Privacy Policy
Last updated 19 September 2026
Avesta Enterprises collects personal information in order to assess loan applications and provide IT services. This page explains what is collected, why, where it is kept and what rights you have over it.
What we collect
- Identity: your full name, NRC number, date of birth and a photograph of your NRC.
- Contact: phone number, email address and physical address.
- Financial: employer, occupation, income, payslips, bank statements and details of any collateral or guarantor.
- Loan records: amounts, dates, repayments and balances.
- Account: your username and a one-way encrypted form of your password. We never store your password itself and can never read it.
- Activity: a record of sign-ins and of changes made to your application, including the date, time and IP address.
Why we collect it
To verify who you are, to decide whether a loan can responsibly be offered, to administer repayment, to meet our obligations under the Money-Lenders Act, and to keep the records a lender is required to keep. For IT work, to understand the problem and to contact you about it.
Where it is kept
Your information is stored on servers located in Zambia, as required by Section 70(1) of the Data Protection Act No. 3 of 2021. Documents you upload are held in a non-public folder on that server.
Who can see it
Only authorised Avesta Enterprises staff, and only what their role requires. Every access and change is recorded. We do not sell your information, and we do not share it with anyone else except where the law requires it, or where you have asked us to (for example, an employer operating a salary-checkoff arrangement you have agreed to).
How long we keep it
For as long as your loan is running, and afterwards for the period the law requires records to be retained. Enquiries that do not lead to a loan are kept for two years and then removed.
Your rights
- Ask what we hold about you, and receive a copy.
- Ask us to correct anything that is wrong.
- Ask us to delete information we no longer have a lawful reason to keep.
- Withdraw consent where we relied on it, though this may mean we cannot continue a loan.
- Complain to us, and to the Data Protection Commissioner if we do not resolve it.
To exercise any of these, contact us on the details below. We will respond within 30 days.