Data Processing Notice
Last updated: June 3, 2026
A. Who plays which role
Each microlender on the platform is the data controller for its own borrowers. Nei Shot WebX Solutions CC (operator of LendCore) is the data processor - we process information on the microlender's documented instructions and in accordance with our service agreement.
The borrower's contractual relationship is with the microlender, not Nei Shot. For data-subject access requests, contact the microlender directly.
B. Data inventory
The platform processes the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Identity | Name, National ID, gender, DOB | Borrower |
| Contact | Phone, email, address | Borrower |
| Employment | Employer, occupation, payslip | Borrower / payslip upload |
| Financial | Income, bank statement, debit-order mandate | Borrower / bank |
| Credit | Bureau score, tradelines, adverse listings, dispute history | Creditinfo Namibia |
| KYC | ID copy, proof of residence, biometric where required | Borrower upload |
| Loan | Application, decision, agreement, repayment history | Microlender / system |
| Technical | IP, device fingerprint, login times, audit log | System |
C. Third-party recipients
A complete register of every third party the platform may share borrower data with:
| Recipient | Type | Purpose | Data shared |
|---|---|---|---|
| Creditinfo Namibia | Credit bureau | Bureau check on application; loan-performance reporting | Identity, contact, application reference, loan status |
| PayM8 | Payment gateway | Disbursement and recurring debit-order collection | Identity, banking details, mandate, transaction amounts |
| NAMFISA | Regulator | Statutory returns, levies, breach reports, inspections | Aggregate lending data; on inspection, full file |
| Bank of Namibia | Regulator | Consumer-protection oversight | As legally compelled |
| Cloud hosting (sub-processor) | Infrastructure | Platform hosting, backups | All platform data, encrypted at rest |
| Email / SMS provider (sub-processor) | Comms | Application notifications, OTP delivery | Email, phone, message content (no full file) |
| Court-appointed parties | Legal | Subpoena, court order | As legally compelled, scope-limited |
| Debt-collection agency (where engaged by the microlender) | Recovery | Collection of defaulted loans | Identity, contact, loan balance, payment history |
We do not sell personal information. We do not share with advertising networks. We do not enrich data from third-party brokers.
D. Retention schedule
| Data class | Retention | Legal basis |
|---|---|---|
| Closed-loan records | 7 years from closure | NAMFISA Microlending Act |
| KYC documents | 5 years from end of relationship | Financial Intelligence Act |
| Bureau pull consent record | Loan term + 7 years | Audit / dispute defence |
| Bureau report retrieved | 12 months from pull date | Affordability evidence |
| Audit logs | 7 years | Regulatory record-keeping |
| Marketing preferences | Until withdrawn | Consent |
| Declined-application data | 2 years | Anti-fraud / re-application context |
E. How to exercise your rights
- Access request - email the microlender you applied with. They must respond within 30 days.
- Correction - log into the borrower portal where available, or email the microlender.
- Bureau consent withdrawal - in writing to the microlender. Future loan applications may be slower or declined.
- Bureau record dispute - contact Creditinfo Namibia directly: info@creditinfo.com.na ยท +264 61 277 100.
- Complaint - first to the microlender; unresolved complaints to NAMFISA at namfisa.com.na.
F. Security commitments
- TLS 1.2+ on all platform traffic
- Sensitive credentials and signatures encrypted at rest
- Strict role-based access; least-privilege by default
- Two-factor authentication available to all staff users
- Every administrative action recorded in an immutable audit log
- Daily backups, retained 30 days; encrypted in transit and at rest
- Breach notification to affected microlenders without undue delay
G. Contact
Platform-level data questions: privacy@lendcore.neishot.com.