UNTU CAPITAL LIMITED
Digital Platform Terms and Conditions and Privacy Notice
IMPORTANT NOTICE TO CUSTOMERS
These Terms and Conditions constitute a legally binding agreement between you and Untu Capital Limited. They govern your access to and use of all Untu Capital digital channels, including our website, client web portal, mobile application, USSD platform, WhatsApp chatbot and any future digital channels or APIs. They incorporate our Privacy Notice (Annexure A), Cookie Notice (Annexure B) and Consent Declaration (Annexure C). Please read them carefully before ticking the acceptance box or otherwise using any Digital Platform. If you do not agree, do not use the Digital Platforms.
PART A — GENERAL TERMS
1. Definitions and Interpretation
1.1 In these Terms, unless the context requires otherwise:
“Act” or “Data Protection Act” means the Cyber and Data Protection Act [Chapter 12:07] (Act No. 5 of 2021), also cited as the Data Protection Act [Chapter 11:12], together with the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024) and any other regulations made under it;
“Applicable Law” means all laws of Zimbabwe applicable to Untu Capital and its customers, including without limitation the Act, the Microfinance Act [Chapter 24:29], the Banking Act [Chapter 24:20], the Money Laundering and Proceeds of Crime Act [Chapter 9:24], the Consumer Protection Act [Chapter 14:44], the National Payment Systems Act [Chapter 24:23], and all directives, guidelines, circulars and frameworks issued by the Reserve Bank of Zimbabwe (“RBZ”), the Financial Intelligence Unit (“FIU”) or the Data Protection Authority;
“Credit Reference Bureau” or “CRB” means any credit reference bureau registered with the RBZ, including Financial Clearing Bureau (FCB), XDS Zimbabwe and Fincheck, and the RBZ Credit Registry;
“Customer”, “you” or “your” means any person who registers for, accesses or uses any Digital Platform, whether or not a loan is granted;
“Data Protection Authority” or “DPA” means the Postal and Telecommunications Regulatory Authority of Zimbabwe (“POTRAZ”), designated as the Data Protection Authority under the Act;
“Digital Platforms” means, collectively, the Untu Capital website (https://www.untucapital.co.zw/), the client web portal, the Untu Capital mobile application, the USSD platform (*261#), the WhatsApp chatbot (0785218112) and any other digital channel, application programming interface (API) or electronic service operated by or on behalf of Untu Capital from time to time;
“Loan Agreement” means any separate written or electronic loan agreement, facility letter or credit agreement concluded between you and Untu Capital, which governs the pricing, repayment and enforcement of any credit facility;
“Personal Information” or “Personal Data” means any information relating to an identified or identifiable natural person, and where applicable an identifiable legal person, as defined in the Act, and includes Sensitive Information;
“Process” or “Processing” means any operation performed on Personal Information, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, combination, blocking, erasure or destruction;
“Sensitive Information” means sensitive data as defined in the Act, including information revealing genetic, biometric or health data, and other categories designated as sensitive under the Act;
“Untu Capital”, “we”, “us” or “our” means Untu Capital Limited, a microfinance institution registered in Zimbabwe and licensed by the Reserve Bank of Zimbabwe under the Microfinance Act [Chapter 24:29], and its successors and assigns;
“Terms” means these Digital Platform Terms and Conditions, including the Privacy Notice, Cookie Notice and Consent Declaration annexed hereto, as amended from time to time.
1.2 Headings are for convenience only and do not affect interpretation. The singular includes the plural and vice versa. References to statutes include amendments, re-enactments and regulations made under them. Where these Terms conflict with a signed Loan Agreement, the Loan Agreement prevails in respect of the credit facility it governs. Where these Terms conflict with mandatory provisions of Applicable Law, the Applicable Law prevails.
2. Acceptance of Terms
2.1 By ticking the box marked “I have read, understood and agree to the Untu Capital Limited Digital Platform Terms and Conditions and Privacy Notice”, or by registering for, accessing or using any Digital Platform, you confirm that you have read, understood and agree to be bound by these Terms.
2.2 On the USSD platform, acceptance is signified by selecting the “Accept” option when prompted. On the WhatsApp chatbot, acceptance is signified by responding with the confirmation keyword or option presented to you. Such acceptance has the same legal effect as a written signature, in accordance with clause 23.
2.3 Your acceptance is recorded electronically, together with the date, time, channel and identifier (such as mobile number or account number) through which acceptance was given. These records constitute evidence of your agreement.
2.4 If you use a Digital Platform on behalf of a company, partnership, association or other entity, you warrant that you are duly authorised to bind that entity, and “you” includes that entity.
3. Eligibility
3.1 To register for and use the Digital Platforms you must: (a) be a natural person of at least eighteen (18) years of age with full legal capacity, or a duly registered legal entity; (b) be resident or domiciled in Zimbabwe, or otherwise acceptable to Untu Capital under its policies; (c) hold a valid national identity document, passport or other identification acceptable under Applicable Law; and (d) provide accurate, current and complete registration information.
