Privacy Notice

Version 2026-10-v1 · Effective 29 October 2026

We respect your right to privacy. Protecting your Personal Data and keeping it secure matters to us, especially because Pretoh handles your identity, your face, your home location and your money.

This Privacy Notice explains, in plain words:

• what Personal Data we collect, where it comes from and why;
• the legal basis that allows us to Process it;
• who we share it with, including outside Cameroon;
• how we decide on loans, including automatic decisions;
• how long we keep it and how we protect it;
• your rights, and how to use them.

It follows Cameroon's Law No. 2024/017 of 23 December 2024 on the protection of personal data and the other laws that apply to us.

Our promises, in short

• We collect only what we need to verify you, lend to you safely and keep the service running.
• We never read your contacts, SMS, call history, photos or other apps.
• Your face is processed on our own servers. It is never sent to an outside face-recognition company, and it is used only to confirm it's you and to stop duplicate accounts.
• We never sell your data, and we never share it for other companies' advertising.
• We share data only with the partners needed to lend and move money, and they must protect it.
• No automatic system refuses you on its own: a person reviews every application that isn't approved automatically, and you can always ask for a person to look again.
• You can see, correct and, where the law allows, delete your data, and you can withdraw consent for optional uses at any time.
• If something goes wrong with your data, we tell you and the Authority without delay.

1. Who we are

This notice is issued by Pretoh ("we", "us", "our").

For the Processing described in this notice, Pretoh is the data controller: we decide why and how your Personal Data is Processed.

Pretoh also grants the Loans, so the same rules apply to your loan data.

Contact for anything about your data: [email protected]. You can also use Profile → Help in the App.

2. Who this notice applies to

This notice applies to:

• customers: anyone who signs up for, uses, or has used Pretoh, including people who started sign-up without finishing it;
• visitors: anyone who opens the Pretoh App or website;
• field agents who introduce customers to Pretoh, for the Personal Data we Process about their activity;
• anyone else whose Personal Data we receive in connection with Pretoh, for example someone who contacts our support.

It does not cover our employees and job applicants, who receive a separate notice.

3. Important words in this notice

4. What Personal Data we collect

We collect only the Personal Data that is adequate, relevant and limited to what we need for the purposes in section 6. What we collect depends on how far you go with Pretoh.

4.1 Identity and contact data

• full name, date of birth, sex;
• mobile phone number and mobile network (MTN or Orange);
• language preference;
• the name registered on your mobile-money account, as returned by your operator or payment company.

4.2 Identity document data

• the type of document (new CNI, old CNI, passport or CNI receipt);
• photos of the front and back of the document;
• the details read from it: document number, names, date of birth, expiry date, and the data in the machine-readable zone (MRZ) and QR code where present;
• the results of our checks on the document.

4.3 Biometric data

• frames from the short live selfie video you take in the App;
• the face template calculated from your selfie and from the photo on your ID;
• the results of our checks: liveness (that a real person was present), face match (that you match your ID), and duplicate search (that your face is not already used by another account).

4.4 Address and location data

• your home address: region, division, town, neighbourhood, landmark;
• the home pin you place on the map, its accuracy, and its location code (Plus Code);
• the area of about 5 km that your home pin falls in (section 6.4);
• optionally, a photo of your house front with the place and time it was taken, and a utility bill (for example ENEO or Camwater);
• location check-ins: your phone's location at the moments you sign in, apply, take the selfie and repay, only if you allow location access;
• if one of our field agents visits your home with your agreement, the result of that visit and the agent's location at the time.

4.5 Financial and loan data

• the occupation, income range and loan reason you give us;
• your subscription fee and renewal payments;
• your loans: amounts, interest, due dates, repayments, status (for example on time, late or default);
• payment references from our payment companies and your operator;
• your scores and the reasons for each decision on your applications.

4.6 Device and technical data

• a coded device identifier (calculated in your browser and stored only as a coded value), browser and phone type;
• the network (IP) address used to connect;
• the time of your sign-ins and actions in the App;
• push-notification tokens, if you allow notifications;
• technical logs we need to keep the service secure and working.

4.7 Communications data

• the messages we send you (in the App inbox, by push notification and by SMS) and their delivery status;
• your messages to our support, and our answers;
• your consents and preferences, for example for offers by SMS.

4.8 Data we do NOT collect We never collect or read your contacts, your SMS messages, your call history, your photo gallery, your other apps, or your social media. We do not ask for your ethnic origin, religion, political opinion or health.

5. Where we get your Personal Data from

5.1 From you, directly: when you sign up, take photos, place your home pin, fill in your profile, pay, repay, or contact us.

5.2 From your phone, with your permission: camera (for the ID photos and selfie), location (for your home pin and check-ins), and notifications.

