Legal document · v1.0
Privacy Policy
What personal data we collect, why, who can see it, how long we keep it, and the rights you have over it.
In plain language
This summary is provided to help you understand the document. It is not a substitute for the formal text below, which governs.
- Your lender controls your borrower data. We process it on their instructions.
- Data collected for lending is used only for lending. Every staff access is logged with a reason.
- Khepee’s own staff are not permitted to read your personal data.
- Your documents are encrypted and never publicly accessible.
- The app does not ask for your contacts, location or photo library.
1Scope and roles
Who is responsible for your data depends on which data it is. This section explains the split.
1.1
Who this covers
This policy covers the khepee.com website, the Khepee borrower application and the operations console, all operated by Lacspace Corporation Pvt. Ltd.
1.2
The lender is the controller
For data relating to your loan application and loan, the partner institution licensed by Nepal Rastra Bank is the controller. It determines why and how that data is used.
1.3
Khepee is the processor
We process borrower data on the partner institution’s instructions under a written agreement. We do not use it for our own purposes.
1.4
Where Khepee is the controller
For limited data we need to run the platform — website analytics, security logs, correspondence you send us directly — we are the controller.
1.5
Your lender’s own policy
Your lender has its own privacy notice covering what it does with your data beyond the platform. Ask them for it; it applies alongside this one.
2What we collect
2.1
Identity data
Your full name, date of birth, and the type, number and images of the identity document you submit for verification.
2.2
Contact data
Your mobile number, and your email address and postal address where provided.
2.3
Financial data
Declared monthly income, employer, account type, and the amount and term you request.
2.4
Verification data
A verification selfie where your lender requires one, and the result of any automated identity or liveness check.
2.5
Loan data
Your application, its status history, the decision and its reason, your instalment schedule and your repayment record.
2.6
Technical data
IP address, device and browser type, and app version — used for security, fraud prevention and diagnostics.
2.7
Usage data
Which screens you visited and when, at a level sufficient to diagnose faults and improve the product.
2.8
Correspondence
Messages you send to us, and our replies.
2.9
What we do not collect
We do not collect your contacts, your location, your photo library, your social media accounts, your SMS messages or your call records. The mobile app does not request these permissions and blocks them at the platform level.
2.10
Special categories
We do not seek data revealing health, religion, caste, ethnicity, political opinion or trade union membership, and such data has no role in any credit decision made on the platform.
3Why we use it
3.1
Purpose limitation
Data collected during the lending process is used only for that process. This is a requirement of Nepal Rastra Bank’s digital lending framework and is enforced technically, not merely stated here.
3.2
The permitted purposes
Every access to personal data must declare one of a fixed list of purposes: identity verification, credit assessment, loan servicing, collections, regulatory reporting, borrower self-access, or dispute resolution.
3.3
How that is enforced
A request to read personal data without a declared purpose is rejected by the platform. The purpose, the person and the time are written to an audit record that cannot be edited or deleted.
3.4
Identity verification
To confirm you are who you say you are, as required before any disbursement.
3.5
Credit assessment
To allow your lender to assess your application under its credit policy.
3.6
Servicing your loan
To generate your schedule, record repayments and send reminders.
3.7
Fraud prevention and security
To detect duplicate applications, prevent account takeover and protect the platform.
3.8
Legal and regulatory obligations
To meet anti-money-laundering, record-keeping and reporting requirements applicable to your lender.
3.9
What we never do
We do not sell your data. We do not share it for third-party advertising. We do not use it to train models for unrelated products. We do not disclose your arrears to your contacts, employer or family.
4Lawful basis
4.1
Performance of a contract
Most processing is necessary to take steps at your request before entering a loan agreement, and to perform that agreement.
4.2
Legal obligation
Identity verification, record retention and regulatory reporting are required by law and by directives applicable to your lender.
4.3
Legitimate interests
Security, fraud prevention and service improvement rest on our and your lender’s legitimate interests, balanced against your rights.
4.4
Consent
Where we rely on consent — for example optional communications — you may withdraw it at any time without affecting your loan.
5Who can see your data
5.1
Your lender’s staff
Personnel of the partner institution you applied to, where their role requires it and under a declared purpose that is logged.
5.2
Not other institutions
Partner institutions are isolated from each other. No institution can see another’s borrowers, and a cross-institution lookup returns "not found" rather than confirming a record exists.
5.3
Khepee staff cannot read it
Our administrative role is deliberately not granted permission to read borrower personal data. Our team can operate the platform and diagnose faults using request identifiers and hashed values.