3.2 Use of the Digital Platforms does not entitle you to credit. All credit facilities remain subject to Untu Capital’s credit assessment, approval processes and the conclusion of a Loan Agreement.
3.3 We may decline, suspend or terminate registration where eligibility requirements are not met, where required by Applicable Law, or where we reasonably suspect fraud, identity misrepresentation or sanctions exposure.
4. Digital Account Registration
4.1 To access certain services you must create a digital profile by providing the information requested during registration, which may include your full name, national ID number, date of birth, mobile number, email address, physical address and employment details.
4.2 You are responsible for maintaining the confidentiality of your login credentials, PIN, OTPs (one-time passwords) and any other security details. You must not share them with any person, including persons claiming to represent Untu Capital. Untu Capital staff will never ask for your full PIN or password.
4.3 You must notify us immediately at info@untucapital.co.zw or 0785218112 if you suspect unauthorised access to your profile, loss or theft of your device or SIM card, or compromise of your credentials. Until we receive such notice and have had a reasonable opportunity to act, all activity conducted through your credentials is deemed authorised by you.
4.4 You must keep your registration information accurate and up to date and promptly notify us of any changes, including changes of mobile number, which is a key identifier on the USSD and WhatsApp channels.
4.5 We may suspend or deactivate any digital profile that is inactive, compromised, used in breach of these Terms or flagged under Applicable Law, subject to any notice requirements under Applicable Law.
5. Identity Verification (Know Your Customer)
5.1 As an accountable institution under the Money Laundering and Proceeds of Crime Act [Chapter 9:24] and applicable RBZ and FIU directives, Untu Capital is legally required to conduct customer due diligence (“CDD”/“KYC”) before establishing a business relationship and on an ongoing basis.
5.2 You consent to Untu Capital verifying your identity and the information you provide, including by: (a) requesting and retaining copies of your national ID, passport, driver’s licence, proof of residence, payslips and bank statements; (b) capturing a photograph or “selfie” and, where used, biometric identifiers for facial comparison; (c) screening your details against domestic and international sanctions, politically exposed person (PEP) and adverse media lists; and (d) making verification checks with the registries, institutions and service providers described in clauses 12 to 16.
5.3 You warrant that all documents and information supplied are authentic, accurate and belong to you. Supplying false or fraudulent KYC information is a criminal offence and will result in termination of services and reporting to relevant authorities.
5.4 We may decline or discontinue services where CDD cannot be completed, and we may be required by law to file reports with the FIU without notice to you. To the extent permitted by law, we are not liable for any loss arising from actions taken in good faith to comply with AML/CFT obligations.
PART B — DATA PROTECTION, PRIVACY AND CONSENTS
6. Collection of Personal Information
6.1 We collect Personal Information directly from you (through application forms, the Digital Platforms, calls and correspondence), automatically (through your use of the Digital Platforms, as described in clauses 17 to 19), and from third parties (including CRBs, banks, employers, mobile network operators, government registries and publicly available sources), in each case in accordance with the Act.
6.2 The categories of Personal Information we collect include: (a) identity data — name, national ID number, passport number, date of birth, gender, nationality, photograph and, where used, biometric data; (b) contact data — physical and postal address, mobile number, email address; (c) financial data — bank account and mobile money details, income, expenses, assets, liabilities, credit history and transaction records; (d) employment data — employer name, position, employment status and remuneration; (e) technical and usage data — as described in clauses 17 to 19; and (f) records of your communications with us, including WhatsApp messages, USSD sessions and recorded calls.
6.3 Where you provide us with Personal Information about another person (such as a next of kin, referee, guarantor or beneficiary), you warrant that you have informed that person and are authorised to provide their information for the purposes described in these Terms.
6.4 Provision of certain Personal Information is mandatory under Applicable Law (including KYC data). Failure to provide it will prevent us from providing services to you.
7. Lawful Basis for Processing
7.1 We Process Personal Information only where a lawful basis exists under the Act, namely where: (a) you have given consent; (b) Processing is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract (including assessing a loan application); (c) Processing is necessary for compliance with a legal obligation to which we are subject (including AML/CFT, tax and RBZ reporting obligations); (d) Processing is necessary to protect your vital interests or those of another person; (e) Processing is necessary for the performance of a task carried out in the public interest; or (f) Processing is necessary for our legitimate interests or those of a third party, except where overridden by your fundamental rights and freedoms.
7.2 We Process Sensitive Information (including biometric data used for identity verification) only with your explicit consent or as otherwise permitted by the Act.
7.3 Untu Capital is registered/licensed with the Data Protection Authority as a data controller to the extent required by SI 155 of 2024 and has appointed a Data Protection Officer (“DPO”), whose contact details appear in clause 40.
