10) years after the relevant transaction, or for any longer period required by law.

Identity verification records may be retained for at least five (5) years after Account closure where necessary for legal or regulatory compliance.

Account and profile information may be retained for the life of the Account and for at least five (5) years after closure where required.

Support communications may ordinarily be retained for three (3) years after resolution.

Device and usage information may ordinarily be retained for up to two (2) years from collection unless a longer period is reasonably necessary for security, investigation, or legal purposes.

When information is no longer required, we will take reasonable steps to securely delete or anonymise it. Where immediate deletion is not technically possible, such as information retained within protected backup systems, access and further processing will be appropriately restricted until deletion occurs.

We use reasonable technical and organisational safeguards appropriate to the nature and sensitivity of the personal and financial information we process.

These measures include encryption, access controls, secure authentication, protected transaction authorisation, server-side controls over sensitive financial operations, transaction-integrity safeguards, security monitoring, audit logging, and controlled access to sensitive records.

We limit access to personal information to authorised persons and systems that require it for legitimate business, security, compliance, or service-delivery purposes.

Although we take reasonable steps to protect personal information, no electronic system, communication network, or storage technology can be guaranteed to be completely secure.

You should protect your password, Transaction PIN, registered device, email account, phone number, and any authentication credentials associated with your Dottra Account.

Dottra's Services are intended only for persons who are at least eighteen (18) years old.

We do not knowingly provide credit services to, collect personal information from, or market the Service to persons under the age of eighteen.

If we become aware that personal information relating to a person under eighteen has been collected through the Service without a lawful basis, we will take reasonable steps to deactivate the relevant Account where appropriate and delete or otherwise lawfully handle the information.

If you believe that Dottra may hold personal information relating to a person under eighteen, please contact us at dpo@dottra.co.

Subject to applicable Zambian data protection law, you may have rights regarding personal information we hold about you.

These may include the right to request access to your personal information, correction of inaccurate or incomplete information, deletion where legally permitted, restriction of certain processing, objection to processing based on legitimate interests, and receipt of certain information in a structured and commonly used format.

Where we rely on your consent for a particular processing activity, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Some information cannot immediately be deleted where Dottra is required to retain it to comply with legal, financial, regulatory, fraud-prevention, accounting, or dispute-resolution obligations.

You may exercise your privacy rights by contacting dpo@dottra.co, using in-app support, or calling +260 973 400 223.

We may need to verify your identity before processing a privacy request.

We aim to respond to valid privacy requests within thirty (30) days, subject to applicable law.

You may request closure of your Dottra Account where you have no Outstanding Balance and no unresolved obligations that prevent closure.

Closing your Account does not necessarily result in immediate deletion of all information.

After closure, we may retain information for the periods described in Section 7 of this Privacy Policy where required for legal compliance, financial recordkeeping, regulatory obligations, fraud prevention, dispute resolution, security, or enforcement of agreements.

Information that is no longer required will be securely deleted or anonymised in accordance with our retention procedures.

We may update this Privacy Policy from time to time to reflect changes to our Service, technology, business operations, or applicable legal and regulatory requirements.

Where a change is material, we may notify you through the Dottra application, push notification, SMS, email, or another appropriate communication channel.

The current version and its effective date will be made available through the Dottra application.

If you believe your personal information has been processed improperly, you may first contact our Data Protection Officer so that we can investigate your concern.

You may also exercise any right available under Zambian law to submit a complaint to the appropriate data protection authority.

For privacy enquiries, requests, or complaints, contact:

Data Protection Officer

Dottra Lending Services Limited

Email: dpo@dottra.co

Phone: +260 973 400 223

Address: Chingwere 31651, Chunga East, Lusaka, Zambia