5.4
Service providers
Identity verification, messaging and hosting providers process data on documented instructions under written terms. Each is engaged per institution and disclosed to it.
5.5
Authorities
We may disclose data where required by law, court order or a lawful regulatory request. Where permitted, we will tell the affected institution.
5.6
Business transfer
If the business is reorganised or transferred, data may transfer with it. Protections at least equivalent to this policy will apply.
6How we protect it
6.1
Encryption at rest
Personal fields are individually encrypted with AES-256-GCM using a key held separately from database credentials. Disk encryption alone would not protect against a database dump.
6.2
Searchable without decryption
A deterministic keyed index allows exact-match lookups — such as signing in with your number — without decrypting the stored value.
6.3
Documents
Identity document images are stored as object keys, never given a public web address, and served only through short-lived signed links.
6.4
Encryption in transit
All traffic uses TLS with strict transport security. The console sets no-store and no-referrer so a URL containing an identifier is never passed to a third party.
6.5
Logs
Credentials and personal fields are stripped by a redaction list before anything is written to a log, as a safety net behind the rule that they are never logged.
6.6
Audit records
Personal values appear in audit records as hashes, so a complete evidential record exists without the log itself becoming a source of exposure.
6.7
Access control
Deny-by-default role permissions, combined with an institution scope taken from the signed session rather than from any request parameter.
6.8
On your device
The app stores only a session token, in the device keychain. No personal data is cached on the phone.
6.9
No absolute guarantee
No system is perfectly secure. We describe specific mechanisms rather than promise invulnerability, and we will tell you honestly if something goes wrong.
7How long we keep it
7.1
Borrower records
Retained for five years after your loan closes, consistent with anti-money-laundering and record-keeping expectations applicable to your lender.
7.2
Unsuccessful applications
Retained for the period your lender is required to evidence its decision, then deleted or anonymised.
7.3
Verification records
Identity verifications carry an expiry and are not treated as valid indefinitely.
7.4
Audit records
Retained for the life of the relationship and the statutory period after it. They are append-only and cannot be edited or deleted.
7.5
Technical logs
Retained for a short operational period, then discarded.
7.6
After the period ends
Data is deleted or irreversibly anonymised. Anonymised aggregates may be retained for statistical purposes.
8Your rights
8.1
Access
You may ask what personal data is held about you and receive a copy.
8.2
Correction
You may ask for inaccurate data to be corrected. Some fields cannot be changed after a decision without a fresh application, because the record must reflect what was actually relied upon.
8.3
Erasure
You may ask for deletion. This is limited by retention obligations — we cannot delete records your lender is required to keep, or entries in the append-only audit trail.
8.4
Objection and restriction
You may object to processing based on legitimate interests, or ask that processing be restricted while a dispute is resolved.
8.5
Portability
You may request your data in a structured, machine-readable format.
8.6
Withdraw consent
Where processing rests on consent, you may withdraw it at any time. This does not affect your loan obligations.
8.7
How to exercise a right
Write to data@khepee.com. We will acknowledge within seven days and respond within thirty days. Where the partner institution is the controller, we will pass the request to them and tell you we have done so.
8.8
Verification of identity
We will verify your identity before acting on a request, to avoid disclosing your data to someone impersonating you. We will not use that verification for any other purpose.
8.9
No charge
We do not charge for responding to a request, unless it is manifestly unfounded or repetitive.
9Other matters
9.1
Automated decisions
The platform computes a score and a recommendation, but no application is refused by automated processing alone. A person at your lender makes the decision and records a reason.
9.2
International transfer
Data is processed in Nepal or in facilities offering equivalent protection. Where a service provider processes outside Nepal, that transfer is disclosed to the partner institution and governed by written terms.
9.3
Children
The platform is not for anyone under 18. If we learn that data of a minor has been collected, we will delete it.
9.4
Cookies
The website uses a minimal set of cookies, described in the Cookie Policy.
9.5
Breach notification
If a breach affecting your data occurs, we will notify the affected partner institution without undue delay. Your lender leads communication with you and any regulator, because it holds that relationship.
9.6
Changes to this policy
Material changes will be notified through the platform or by email at least fourteen days before they take effect.
9.7
Complaints
Complaints about our handling of your data go to privacy@khepee.com. If unresolved, escalate to your lender and, where applicable, to the relevant authority.
9.8
Contact
Privacy questions: privacy@khepee.com. Data requests: data@khepee.com. Lacspace Corporation Pvt. Ltd., Kathmandu, Nepal. +977 9705 300600.