8. Customer Consent
8.1 By accepting these Terms you consent to the Processing of your Personal Information by Untu Capital, its employees, agents and service providers, for the following purposes: (a) registering and administering your digital profile; (b) assessing loan applications and creditworthiness; (c) concluding and administering Loan Agreements, collections and recoveries; (d) identity verification, KYC, AML/CFT compliance, sanctions screening and fraud prevention; (e) credit referencing as set out in clauses 9 and 10; (f) regulatory reporting to the RBZ, FIU, ZIMRA, the DPA and other competent authorities; (g) service communications relating to your accounts and applications; (h) research, statistical analysis, credit scoring model development and service improvement, using aggregated or de-identified data wherever practicable; and (i) marketing, subject to clause 30.
8.2 Consent is given freely, specifically and on an informed basis. Where we rely on consent, you may withdraw it as described in clause 31. Where we Process on a legal basis other than consent (for example, a statutory obligation), withdrawal of consent does not affect that Processing.
8.3 Separate, specific consents (for example for marketing or location data) are presented as distinct opt-ins and are not a condition for obtaining credit unless the Processing is necessary for the credit service itself.
9. Credit Bureau Consent
9.1 You acknowledge that Untu Capital is required and entitled, under the Banking Act [Chapter 24:20], the Microfinance Act [Chapter 24:29] and RBZ directives governing the Credit Registry and credit reference bureaus, to exchange information about you and your credit facilities with the RBZ Credit Registry and registered CRBs.
9.2 You consent to Untu Capital: (a) requesting and obtaining your credit reports, credit scores and related information from any CRB and the RBZ Credit Registry, at application, during the life of any facility, and for collections purposes; (b) submitting to the CRBs and the RBZ Credit Registry information about your identity, your applications, the facilities granted to you, your repayment performance (both positive and adverse), defaults, restructurings and settlements; and (c) using CRB information in credit scoring, affordability assessment, fraud detection and account management.
9.3 You acknowledge that: (a) adverse information (such as late payment or default) submitted to CRBs may negatively affect your ability to obtain credit from Untu Capital and other credit providers; (b) information will be retained by the CRBs and the Credit Registry for the periods prescribed by Applicable Law and RBZ directives; and (c) other credit providers and subscribers may access this information when assessing you, as permitted by law.
9.4 We will take reasonable steps to ensure the information we submit is accurate, complete and current. If you believe information we submitted is inaccurate, you may dispute it through the complaints procedure in clause 37, and we will investigate and, where warranted, correct the record with the relevant CRB within the timelines required by Applicable Law.
10. Consent to FCB and Other Credit Reference Bureaus
10.1 Without limiting clause 9, you expressly consent to Untu Capital conducting enquiries on you with, and disclosing your information to, the Financial Clearing Bureau (FCB) and any other credit reference bureau registered with the RBZ from time to time (including XDS Zimbabwe and Fincheck), and the RBZ Credit Registry.
10.2 This consent covers: (a) searches at the point of each application and periodically thereafter for account management, review, collections and fraud-prevention purposes; (b) the listing of your account conduct, including adverse listings following default, subject to any notice requirements under Applicable Law and the relevant bureau’s rules; and (c) verification of your identity and contact details against bureau records.
10.3 You acknowledge that each enquiry may be visible to other subscribers of the relevant bureau, and that bureaus operate under their own statutory and contractual duties of confidentiality and data protection.
10.4 Before an adverse listing is made, we will give you any notice required by Applicable Law or applicable RBZ directives at your last known contact details, affording you an opportunity to remedy the default or dispute the listing.
11. Third-Party Data Sharing
11.1 We may share your Personal Information with: (a) CRBs and the RBZ Credit Registry (clauses 9 and 10); (b) the RBZ, FIU, DPA, ZIMRA, law enforcement and other competent authorities where required or permitted by law; (c) our service providers and processors, including IT hosting, cloud, software, payment processing, SMS/USSD/WhatsApp gateway, identity verification, document management, collections and debt recovery service providers, under written contracts imposing confidentiality and data protection obligations consistent with the Act; (d) our funders, insurers, guarantors, auditors, legal advisers and professional advisers, under duties of confidentiality; (e) banks, mobile money operators and payment system participants for disbursement and repayment processing; and (f) any person to whom we cede, assign or transfer rights or obligations under a Loan Agreement, or in connection with a corporate restructuring, merger or sale, subject to Applicable Law.
11.2 We do not sell your Personal Information.
11.3 Where Personal Information is transferred outside Zimbabwe (for example to a regional cloud or messaging provider such as the operator of the WhatsApp platform), we will do so only in accordance with the Act, including ensuring an adequate level of protection or another lawful transfer mechanism, and where required, with the authorisation of the DPA or your consent.
12. Consent for Bank Verification
12.1 You consent to Untu Capital verifying, directly with your bank or through authorised verification service providers, the bank account details you provide, including confirmation that the account exists, is active and is held in your name.