5.3 From third parties:

• payment companies and your mobile-money operator: the result of each payment and, where available, the name registered on your mobile-money account;
• our field agents: if an agent introduced you, their agent code; if an agent visited your home, the result of the visit;
• public authorities, where the law requires them to send us information.

6. Why we use your Personal Data, and on what legal basis

The basic rule. Under Law No. 2024/017 (article 9), we Process your Personal Data only with your prior, free, informed, specific and unambiguous consent. The only exceptions are the cases the law allows without consent, mainly when a law requires us to Process it (for example anti-money-laundering, accounting and regulatory reporting). We ask for each consent separately, on its own screen or tick box, before the Processing starts. We record the date, time and version of the text you accepted.

6.1 Your consents, one by one. During sign-up we ask for these consents separately. None of them is pre-ticked.

1. Account consent: to create and run your Account and send you service messages.
2. Biometric consent (express): to calculate and compare your face template, as described in 6.2.
3. Location consent: to use your home pin, location check-ins and area grouping (6.4).
4. Assessment consent (explicit): to assess your requests with scoring and automatic decisions, with a right to human review (section 7).
5. Sharing consent: to share the data each recipient needs with the payment companies and your operator (section 9).
6. Consent to transfers abroad: to send the limited data listed in section 10 to the named recipients outside Cameroon.
7. Offers (optional): to receive offers. Refusing has no effect on your loans.

Consents 1 to 6 are needed to verify you and to lend safely. If you refuse or withdraw one of them, we explain the consequence, for example that we can no longer assess new requests. Withdrawal never affects what was done before, or data we must keep by law.

6.2 Biometric data is Sensitive Personal Data. Under Law No. 2024/017 (articles 48 and 66), we Process it only with your express consent. You give it on a separate screen, before you take any photo, by ticking a box that is not pre-ticked. We use it only for:

• confirming that you are a real person and that you match your ID;
• preventing the same person from opening several accounts;
• confirming it is still you before a loan is sent.

We never use it for anything else, never sell it, and never send it to an outside face-recognition company. It is calculated by our own software, on servers we control, and stored encrypted. Our hosting provider (section 9) only stores it in encrypted form and cannot read it. We do not give your face template to any payment company or partner. Others receive only the result of the check ("verified" or "not verified").

6.3 Financial data about your loans and payments is Processed with your consent and because the law requires financial records.

6.4 Area grouping. With your location consent, we group home pins into areas of about 5 km (a map grid cell). We use these areas to make sure the service reaches every area:

• planning where our agents work;
• watching that approval rates are fair between areas;
• running the area coverage programme. In areas where few loans have been paid out yet, a small number of small loans may be offered each week to customers who pass the identity, duplicate and fraud checks (see the Terms, section 6.7).

Area grouping can only add a chance of an offer. It never lowers your score, and it is never used to refuse you. Area statistics are shared only in anonymous form.

6.5 We do not use your Personal Data for a new purpose that is incompatible with the reason we collected it, unless the law allows it, you consent, or it is needed for legal proceedings.

7. Automatic decisions and profiling

Pretoh makes some decisions automatically, and uses scoring, so we explain them here. Under Law No. 2024/017 (article 44), you have the right not to be subject to a decision based only on automatic processing, unless you were informed and gave your prior, explicit and informed consent. That is the assessment consent in section 6.1. You can withdraw it at any time. We then stop automatic decisions for you, but we can no longer assess new requests.

7.1 What is automatic. When you complete sign-up and each time you request a loan, our system:

• checks your identity, liveness, face match and duplicates;
• checks your address signals;
• calculates a fraud-risk score (from 0 to 100) and a credit score.

The credit score is based only on:

• your repayment history with Pretoh;
• how long you have been subscribed;
• the strength of your identity and address checks;
• how complete your profile is;
• whether the name on your mobile-money account matches your ID;
• fraud signals.

7.2 What the system can decide on its own. If all conditions are clearly met, the system can propose a loan offer automatically, which you are free to accept or decline.

7.3 What it cannot decide on its own. The system does not refuse you on its own. Applications that are not approved automatically are reviewed by a person on our team, usually within 48 hours. Refusals for fraud are decided by a person. An answer of "not this time" because the day's funds are used up is not a judgement about you.

7.4 What we never use. Our scoring never uses ethnic origin, religion, political opinion, health, sex, or your contacts and messages. We check regularly that approval rates are fair between areas, regions and languages.

7.5 Your rights. You can:

• know the main reasons for a decision;
• ask for a person to review any decision;
• give your point of view and contest the decision.

Write to [email protected] or use Profile → Help.

8. Is it mandatory to give us your Personal Data?

You are never forced to use Pretoh. However:

• identity, document, biometric, address and contact data are necessary to open an account and receive a loan. Without them we cannot verify you or lend to you, because of our legal obligations and fraud prevention;
• location access is needed for the home pin and address checks. Without it, your application may take longer, need an agent visit, or not be possible;
• notifications and offers by SMS are optional. Refusing them does not affect your loans.

