How we protect your data.
The lender remains the data controller. VALR Capital acts as its data processor under a written data processing agreement, and is registered with Kenya's Office of the Data Protection Commissioner. Clients choose whether UNBRDN runs in our cloud or on their own servers. Each client's data is held in its own separate workspace.
UNBRDN is read-only by default: it reads the lender's data and changes nothing in their systems. Collections and origination modules are available when a client chooses to switch them on. The lender makes the credit decision.
In place today
- Registered with Kenya's Office of the Data Protection Commissioner
- A written data processing agreement before any data is shared, with the lender as data controller
- Each client's data held in its own separate workspace
- Passkey-only sign-in for staff
- An evidence trail on every analysis run
- Customer data used only with consent, with personal details removed from review exports by default
- A choice of deployment: our cloud or the client's own servers
Planned: an independent security review.