12.2 Where you submit bank statements in support of a loan application, you consent to us verifying their authenticity with the issuing bank or through statement-verification services, and analysing the transactions they contain for affordability and fraud-prevention purposes.
12.3 We will not effect debits from your account except as authorised under a Loan Agreement, a debit order or stop-order mandate, or other instrument signed (including electronically) by you.
13. Income Verification
13.1 You consent to Untu Capital verifying your declared income and affordability using payslips, bank and mobile money statements, employer confirmations, and any lawful data source, for the purpose of responsible lending and affordability assessment consistent with RBZ consumer protection requirements.
13.2 You acknowledge that responsible-lending assessment is undertaken for your protection and ours, and that we may decline an application where affordability cannot be established.
14. Employer Verification
14.1 Where you indicate that you are employed, you consent to Untu Capital contacting your employer (including its human resources or payroll office) to verify your employment status, position, tenure and salary details relevant to your application.
14.2 Where repayment is to be effected by salary deduction or payroll stop-order, you consent to the exchange of information between Untu Capital and your employer (or the responsible paymaster, including the Salary Service Bureau where applicable) necessary to establish, administer, amend and terminate the deduction.
15. National ID Verification
15.1 You consent to Untu Capital verifying your national identity document and the particulars on it against the records of the Registrar-General’s office and/or through authorised identity-verification service providers, including biometric or photographic comparison where available.
15.2 You acknowledge that identity verification is a legal requirement under AML/CFT law, and that services cannot be provided where identity cannot be verified.
16. Mobile Network Verification
16.1 You consent to Untu Capital verifying, with mobile network operators and mobile money operators (including Econet/EcoCash, NetOne/OneMoney and Telecel/Telecash or their successors), that the mobile number you register: (a) is active and registered in your name; (b) has not recently been subject to a SIM-swap or port that may indicate fraud; and (c) is linked to the mobile money wallet nominated for disbursement or repayment.
16.2 Where you apply through the USSD or WhatsApp channels, you consent to the mobile network operator sharing with us such technical confirmation as is necessary to authenticate your session and process your request.
17. Use of Cookies
17.1 Our website and web portal do not currently use cookies or similar tracking technologies. If we introduce cookies in the future, we will update this clause and the Cookie Notice (Annexure B) and, where required, obtain your consent.
17.2 You may still manage cookies set by your browser or by third-party sites through your browser settings. Untu Capital does not presently operate a cookie banner or cookie preference centre on its website.
18. Device Information Collection
18.1 When you use the Digital Platforms we may automatically collect device and technical information, including device make and model, operating system and version, unique device identifiers, IP address, browser type, mobile network information, app version and crash logs.
18.2 We use this information to authenticate you, secure the Digital Platforms, detect fraud (including detection of emulators, rooted or compromised devices and SIM-swap indicators), diagnose technical problems and improve our services.
18.3 The mobile application will request only those device permissions reasonably necessary for its functions (for example camera access for document capture). You may manage permissions in your device settings, but disabling certain permissions may prevent particular features from working.
19. Location Data
19.1 With your consent, given through your device settings or an in-app prompt, we may collect approximate or precise location data to: (a) verify your stated address or business location; (b) prevent and detect fraud; (c) comply with Applicable Law; and (d) direct you to the nearest branch or agent.
19.2 You may withdraw location consent at any time through your device settings. Withdrawal does not affect the lawfulness of prior Processing, but may limit features or require alternative address verification.
PART C — CHANNEL-SPECIFIC TERMS
20. WhatsApp and Chatbot Terms
20.1 The Untu Capital WhatsApp chatbot is provided through the WhatsApp Business platform. Your use of WhatsApp is also governed by the terms and privacy policy of WhatsApp LLC/Meta, over which we have no control. Messages exchanged on WhatsApp are processed on infrastructure operated by Meta, which may be located outside Zimbabwe (see clause 11.3).
20.2 The chatbot provides automated responses. While we take care to ensure accuracy, automated responses are for convenience and general information; they do not constitute a binding loan offer unless expressly stated and confirmed through our approval process.
20.3 You must not use the chatbot to send Sensitive Information beyond what is requested, or content that is unlawful, abusive or infringing. Conversations may be recorded, retained and reviewed for quality assurance, dispute resolution, compliance and fraud prevention.
20.4 You are responsible for maintaining control of the WhatsApp account and mobile number you use. Instructions received from your registered number are deemed to be from you, subject to clause 4.3.
20.5 We may verify your identity within the chat (for example by OTP or security questions) before disclosing account information or processing transactions.
21. USSD Terms
21.1 The USSD service is accessible by dialling *261# from a registered mobile number on participating networks. Availability depends on your mobile network operator, and standard network charges or session fees set by the operator may apply.
21.2 USSD sessions are unencrypted, time-limited menu sessions. A session may terminate mid-transaction due to network conditions; an incomplete session does not constitute a submitted application or instruction unless we confirm receipt.
