1. Who we are
Goodfellow Finance Limited is an indigenous Zambian microfinance institution established in 2017 and registered with the Bank of Zambia. We provide payday salary advances and short-term loans to employed individuals across Zambia through 28 branches nationwide.
- Registered office: Plot No. 4448/8 Chaholi Road, Rhodespark, Lusaka, Zambia
- Telephone: +260 211 238 719 / +260 957 224 792
- General enquiries: info@goodfellow.co.zm
- Data Protection Commissioner registration: Registered Data Controller and Data Processor under the Data Protection Act, 2021 — certificate DP000287, valid 1 April 2026 to 31 March 2027
Our Data Protection Officer (DPO)
You may contact our DPO for any privacy matter, including to exercise your rights or raise a concern:
2. Scope of this policy
This policy applies to personal data processed through:
- Our website (goodfellow.co.zm) and online loan application forms
- Walk-in applications and services at any of our 28 branches
- Phone, email and social media enquiries
- Mobile loan services including USSD dial *774#
- Loan disbursement and recovery via cash, bank transfer, mobile money, DDACC and PMEC
- Customer complaints and feedback
This policy does not apply to third-party websites linked from our site. Please review their privacy policies separately.
3. Key terms (DPA Section 2)
- Personal data — information identifying or relating to an identifiable individual (e.g. name, NRC number, phone number, bank details).
- Sensitive personal data — includes financial information, employment details, and other categories defined in Section 14 of the Act.
- Data subject — the individual the data is about (you, our customer or applicant).
- Data Controller — the entity that determines why and how personal data is processed (Goodfellow Finance Limited).
- Processing — any operation on personal data including collection, storage, use, disclosure or deletion.
- Consent — a freely given, specific, informed and unambiguous indication of your agreement to processing (Section 15).
4. Personal data we collect
We collect different categories depending on your relationship with us:
| Category | Typical personal data |
|---|
| Loan applicants | Full name, NRC number, date of birth, phone, email, address, employer, sector, payslips, bank statements, loan amount requested, payroll number |
| Existing customers | Loan account details, repayment history, DDACC/PMEC deduction records, disbursement method, credit profile |
| Website visitors | IP address, browser/device type, pages viewed, cookie preferences (see Cookie Notice) |
| USSD (*774#) users | Mobile number (MSISDN), NRC, transaction metadata, mobile money wallet details |
| Complaints & enquiries | Name, contact details, complaint content, correspondence records |
| Branch visitors | Identity documents, application forms, CCTV footage where installed for security |
5. Purposes & lawful bases
We process personal data only where a lawful basis under Section 13 of the Data Protection Act applies:
| Purpose | Lawful basis |
|---|
| Processing loan applications and administering loans | Performance of a contract / steps prior to entering a contract (Section 13(b)(i)) |
| KYC, identity verification and affordability assessment | Legal obligation — Bank of Zambia and AML/CFT requirements (Section 13(b)(ii)) |
| Credit reference bureau reporting | Legal obligation |
| PMEC payroll deductions and DDACC bank debits | Performance of contract + legal obligation |
| Responding to website, email and branch enquiries | Legitimate interests — addressing your request (Section 13(b)(v)) |
| Marketing SMS, email or calls about our products | Consent (Section 13(a)) — withdrawable at any time |
| Fraud prevention and security monitoring | Legitimate interests + legal obligation |
| Statutory reporting to Bank of Zambia and other regulators | Legal obligation |
| Handling complaints | Legitimate interests + legal obligation |
6. Sensitive personal data
Loan processing requires financial and employment-related personal data. We process this data only for lending, recovery, regulatory compliance and related legitimate purposes. We apply additional safeguards including restricted access, staff confidentiality obligations and secure storage systems.
We do not sell your personal data to third parties.
7. Sharing & disclosure
We may share personal data with:
- Your employer — for PMEC payroll deduction authorisation and verification
- Your bank — for DDACC direct debit setup, disbursement and recovery
- Mobile network operators — for *774# USSD and mobile money services
- Credit reference bureaus — for credit checks and reporting as permitted by law
- Bank of Zambia and other regulators — when required by law
- Professional advisers and auditors — under confidentiality obligations
- IT and service providers — who process data on our behalf under written agreements
- Law enforcement or courts — when required by law or court order
We require all third-party processors to protect personal data in line with the Data Protection Act, 2021.
8. Retention
We retain personal data only for as long as necessary for the purposes collected:
- Active loan records: for the duration of the loan and recovery period
- Closed loan records: up to 7 years after final settlement, as required for financial and regulatory record-keeping
- Unsuccessful applications: up to 12 months unless you consent to longer retention
- Marketing data: until you withdraw consent or opt out
- Complaint records: as required by Bank of Zambia complaint-handling requirements
- Website logs: typically up to 12 months
When data is no longer needed, we securely delete or anonymise it.
9. Security
We implement technical and organisational measures to protect personal data, including:
- SSL/TLS encryption on our website
- Access controls limiting data to authorised staff on a need-to-know basis
- Secure branch procedures for handling physical documents
- Staff confidentiality and data protection training
- Regular review of our information security practices
10. Data-breach notification
If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the Office of the Data Protection Commissioner within 24 hours as required by Section 49 of the Act. Where the breach is likely to result in a high risk to you, we will also notify affected data subjects without undue delay.
11. Your rights as a data subject
Under the Data Protection Act, 2021, you have the right to:
- Access — request confirmation of whether we process your data and obtain a copy
- Rectification — request correction of inaccurate or incomplete data
- Erasure — request deletion where legally permitted
- Object — object to processing, including direct marketing
- Withdraw consent — where processing is based on consent, at any time
- Complain — lodge a complaint with the Office of the Data Protection Commissioner if you believe your rights have been infringed
To exercise your rights, email customercare@goodfellow.co.zm or write to our DPO at the head office address above. We will respond within the timeframe prescribed by the Act.
Office of the Data Protection Commissioner: www.dataprotection.gov.zm
12. Cookies
Our website uses cookies and similar technologies. For full details on the cookies we use and how to manage your preferences, please read our Cookie Notice.
13. Marketing communications
We may send you information about loan products and promotions by SMS, email or phone only where permitted by law and, where required, with your consent. You may opt out at any time by:
14. Automated decisions & profiling
We may use automated systems to assist with credit assessment and affordability checks. You will not be subject to a decision based solely on automated processing that produces legal or similarly significant effects without human review where required by the Act. You may request human intervention by contacting our DPO.
15. USSD & mobile services
When you use *774# or other mobile loan channels, your mobile number and transaction data are processed by your mobile network operator and shared with us as necessary to deliver the service. By using these services you acknowledge this processing as described in this policy and our loan terms.
16. Changes to this policy
We may update this policy to reflect changes in law, regulation or our practices. We will publish the updated version on this page with a revised effective date. Material changes will be communicated via our website and, where appropriate, by email or SMS at least 30 days before they take effect.
17. Contacting us
For privacy enquiries or to exercise your data protection rights:
18. Governing law & jurisdiction
This policy is governed by the laws of the Republic of Zambia, including the Data Protection Act, 2021 (Act No. 3 of 2021). Goodfellow Finance Limited also operates under Bank of Zambia supervision.
If you are dissatisfied with our response to a privacy concern, you may:
- Contact our complaints team at complaints@goodfellow.co.zm — see our Complaint Handling Procedure
- Lodge a complaint with the Office of the Data Protection Commissioner at www.dataprotection.gov.zm
- For financial services matters, escalate to the Bank of Zambia as described in our Terms & Conditions