9. Who we share your Personal Data with

We share only the Personal Data each recipient needs. Our processors must Process it only on our instructions, keep it confidential and secure, and are not allowed to use it for their own purposes.

9.1 We never sell your Personal Data, and we never share it with other companies for their own advertising.

9.2 Statistics. We may share statistics with partners only if they are anonymous, meaning no person can be identified from them.

10. Transfers outside Cameroon

Some recipients in section 9 Process Personal Data outside Cameroon: our payment companies, MSG91 (India), Google (United States), and possibly our hosting provider.

We transfer Personal Data outside Cameroon only where Law No. 2024/017 allows it. This means:

• with the prior authorisation of the Authority, as article 32 of Law No. 2024/017 requires. Until the Authority is able to grant authorisations, we keep a record of our requests and limit transfers to what is strictly necessary;
• with your consent to transfers abroad (section 6.1), which names each recipient and country in section 9;
• with contracts that require the recipient to protect your data at a level comparable to Cameroonian law, including the standard clauses published by the Authority when available;
• sending only what is necessary for the purpose.

Our request for authorisation of these transfers is being filed with the Authority.

Your biometric data and ID images are not sent to the payment companies, MSG91 or Google.

11. How long we keep your Personal Data

We keep Personal Data only as long as needed for the purpose, or as long as the law requires. After that it is deleted or anonymised securely.

12. How we protect your Personal Data

We use technical and organisational measures appropriate to the risks.

12.1 Technical measures

• Encryption: ID and selfie images, and our providers' secret keys, are encrypted on our servers (AES-256). All connections use HTTPS.
• Our own face processing: face templates are calculated on our own servers, not by outside companies.
• Access control: only authorised staff can see Personal Data. Images open only through links that expire after 5 minutes.
• Two-step sign-in for our staff, account lockout after repeated wrong passwords, and limits on repeated requests.
• Records: every staff action, and every view of an ID or selfie image, is recorded.
• Tamper-proof financial records, and protection against double payments.
• Encrypted backups, kept off our main server.

12.2 Organisational measures

• Staff access only what their role needs, and are bound by confidentiality.
• Processors are bound by contracts with security and confidentiality duties.
• We review our risks and security regularly.

12.3 Your part. Keep your phone, your PIN and your SMS codes secret. Pretoh will never ask for your PIN or a code by phone call, SMS, WhatsApp or in person.

13. Personal data breaches

No system can remove all risk. If we discover, or reasonably suspect, that Personal Data has been lost, stolen, accessed or changed without authorisation, we will:

• act immediately to contain it and limit the harm;
• notify the Authority without delay, as required by Law No. 2024/017;
• inform you without delay if the breach is likely to put your rights at risk, and tell you what you can do to protect yourself;
• record the breach and the measures taken.

14. Your rights

You have the following rights over your Personal Data, free of charge:

You also have the right to refuse consent without fear of negative consequences for anything that is optional.

14.1 How to use your rights

• Write to [email protected], or use Profile → Help in the App.
• Tell us which right you want to use.
• To protect you, we may ask you to confirm your identity, for example with an SMS code sent to your registered number.
• We acknowledge your request within 5 business days and answer within 30 days. If your request is complex, we may extend this once and will tell you why.
• If we cannot fully meet your request (for example because the law requires us to keep certain data), we will explain why.

14.2 Offers. You can stop offers at any time in Profile → Preferences, or by replying STOP to an offer SMS.

15. Phone permissions, cookies and local storage

15.1 Phone permissions. The App asks for:

• camera: only to take your ID photos and selfie, and only when you are on those screens;
• location: for your home pin and check-ins;
• notifications: for free alerts.

You can refuse or withdraw these permissions at any time in your phone's settings.

15.2 Local storage. The App stores on your phone:

• your session (so you stay signed in);
• your language;
• a coded device identifier;
• data needed to keep working on a slow network (for example a payment in progress).

We do not use advertising cookies or trackers.

15.3 Google Maps. When you use the map, Google receives technical data such as your IP address and the map area displayed, under Google's own privacy policy.

16. Children

Pretoh is only for people aged 18 or over. We check the date of birth on your ID. We do not knowingly collect Personal Data about children. If we find we have, we delete it.

17. Changes to this notice

We may update this notice to reflect changes in our services, our partners or the law.

• The version and effective date are at the top.
• We will tell you in the App before an important change applies, and where the law requires it, ask for your consent again.
• You can read the current version at any time in Profile → Legal.

18. Contact us

Pretoh

• Your data, your rights, a complaint about privacy: [email protected]
• Customer support (email, phone or WhatsApp where shown): [email protected]
• In the App: Profile → Help

If you are not satisfied with our answer, you may contact Cameroon's Personal Data Protection Authority.