21.3 Instructions entered from your registered mobile number and confirmed with your PIN or the prescribed confirmation step are deemed authorised by you.
21.4 You must not access the USSD service using another person’s SIM card, and you are responsible for safeguarding your SIM and PIN. Notify us immediately of SIM loss, theft or swap.
22. Mobile Application Terms
22.1 We grant you a limited, personal, non-exclusive, non-transferable, revocable licence to install and use the Untu Capital mobile application on a device you own or control, for your own lawful use of our services.
22.2 You must download the application only from official app stores or channels we designate. We are not responsible for versions obtained elsewhere.
22.3 You must not (and must not permit any person to): reverse engineer, decompile, modify or create derivative works of the application; bypass or interfere with its security features; use it on a rooted or jailbroken device in breach of our security requirements; or use any robot, scraper or automated means to access the Digital Platforms.
22.4 We may issue updates, and may require you to install updates as a condition of continued use, including security updates. Older versions may cease to function.
22.5 App store providers (such as Google or Apple) are not parties to these Terms and bear no responsibility for the application or our services.
PART D — ELECTRONIC TRANSACTIONS AND DIGITAL LENDING
23. Electronic Signatures and Electronic Acceptance
23.1 You agree that your electronic acts of acceptance — including ticking an acceptance checkbox, selecting “Accept” on USSD, confirming through the WhatsApp chatbot, entering an OTP or PIN, clicking “Submit” or “I Agree”, or applying any electronic signature we support — constitute your signature and manifest your intention to be legally bound, to the fullest extent recognised under the laws of Zimbabwe, including the Act, the Consumer Protection Act [Chapter 14:44] (in respect of electronic transactions) and the common law.
23.2 You agree not to challenge the validity, enforceability or admissibility of any agreement, instruction or record solely on the basis that it was concluded, given or stored electronically.
23.3 Each OTP, PIN or credential-based confirmation is unique to you. You must not disclose OTPs to any person. Untu Capital will never ask you to share an OTP by phone or message.
24. Electronic Records
24.1 We keep electronic records of your registrations, acceptances, applications, agreements, instructions, communications and transactions. You agree that such records (including system logs, USSD session records and WhatsApp transcripts) are admissible as evidence and, absent manifest error, constitute prima facie proof of their contents.
24.2 Where Applicable Law requires information to be provided in writing, provision through a Digital Platform, by email or by SMS to your registered contact details satisfies that requirement to the extent the law permits.
24.3 You may request copies of your Loan Agreement and key records through the contact details in clause 40; statutory fees, if any, are those permitted by Applicable Law.
25. Digital Loan Applications
25.1 Loan applications may be initiated and completed through the Digital Platforms. Submission of an application is not an offer or approval of credit by Untu Capital; a facility exists only when we approve the application and a Loan Agreement is concluded.
25.2 The interest rate, fees and charges, repayment schedule, default consequences and all pricing terms of any facility are contained in the Loan Agreement and its disclosure statement, which are provided to you before you accept the facility, in accordance with the Microfinance Act [Chapter 24:29], RBZ disclosure requirements and the Consumer Protection Act [Chapter 14:44]. These Terms do not amend any Loan Agreement.
25.3 You warrant that all information submitted in an application is true, complete and accurate, and you acknowledge that credit decisions rely on it. Material misstatements may result in decline, termination, acceleration of any facility as provided in the Loan Agreement, adverse CRB listing and criminal referral.
25.4 We may use automated credit scoring, including models drawing on CRB data, verification data and platform data, to assist or make credit decisions. Where a decision that significantly affects you is based solely on automated Processing, you may, as provided in the Act, request human review of the decision through the contacts in clause 40.
25.5 Approved funds are disbursed to the bank account or mobile money wallet nominated and verified in your application. Disbursement timing depends on third-party payment systems and is not guaranteed.
25.6 Where the Consumer Protection Act [Chapter 14:44] confers a cooling-off right in respect of an electronic transaction, that right applies as provided by that Act; note that statutory exclusions may apply to financial services and to agreements already performed.
26. Fraud Prevention
26.1 We employ fraud detection and prevention measures across the Digital Platforms, including device intelligence, behavioural analytics, SIM-swap checks, biometric comparison, sanctions and watchlist screening, and information sharing with CRBs, banks, mobile network operators, other financial institutions, industry fraud databases and law enforcement, in accordance with Applicable Law.
26.2 We may delay, decline or reverse any transaction, suspend any profile, or withhold disbursement where we reasonably suspect fraud, money laundering, terrorist financing or other unlawful activity, and to the extent permitted by law we are not liable for loss arising from such action taken in good faith.
26.3 You must not use the Digital Platforms for any fraudulent or unlawful purpose. We will report suspected criminal conduct to the relevant authorities.
27. Customer Responsibilities
27.1 You are responsible for: (a) the accuracy of the information you provide; (b) safeguarding your devices, SIM cards, credentials, PINs and OTPs; (c) reviewing communications we send to your registered contact details; (d) ensuring you understand any Loan Agreement before accepting it, and seeking independent advice if in doubt; (e) using the Digital Platforms lawfully and in accordance with these Terms; and (f) promptly reporting errors, unauthorised transactions and security incidents.
27.2 You must not introduce malware, attempt to gain unauthorised access to any system or data, interfere with other users, or engage in any conduct that disrupts or damages the Digital Platforms.
28. Data Security
28.1 We implement appropriate technical and organisational measures, consistent with section requirements of the Act and industry practice, designed to protect Personal Information against unauthorised access, disclosure, alteration, loss or destruction. These include encryption in transit, access controls, staff confidentiality undertakings, monitoring and vendor due diligence.
28.2 Our processors are contractually bound to implement equivalent safeguards and to Process Personal Information only on our documented instructions.
28.3 In the event of a data breach affecting your Personal Information, we will act in accordance with the Act, including notifying the Data Protection Authority within the prescribed period and, where required, notifying you without undue delay with information about the nature of the breach and recommended protective steps.
28.4 No system is absolutely secure. You play an essential role in security by protecting your credentials and devices as described in these Terms.
29. Data Retention
29.1 We retain Personal Information only for as long as necessary for the purposes for which it was collected, and thereafter as required by Applicable Law, including: (a) KYC/CDD and transaction records for the minimum periods prescribed under the Money Laundering and Proceeds of Crime Act [Chapter 9:24] (generally at least five (5) years after the end of the business relationship or transaction); (b) accounting and tax records for the periods required by tax legislation; and (c) records relevant to actual or contemplated legal proceedings until those proceedings are concluded and appeal rights exhausted.
29.2 When retention is no longer required, Personal Information is securely deleted, destroyed or anonymised. Anonymised or aggregated data that no longer identifies you may be retained for statistical and model-development purposes.
29.3 Our detailed retention schedule is available from the DPO on request.
30. Marketing Communications
30.1 With your consent, we may send you marketing and promotional communications about Untu Capital products, services, offers, financial education and events, by SMS, email, WhatsApp, in-app notification, telephone or post.
30.2 Marketing consent is optional and separate from these Terms; declining it does not affect your access to credit or services.
30.3 Every electronic marketing message will identify Untu Capital and include a simple opt-out mechanism (for example replying “STOP” or an unsubscribe link). You may also opt out at any time via the contacts in clause 40. We will give effect to opt-outs promptly, subject to a reasonable period for systems to update.
30.4 Service and regulatory communications (such as repayment reminders, statements, security alerts and changes to terms) are not marketing and will be sent regardless of marketing preferences.
30.5 We do not share your Personal Information with third parties for their own direct marketing without your explicit consent.
31. Withdrawal of Consent
31.1 Where Processing is based on your consent, you may withdraw that consent at any time, free of charge, by contacting the DPO (clause 40), adjusting in-app or cookie settings, or using the opt-out mechanism in the relevant communication.
31.2 Withdrawal does not affect: (a) the lawfulness of Processing carried out before withdrawal; (b) Processing based on another lawful basis, including our statutory KYC, credit-reporting, record-keeping and reporting obligations, which continue notwithstanding withdrawal; or (c) our right to complete or enforce any existing Loan Agreement.
31.3 If you withdraw consent that is necessary for the provision of a service (for example identity verification), we may be unable to provide or continue that service.
32. Children’s Privacy
32.1 The Digital Platforms are not intended for, and may not be used by, persons under the age of eighteen (18). We do not knowingly Process the Personal Information of children except where incidental and permitted by the Act (for example a minor beneficiary named on a form, with the consent of a parent or guardian).
32.2 If we become aware that a child’s Personal Information has been collected without the consent required by the Act, we will delete it and deactivate any related profile. Suspected under-age use may be reported to us at the contacts in clause 40.
PART E — GENERAL LEGAL PROVISIONS
33. Intellectual Property
33.1 All intellectual property in the Digital Platforms — including software, source code, designs, logos, trade marks, trade names, content, databases and documentation — is owned by or licensed to Untu Capital and is protected under the laws of Zimbabwe and international law.
33.2 Nothing in these Terms transfers any intellectual property to you. You may not copy, reproduce, distribute, modify, publish or commercially exploit any part of the Digital Platforms except as these Terms expressly permit or with our prior written consent.
33.3 “Untu Capital” and associated logos are trade marks of Untu Capital Limited. Unauthorised use, including in phishing or impersonation, is prohibited and will be pursued.
34. Service Availability
34.1 We aim to keep the Digital Platforms available at all times but do not warrant uninterrupted, error-free or continuously secure operation. Availability depends on factors beyond our control, including electricity supply, telecommunications networks, mobile money systems, third-party platforms (such as WhatsApp) and scheduled maintenance.
34.2 We may suspend, modify or discontinue any Digital Platform or feature, temporarily or permanently, for maintenance, security, regulatory or business reasons. Where reasonably practicable we will give advance notice of planned material interruptions.
34.3 If a Digital Platform is unavailable, you may transact through our branches or such alternative channels as we make available. Unavailability of a channel does not suspend your payment obligations under any Loan Agreement.
35. Limitation of Liability
35.1 Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited, including liability arising from gross negligence or wilful misconduct, or your rights under the Consumer Protection Act [Chapter 14:44].
35.2 Subject to clause 35.1, to the maximum extent permitted by Applicable Law, Untu Capital shall not be liable for: (a) loss arising from events beyond our reasonable control, including network or power failures, third-party platform outages (including WhatsApp, app stores, banks and mobile money operators), strikes, civil unrest or acts of authority; (b) loss arising from your failure to safeguard credentials, devices or SIM cards, or from instructions given with your credentials before you notified us of compromise; (c) indirect, consequential, special or punitive loss, loss of profit, loss of business or loss of data; (d) the acts or omissions of third parties whose services you access through the Digital Platforms; or (e) inaccuracies in general information (as opposed to your contractual documents) published on the Digital Platforms.
35.3 Subject to clauses 35.1 and 35.2, our total aggregate liability to you arising out of or in connection with the Digital Platforms in any twelve (12) month period shall not exceed the total fees and charges paid by you to Untu Capital for Digital Platform services in that period.
35.4 Each provision of this clause is severable and applies to the fullest extent permitted by law.
36. Indemnity
36.1 To the extent permitted by Applicable Law, you indemnify Untu Capital, its directors, employees and agents against claims, losses, damages and costs (including reasonable legal costs) arising from: (a) your breach of these Terms or of Applicable Law; (b) false, misleading or fraudulent information supplied by you; (c) your misuse of the Digital Platforms; or (d) claims by third parties whose Personal Information you provided without authority (clause 6.3).
36.2 This indemnity does not apply to the extent a loss is caused by Untu Capital’s own gross negligence or wilful misconduct, and does not limit any right you have under the Consumer Protection Act [Chapter 14:44].
37. Complaints and Dispute Resolution
37.1 If you have a complaint about the Digital Platforms, our services or the handling of your Personal Information, please contact us first: Complaints Desk, 0732 001 002, info@untucapital.co.zw, or any branch. Please provide your name, account or ID number, contact details and a description of the complaint.
37.2 We will acknowledge your complaint within two (2) business days and endeavour to resolve it within fourteen (14) business days, keeping you informed of progress. Complex complaints may take longer, in which case we will advise you of revised timelines.
37.3 If you are not satisfied with the outcome, you may escalate: (a) for banking/microfinance conduct matters — to the Reserve Bank of Zimbabwe (Bank Use Promotion and Consumer Protection / Financial Consumer Protection channels); (b) for data protection matters — to the Data Protection Authority (POTRAZ), which is empowered to receive complaints under the Act; and (c) for consumer protection matters — to the Consumer Protection Commission established under the Consumer Protection Act [Chapter 14:44].
37.4 Nothing in these Terms prevents either party from approaching a court of competent jurisdiction in Zimbabwe. Any dispute-resolution provisions in a Loan Agreement (including arbitration, if applicable) govern disputes under that agreement.
37.5 These Terms do not limit your statutory rights, including your rights as a data subject under the Act to access, rectification, erasure, objection and the other rights described in the Privacy Notice (Annexure A).
38. Governing Law
38.1 These Terms, and any dispute or claim arising out of or in connection with them or the Digital Platforms, are governed by and construed in accordance with the laws of Zimbabwe.
38.2 Subject to clause 37, the parties submit to the jurisdiction of the courts of Zimbabwe.
39. Changes to These Terms
39.1 We may amend these Terms from time to time, including to reflect changes in Applicable Law, regulatory directives, our services or security requirements.
39.2 Material changes will be notified to you at least fourteen (14) days before they take effect, by notice on the Digital Platforms and/or by message to your registered contact details, except where a shorter period is required by law or urgent security considerations.
39.3 Your continued use of the Digital Platforms after the effective date of an amendment constitutes acceptance of the amended Terms. If you do not accept an amendment, you must stop using the Digital Platforms; obligations under any existing Loan Agreement continue unaffected.
39.4 The current version of these Terms is always available at https://www.untucapital.co.zw/terms-and-privacy.php and on request from any branch.
40. Contact Details
Untu Capital Limited
Registered office: 3 Drury Lane, Strathaven, Avondale West, Harare, Zimbabwe
Customer service: 0732 001 002 | info@untucapital.co.zw
WhatsApp: 0785218112 | USSD: *261#
Website: https://www.untucapital.co.zw/
Data Protection Officer (DPO): contact via info@untucapital.co.zw or 0785218112
Complaints Desk: info@untucapital.co.zw | 0732 001 002
Data Protection Authority: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), Harare — for data protection complaints and enquiries.
ANNEXURE A — PRIVACY NOTICE
(Clause 41 of the Terms. This Privacy Notice is issued in terms of the Cyber and Data Protection Act [Chapter 12:07] / Data Protection Act [Chapter 11:12].)
A1. Who we are.
Untu Capital Limited is a microfinance institution licensed by the Reserve Bank of Zimbabwe and a data controller under the Act. Contact details, including those of our Data Protection Officer, appear in clause 40 of the Terms.
A2. What we collect.
Identity, contact, financial, employment, credit, technical, usage, location (with consent) and communications data, as detailed in clauses 6 and 17 to 19 of the Terms. We collect it from you, from your use of our Digital Platforms, and from third parties including credit reference bureaus, banks, employers, mobile network operators and government registries.
A3. Why we process it and on what basis.
We process Personal Information to provide and administer credit and related services (contract); to meet KYC/AML, credit-reporting, tax and regulatory obligations (legal obligation); to prevent fraud, secure our systems and develop our services (legitimate interests); and for marketing, location and cookie purposes (consent). Sensitive data, including biometrics used in identity verification, is processed only with explicit consent or as the Act otherwise permits.
A4. Who we share it with.
Credit reference bureaus (including FCB) and the RBZ Credit Registry; regulators and authorities (RBZ, FIU, POTRAZ, ZIMRA, law enforcement); our vetted service providers under contract; funders, insurers, auditors and professional advisers; payment system participants; and successors in title. We do not sell Personal Information. Details appear in clauses 9 to 16 of the Terms.
A5. Cross-border transfers.
Some providers (for example the WhatsApp platform and certain cloud services) process data outside Zimbabwe. We transfer Personal Information outside Zimbabwe only as the Act permits, ensuring adequate protection or another lawful mechanism, with DPA authorisation or your consent where required.
A6. How long we keep it.
For as long as needed for the stated purposes and thereafter as the law requires — generally at least five years after the relationship ends for KYC and transaction records — after which it is securely destroyed or anonymised (clause 29).
A7. How we protect it.
Technical and organisational safeguards including encryption in transit, access controls, monitoring, staff confidentiality and processor contracts (clause 28). Breaches are handled and notified in accordance with the Act.
A8. Your rights.
Subject to the Act, you have the right to: (a) be informed about Processing (this Notice); (b) access your Personal Information; (c) rectification of inaccurate or incomplete data; (d) erasure/deletion where Processing is unlawful or no longer necessary; (e) object to Processing, including for direct marketing; (f) withdraw consent at any time; (g) not be subject to certain decisions based solely on automated Processing, and to request human review; and (h) lodge a complaint with us or with the Data Protection Authority (POTRAZ). To exercise any right, contact the DPO (clause 40). We respond within the timelines prescribed by the Act; identity verification is required before we act on a request.
A9. Consequences of not providing data.
KYC and application data are required by law and by our credit process; without them we cannot provide services.
A10. Automated decision-making.
We use automated credit scoring as described in clause 25.4, with a right to human review of solely automated decisions that significantly affect you.
A11. Changes.
We may update this Privacy Notice as described in clause 39. The current version is available at https://www.untucapital.co.zw/terms-and-privacy.php#privacy.
ANNEXURE B — COOKIE NOTICE
(Clause 42 of the Terms.)
B1. What cookies are.
Cookies are small text files placed on your device by websites you visit. Similar technologies include pixels, local storage and SDKs.
B2. Cookies we use.
Untu Capital does not currently use cookies, pixels, local storage SDKs or similar tracking technologies on its website. The categories below describe cookies that may be introduced in future; until then, none of these categories apply.
| Category | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Login sessions, security (including fraud prevention), load balancing, cookie-preference storage | No |
| Functional | Remembering language and display preferences | Yes |
| Analytics | Understanding how visitors use the site to improve it (e.g. pages visited, time on site) | Yes |
| Marketing | Measuring campaigns and showing relevant Untu Capital offers | Yes |
B3. Your choices.
Because we do not currently set cookies, there is no cookie banner or Cookie Settings link on our website. You may still control cookies generally through your browser settings. If we introduce cookies later, we will provide appropriate controls and update this Notice.
B4. Third-party cookies.
We do not currently use third-party analytics or marketing tools that set cookies on our website. If that changes, those parties will act as processors or independent controllers under their own notices, and we will list them in an updated version of this Cookie Notice.
B5. Retention.
As we do not currently set cookies, there is no cookie retention period applicable to our website. If cookies are introduced in future, session cookies will expire when you close your browser and persistent cookies will expire after the period stated when they are deployed, or when you delete them.
ANNEXURE C — CONSENT DECLARATION
(Clause 43 of the Terms. To be presented at registration and at each loan application, with tick-boxes rendered per channel: checkbox on web/app; numbered “Accept” options on USSD; keyword confirmation on WhatsApp.)
I, the undersigned/accepting Customer, confirm and declare that: