PATO CAPITAL LIMITED

TERMS AND CONDITIONS OF USE

Version 2.0 | Effective Date: May 2026

Regulated by the Central Bank of Kenya under the Digital Credit Providers Regulations, 2022

1. INTRODUCTION AND ACCEPTANCE OF TERMS

These Terms and Conditions of Use ("Terms") govern your access to and use of all products, services, digital platforms, mobile applications, USSD channels, and portals operated by Pato Capital Limited ("Pato Capital", "PCL", "we", "our", or "us"), a company incorporated in Kenya and licensed by the Central Bank of Kenya (CBK) as a Digital Credit Provider under the Non-Deposit Taking Credit Providers Act, 2023 and the CBK Digital Credit Providers Regulations, 2022.

By downloading, installing, registering for, or using any Pato Capital service, application, or platform, you ("you", "User", "Borrower", "Partner", or "Client") unconditionally agree to be bound by these Terms, our Privacy Policy, any product-specific loan agreement, and all applicable Kenyan laws and regulations. If you do not agree, you must not use our services.

Important notice: These Terms constitute a legally binding contract. Please read them carefully before proceeding. Pato Capital reserves the right to amend these Terms at any time with notice as required by law.

2. DEFINITIONS

In these Terms, the following definitions apply:

• "Account" means a registered user profile on any Pato Capital platform or system.

• "APR" means the Annualised Percentage Rate computed in accordance with Section 27(2) of the CBK Digital Credit Providers Regulations, 2022.

• "Borrower" means any natural person or entity that applies for or receives a loan from Pato Capital.

• "Check-off Deduction" means a payroll deduction arrangement between Pato Capital, an Employer Aggregator, and a Borrower for loan repayment.

• "CRB" means any Credit Reference Bureau licensed in Kenya, including TransUnion, Metropol, and Creditinfo.

• "Fund Administration Client" means a chama, SACCO, employer fund, or similar group that has engaged Pato Capital under a Fund Administration Agreement.

• "Loan Agreement" means a specific loan contract between Pato Capital and a Borrower setting out the terms of an individual credit facility.

• "Loan Product" means any of the credit products offered by Pato Capital as described in Clause 5 of these Terms.

• "M-Pesa" means the mobile money service operated by Safaricom PLC.

• "NDTCP Regulations" means the Non-Deposit Taking Credit Providers Regulations, 2026 (gazetted).

• "Platform" means the Pato Capital mobile application, USSD system, web portal, or any other digital interface through which services are accessed.

• "Processing Fee" means a one-time fee charged at loan disbursement as disclosed in the applicable product schedule.

• "Two-Thirds Rule" means the limitation under Section 19(1) of the Employment Act, Cap 226, that deductions from an employee's salary shall not exceed two-thirds of gross monthly earnings.

3. ELIGIBILITY

To be eligible to use Pato Capital's credit services, you must satisfy all of the following requirements at the time of application and throughout the duration of your loan:

• You are a natural person aged 18 years or older, or a legally recognised entity (including a chama, SACCO, or company) with capacity to contract under Kenyan law.

• You hold a valid Kenyan National Identity Card, valid Passport, Military Identity Card, or Alien Identity Card.

• You hold an active M-Pesa registered mobile number in your name.

• You are not subject to any active adverse CRB listing that disqualifies you from credit under our credit policy, unless exceptional circumstances apply.

• You have not been previously blacklisted by Pato Capital for fraud, misrepresentation, or material breach of any prior loan agreement.

• For employer-linked products: your employer has entered into an Employer Aggregator Agreement with Pato Capital.

• For invoice financing products: the invoice payer or buyer organisation has been approved by Pato Capital.

• For pension-backed products: your pension or annuity administrator has entered into a formal arrangement with Pato Capital.

• For insurance-backed products: you hold a qualifying in-force life insurance policy with an insurer that has entered into an irrevocable assignment arrangement with Pato Capital.

Pato Capital reserves the right to verify eligibility at any stage and to decline or terminate access to services where eligibility requirements are not met.

4. ACCOUNT REGISTRATION AND SECURITY

4.1 Registration: To access Pato Capital's services, you must register an account using your verified personal information. You must provide accurate, complete, and current information. Providing false or misleading information is grounds for immediate account termination and may constitute an offence under the Proceeds of Crime and Anti-Money Laundering Act, 2009.

4.2 One Account Per Person: Each natural person may hold only one active Account. Registration of multiple accounts is strictly prohibited and will result in permanent account closure and potential CRB reporting.

4.3 Security: You are responsible for maintaining the confidentiality of your login credentials, PIN, or OTP. You must notify us immediately at info@patocapital.com or +254 108 238171 if you suspect any unauthorised access to your Account.

4.4 Consent to KYC Verification: By registering, you authorise Pato Capital to verify your identity using the Integrated Population Registration System (IPRS), CRBs, M-Pesa records, and any other verification services as required by law. You waive any confidentiality rights over personal data to the extent necessary for credit assessment and KYC compliance.

4.5 Account Updates: You must promptly update your account information whenever it changes. Failure to maintain current information may result in suspension of services.

5. OUR SERVICES AND LOAN PRODUCTS

Pato Capital offers the following credit products and services, each subject to specific eligibility criteria, product terms, and a Loan Agreement:

5.1 Consumer Employer Salary Advance (Product A1)

A short-term salary advance for employees of approved employer organisations, repaid via check-off deduction from monthly salary. The loan amount is subject to a 40% affordability cap on net disposable income after statutory deductions and subject to the Two-Thirds Rule under the Employment Act. Repayment is made directly from payroll by the employer to Pato Capital.

5.2 Mamamboga Trader Advance

A short-term credit facility for small traders and micro-entrepreneurs, disbursed via M-Pesa. This product is designed for working capital and inventory financing for informal and semi-formal traders with verifiable business activity.

5.3 Inventory and Supply Chain Loan (Self-Onboarding)

A short-term inventory loan for traders who self-register on the Pato Capital platform. Designed for stock and working capital financing over short cycles, disbursed to the borrower's M-Pesa wallet.

5.4 Inventory and Supply Chain Loan (Partner-Onboarded)

An inventory loan for traders onboarded through an approved partner organisation (distributor, supplier, or aggregator). Partner organisations support the credit assessment and may provide soft guarantees or collection assistance.

5.5 Invoice and Supply Chain Financing (Product A3)

Financing secured against verified trade invoices owed by approved buyer organisations. The loan advance is up to 85% of the face value of the invoice. Repayment is made directly by the buyer organisation to Pato Capital on the invoice due date. Only invoices from pre-approved buyer organisations qualify.

5.6 Pension and Annuity-Backed Loan (Product A4)

A credit facility for active pensioners or annuitants drawing regular income from an approved pension or annuity administrator. Repayment is deducted from the monthly pension payment before disbursement to the pensioner. This product is structured as a loan with pension deduction and not as a direct assignment of pension benefits, in compliance with Section 38 of the Retirement Benefits Act.

5.7 Insurance Policy Loan (Product A5)

A credit facility advanced against the surrender value of an in-force life insurance policy (endowment, whole life, anticipated endowment, or unit-linked). The advance is up to 80% of current surrender value. You must irrevocably assign your policy to Pato Capital as security. On default, lapse, or policy maturity, the insurer will net the outstanding loan balance against policy proceeds before paying you.

5.8 Fund Administration Services

For approved chamas, SACCOs, employer investment clubs, and similar groups acting as Fund Administration Clients, Pato Capital provides technology, compliance, credit assessment, disbursement, and collections infrastructure. The group provides its own capital and membership base. Pato Capital charges a fund administration fee as specified in the applicable Fund Administration Agreement. Group members access credit products under the umbrella of their group's fund arrangement.

5.9 Other Products

Pato Capital may introduce additional products from time to time, subject to CBK pre-approval under Regulation 26 of the CBK Digital Credit Providers Regulations, 2022. All new products will be communicated to users with adequate advance notice.

6. LOAN APPLICATION AND ASSESSMENT

6.1 Application: You may apply for any eligible loan product through the Pato Capital mobile application, USSD, or any other approved channel. Applications must be completed honestly and in full.

6.2 Credit Assessment: All applications are assessed using Pato Capital's credit scoring model, which evaluates factors including identity verification, CRB history, income, affordability, and product-specific criteria. You have the right to request a plain-language explanation of any adverse credit decision within 30 days of the decision.

6.3 No Guarantee of Approval: Submission of an application does not guarantee loan approval. Pato Capital reserves the right to decline any application without being required to disclose detailed reasons beyond what is required by law.

6.4 Accuracy of Information: By submitting an application, you certify that all information provided is true, accurate, and complete. Any misrepresentation will result in immediate termination of the facility, demand for immediate repayment, and may be reported to law enforcement.

6.5 Human Override: All automated credit decisions are subject to review by a Pato Capital Credit Officer, in compliance with Regulation 57 of the NDTCP Regulations, 2026. You may request a human review of any automated decision.

7. FEES, CHARGES AND APR DISCLOSURE

7.1 Transparency: Pato Capital is committed to transparent pricing. Before you accept any loan, we will disclose:

• The loan principal amount.

• The processing fee (expressed as a percentage of principal).

• The interest rate (expressed as a flat rate per 30-day period or applicable tenor).

• The total repayment amount.

• The Annualised Percentage Rate (APR) computed in accordance with CBK Regulations.

• The loan tenor in days.

• Any penalty charges applicable in the event of late payment.

7.2 Processing Fee: A non-refundable processing fee is deducted from the loan disbursement amount. The applicable processing fee is specified in your Loan Agreement and product schedule.

7.3 Interest: Interest is charged as a flat rate on the principal for the applicable loan tenor. The current standard interest rate across all consumer products is 9% per 30-day period unless a different rate is specified in your individual Loan Agreement or you qualify for a loyalty rate reduction.

7.4 Excise Duty: A government excise duty of 20% applies to the processing fee component and is included in the charges disclosed to you.

7.5 Loyalty Rate Graduation: Returning borrowers who have demonstrated consistent repayment history may qualify for a reduced interest rate (8% or 7% per 30-day period) as a loyalty benefit. Eligibility for rate graduation is determined by Pato Capital's credit policy.

7.6 Penalty for Late Payment: A one-time late payment penalty applies where repayment is not received by the due date. The penalty rate and structure are disclosed in your Loan Agreement. Penalty interest ceases to accrue when the total of interest and penalties equals the principal (in duplum rule, as required by applicable law).

7.7 In Duplum Rule: In accordance with applicable Kenyan law, Pato Capital shall not charge or collect interest, penalties, and fees that in total exceed the original principal amount of the loan. Our loan management system enforces this cap automatically.

7.8 No Hidden Fees: Pato Capital does not charge any fees not disclosed in the loan offer. You will not be charged for loan application, account registration, or CRB consent separately beyond what is included in the processing fee.

8. LOAN DISBURSEMENT

8.1 Disbursement Channel: Approved loans are disbursed to your registered M-Pesa wallet. For employer-linked and fund administration products, disbursement channels may differ as specified in the applicable Loan Agreement.

8.2 Disbursement Amount: The amount disbursed to you is the principal minus the processing fee and any other upfront deductions disclosed in your Loan Agreement.

8.3 Cooling-Off Period: You have a 24-hour cooling-off period from the time of disbursement within which you may cancel the loan and repay the principal in full without incurring interest. The processing fee is non-refundable after disbursement has occurred.

8.4 Timing: Disbursement typically occurs within one business day of loan approval, subject to M-Pesa availability and compliance clearances. Pato Capital is not liable for delays caused by M-Pesa system outages or third-party processing delays.

8.5 Rollover: Pato Capital does not automatically roll over loans. Any extension of a loan facility must be expressly agreed by both parties in writing before the original due date.

9. REPAYMENT OBLIGATIONS

9.1 Repayment Obligation: You are obligated to repay the full amount due (principal, interest, fees, and applicable penalty) by the due date specified in your Loan Agreement.

9.2 Repayment Channels: You may repay via:

• M-Pesa Paybill: Pato Capital's business number (as communicated in your loan offer and account).

• M-Pesa STK Push: A payment prompt sent to your registered phone.

• Employer check-off (for employer-linked products): Automatic deduction from payroll by your employer.

• Invoice payer direct payment (for invoice financing): Direct payment by the buyer to Pato Capital on invoice due date.

• Pension administrator deduction (for pension-backed products): Automatic deduction from monthly pension disbursement.

9.3 Partial Payments: Partial payments are accepted but do not extend the due date. Partial payments are applied first to fees and penalties, then to interest, then to principal.

9.4 Early Repayment: You may repay your loan in full at any time before the due date without penalty. Early repayment does not entitle you to a refund of the processing fee or any portion of interest already accrued.

9.5 Employer Check-off Obligation: Where your loan is linked to an employer check-off arrangement, you authorise your employer to deduct the applicable repayment amount from your salary and remit it to Pato Capital. This deduction is made subject to the Two-Thirds Rule under Section 19(1) of the Employment Act. You must promptly notify Pato Capital of any change in employment or salary that may affect check-off arrangements.

9.6 Change of Employment: If you leave your employer before full loan repayment, you remain personally liable for the outstanding balance. Pato Capital may immediately demand repayment of the full outstanding balance upon receipt of notice of your employment termination or resignation.

10. DEFAULT, COLLECTIONS AND CRB REPORTING

10.1 Events of Default: You will be in default if:

• You fail to make full repayment by the due date.

• You provide false, misleading, or fraudulent information at any time.

• You become insolvent or are subject to bankruptcy proceedings.

• Any information you provided materially changes in a way that adversely affects your repayment capacity.

• Your employment is terminated and no alternative repayment arrangement is agreed.

10.2 Collections: Upon default, Pato Capital may take any or all of the following actions:

• Send automated SMS/IVR repayment reminders to your registered number.

• Contact you by phone between the hours of 8:00 AM and 6:00 PM EAT, Monday to Saturday.

• Contact your employer (where applicable) for check-off enforcement.

• List the outstanding debt with licensed Debt Collection Agents.

• Initiate legal proceedings for debt recovery.

Important: Pato Capital will not: contact you outside permitted hours; contact your relatives, friends, or colleagues for collection purposes; share your debt status publicly; or use any harassing, abusive, or threatening language in collection communications. Any such conduct should be reported to us immediately.

10.3 CRB Reporting: In accordance with CBK regulations and the Credit Reference Bureau Regulations, Pato Capital will submit positive credit information (repayment history) and negative information (defaults) to licensed CRBs. A negative CRB listing will be made:

• After 30 days of non-payment (PAR30 threshold).

• With written or SMS notice sent to you before or at the time of listing.

• In accordance with the applicable CRB Regulations.

10.4 Delisting: Upon full repayment of all amounts due, Pato Capital will submit a delisting request to the relevant CRBs within 5 business days of receiving your payment.

10.5 Legal Recovery: Pato Capital reserves the right to commence legal proceedings in a court of competent jurisdiction in Kenya for recovery of outstanding amounts, together with legal costs.

11. PROHIBITED CONDUCT

You must not, in connection with your use of Pato Capital's services:

• Provide false, fraudulent, or misleading information at any time.

• Use a borrowed or another person's identity to register or apply for credit.

• Collude with any other person to misrepresent your financial position.

• Interfere with or circumvent any check-off, repayment, or security arrangement.

• Use loan proceeds for purposes prohibited by law, including financing of terrorism, money laundering, or any criminal activity.

• Attempt to access another user's account without authorisation.

• Reverse-engineer, copy, or reproduce any part of the Pato Capital platform.

• Engage in any conduct that disrupts, degrades, or impairs the operation of the Platform.

Violation of any of the above will result in immediate account closure, demand for full repayment, reporting to relevant authorities, and may result in criminal liability.

12. DATA AND PRIVACY CONSENT

Your use of Pato Capital's services involves the collection and processing of personal data. By agreeing to these Terms, you acknowledge and consent to the collection, use, processing, and sharing of your personal data as described in our Privacy Policy, which forms part of these Terms and is available at www.patocapital.com.

Specific data consents you grant include:

• Consent for Pato Capital to access and read relevant SMS messages on your device for the purpose of generating M-Pesa transaction summaries to support credit assessment.

• Consent for identity verification through IPRS and biometric matching.

• Consent for CRB enquiries and reporting (positive and negative).

• Consent for payroll data access for employer check-off products.

• Consent for pension or annuity data access for pension-backed products.

• Consent for invoice verification with approved buyer organisations.

• Consent for Pato Capital to share your data with agents, partner organisations, legal representatives, and regulators as required.

You may withdraw any consent at any time by contacting us, noting that withdrawal of consent may affect your eligibility for certain loan products. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal or your obligations under any existing Loan Agreement.

13. CONSUMER RIGHTS AND COMPLAINTS

13.1 Consumer Rights: You have the following rights in relation to your credit facility:

• The right to receive a pre-contractual disclosure of all loan terms, fees, and APR before accepting any loan.

• The right to a plain-language explanation of any adverse credit decision.

• The right to a 24-hour cooling-off period after disbursement.

• The right to repay early without penalty.

• The right to be treated with dignity and respect in all collection communications.

• The right to dispute any CRB listing.

• The right to access your own credit data.

13.2 Complaints Process: If you have a complaint, please contact us through any of the following channels:

• In-app complaint submission.

• Email: info@patocapital.com

• Phone: +254 108 238171 (Monday to Friday, 8:00 AM to 6:00 PM EAT).

• Web: www.patocapital.com/complaints

13.3 Complaint SLA:

• Day 1: Your complaint is logged and an acknowledgement reference is issued within 2 hours.

• Day 3: A Pato Capital officer contacts you with the investigation status.

• Day 30: All complaints are resolved within 30 days as required by Regulation 38 of the NDTCP Regulations, 2026.

13.4 Escalation: If you remain dissatisfied after our final response, you may escalate your complaint to the CBK Consumer Protection Department. Contact details are available on the CBK website at www.centralbank.go.ke.

14. INTELLECTUAL PROPERTY

All content, software, trademarks, trade names, logos, and intellectual property on the Pato Capital Platform are owned by or licensed to Pato Capital Limited. Nothing in these Terms grants you any ownership or licence over Pato Capital's intellectual property beyond a limited, non-exclusive, non-transferable licence to use the Platform for the purposes described in these Terms.

15. LIMITATION OF LIABILITY

15.1 Pato Capital's liability to you in connection with these Terms or any loan product is limited to the extent permitted by Kenyan law.

15.2 Pato Capital is not liable for: losses arising from inaccurate information you provided; losses due to M-Pesa or third-party system outages beyond our reasonable control; or any indirect, consequential, or special damages.

15.3 Pato Capital is not liable for any loss arising from your failure to comply with these Terms or the terms of your Loan Agreement.

16. AMENDMENTS TO THESE TERMS

Pato Capital reserves the right to amend these Terms at any time, subject to the following:

• Material changes will be communicated to you via SMS, in-app notification, or email at least 30 days before they take effect.

• Any change to product pricing or charges requires CBK pre-approval under Regulation 26 of the CBK Digital Credit Providers Regulations, 2022.

• Your continued use of Pato Capital's services after the effective date of amendments constitutes your acceptance of the amended Terms.

• If you do not accept amended Terms, you must stop using the services and repay any outstanding loan in accordance with the original terms.

17. GOVERNING LAW AND JURISDICTION

These Terms are governed by and construed in accordance with the laws of the Republic of Kenya. Any dispute arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of the courts of Kenya. Applicable legislation includes but is not limited to the Non-Deposit Taking Credit Providers Act, 2023; the CBK Digital Credit Providers Regulations, 2022; the NDTCP Regulations, 2026; the Data Protection Act, 2019; the Consumer Protection Act, 2012; the Employment Act, Cap 226; the Electronic Transactions Act, 2017; and the Proceeds of Crime and Anti-Money Laundering Act, 2009.

18. GENERAL PROVISIONS

18.1 Severability: If any provision of these Terms is found to be unlawful, void, or unenforceable, the remaining provisions continue in full force.

18.2 Waiver: Failure by Pato Capital to enforce any provision of these Terms does not constitute a waiver of that provision or any other.

18.3 Entire Agreement: These Terms, together with the Privacy Policy and your Loan Agreement(s), constitute the entire agreement between you and Pato Capital in relation to the subject matter hereof.

18.4 Language: These Terms are in English. In the event of any inconsistency between English and any translated version, the English version prevails.

19. CONTACT INFORMATION

Pato Capital Limited

PO BOX 51957-00100, Nairobi, Kenya

Email: info@patocapital.com

Website: www.patocapital.com

Phone: +254 108 238171

Complaints: www.patocapital.com/complaints

Regulated by the Central Bank of Kenya. CBK Licence No: CBK/DCP/2025/182.

Pato Capital Limited | Borrow Wisely. Grow Steadily. Protect Fully.

PATO CAPITAL LIMITED

PRIVACY POLICY

Version 2.0 | Effective Date: May 2026 | Last Reviewed: May 2026

Issued under the Kenya Data Protection Act, 2019 and the CBK Digital Credit Providers Regulations, 2022

1. INTRODUCTION AND WHO WE ARE

Pato Capital Limited ("Pato Capital", "PCL", "we", "our", "us") is a company incorporated in Kenya and licensed by the Central Bank of Kenya (CBK) as a Digital Credit Provider. We are registered with the Office of the Data Protection Commissioner (ODPC) as a Data Controller and Data Processor in accordance with the Data Protection Act, 2019 (Cap 411C of the Laws of Kenya).

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you interact with our services, mobile application, USSD channels, website, and any other Pato Capital digital platform (collectively, the "Platform"). It applies to all persons who interact with us, including borrowers, partner organisations, agents, fund administration clients, and website visitors.

Contact information for data matters:

• Data Controller: Pato Capital Limited

• Physical address: Nairobi, Kenya (PO BOX 51957-00100)

• Email: info@patocapital.com

• Phone: +254 108 238171

• Website: www.patocapital.com

By using our services, you acknowledge that you have read and understood this Privacy Policy. This Policy forms part of our Terms and Conditions of Use.

2. LEGAL FRAMEWORK AND REGULATORY BASIS

Our data processing activities are conducted in compliance with the following laws and regulations:

• The Data Protection Act, 2019 (Cap 411C) and the Data Protection (General) Regulations, 2021

• The CBK Digital Credit Providers Regulations, 2022

• The Non-Deposit Taking Credit Providers (NDTCP) Regulations, 2026 (gazetted)

• The Electronic Transactions Act, 2017

• The Proceeds of Crime and Anti-Money Laundering Act (POCAMLA), 2009

• The Prevention of Terrorism Act, 2012

• The Credit Reference Bureau Regulations, 2020

We process your personal data on the following legal bases under the Data Protection Act, 2019:

• Consent: Where you have given explicit, informed, and freely given consent to a specific processing purpose.

• Contract performance: Processing necessary for the performance of your loan agreement.

• Legal obligation: Processing required to comply with our obligations under Kenyan law (including KYC, AML/CFT, CRB reporting, and tax obligations).

• Legitimate interests: Processing necessary for our legitimate business interests, where these do not override your fundamental rights and freedoms.

• Vital interests: In exceptional circumstances, to protect interests that are essential for life.

3. DATA PROTECTION PRINCIPLES

Pato Capital is committed to the following data protection principles in all its data processing activities:

4. WHAT PERSONAL DATA WE COLLECT

4.1 Identity and KYC Data

We collect the following identity data to verify your identity and comply with our KYC obligations under POCAMLA and CBK Regulations:

• Full legal name

• National Identity Card number, Passport number, Military ID, or Alien ID

• Date of birth and gender

• Nationality and citizenship

• Marital status

• Residential address (current and historical)

• Photograph or selfie (for biometric matching where applicable)

• Tax Identification Number (TIN/KRA PIN) where required

4.2 Contact Data

• Mobile phone number (M-Pesa registered)

• Email address

• Physical address

• Next of kin or emergency contact (where voluntarily provided)

4.3 Financial and Credit Data

• Bank account details (where applicable for disbursement)

• M-Pesa transaction history (with your consent, used for credit scoring)

• Income information and payslips (for employer-linked products)

• Net disposable income and existing financial obligations

• Credit bureau reports from TransUnion, Metropol, and/or Creditinfo

• Loan application history with Pato Capital

• Repayment history and loan performance data

• Invoice data (face value, buyer, due date) for invoice financing products

• Pension or annuity statement data for pension-backed products

• Insurance policy details and surrender value for insurance-backed products

4.4 Employment and Payroll Data

For employer-linked products (salary advances and check-off loans):

• Employer name and HR/payroll contact

• Employment status, grade, and date of employment

• Gross monthly salary and allowances

• Existing payroll deductions and statutory deductions

• Net salary available for check-off after Two-Thirds Rule computation

4.5 Device and Mobile Data

When you use our mobile application, we may collect (subject to your express consent):

• Device identifier (IMEI or device ID) and operating system version

• Mobile network carrier and signal data

• App usage patterns and session duration

• SMS data: We access relevant SMS messages solely to identify and summarise M-Pesa transaction confirmations for credit scoring. We do not read personal conversations. This consent can be withdrawn at any time through app settings.

• Phone contacts: We may request access to contacts solely to enable you to select a contact when initiating a transaction. We do not upload or store your full contact list on our servers.

• Camera access: To capture photographs for identity verification only.

• Storage access: To enable document upload for loan applications.

4.6 Location Data

We may collect approximate location data (based on network or GPS) to support fraud detection, identity verification, and regulatory compliance. Precise location data is collected only where you have expressly granted location permission in your device settings. You may disable this at any time.

4.7 Fund Administration Client Data

For groups using our Fund Administration service (chamas, SACCOs, employer funds):

• Group name, registration certificate, and constitution

• Names, ID numbers, and contact details of group officials (chairperson, treasurer, secretary)

• Group membership lists and contribution records

• Group financial statements and bank account details

• Individual member loan applications and repayment records

4.8 Data from Third Parties

We may receive data about you from the following third-party sources:

• Credit Reference Bureaus (TransUnion, Metropol, Creditinfo via Peleza or equivalent aggregator)

• IPRS and the National Registration Bureau (for identity verification)

• Your employer (payroll data for employer-linked products)

• Invoice payer or buyer organisations (invoice verification for supply chain financing)

• Pension or annuity administrators (for pension-backed products)

• Insurance companies (for insurance-backed products and policy verification)

• M-Pesa/Safaricom (transaction confirmation data, through Daraja API)

• Fraud detection and AML screening services (including PEP/sanctions screening via Dow Jones or equivalent)

• Government departments and regulatory agencies as legally required

5. HOW WE USE YOUR PERSONAL DATA

We use your personal data for the following purposes, each on the legal basis indicated:

AI and Automated Decision-Making: Pato Capital uses an automated credit scoring model to assess loan applications. In accordance with Regulation 57 of the NDTCP Regulations, 2026, all automated decisions are subject to human oversight by a Credit Officer. You have the right to request a human review of any automated decision and to receive a plain-language explanation of the top factors influencing the decision (top 5 score drivers). We do not use your protected attributes (race, religion, political opinion, ethnic origin, or disability) in credit assessment.

6. HOW WE SHARE YOUR PERSONAL DATA

Pato Capital does not sell your personal data. We share your data only in the following circumstances and with the safeguards described:

6.1 Regulatory and Law Enforcement Authorities

• Central Bank of Kenya (CBK): Monthly loan book returns, NPL reports, product change notifications, and any information required by CBK inspection or inquiry.

• Financial Reporting Centre (FRC): Suspicious Transaction Reports (STRs) filed within the timeframes required by POCAMLA, 2009.

• Office of the Data Protection Commissioner (ODPC): Annual compliance reports, data breach notifications (within 72 hours of discovery), and data subject access responses.

• Kenya Revenue Authority (KRA): Withholding tax remittances, excise duty, and any other tax reporting required by law.

• Courts and law enforcement agencies: In response to valid court orders, subpoenas, or lawful demands.

• Credit Reference Bureaus (CRBs): Positive and negative credit data submitted monthly and on an event-driven basis as required by CRB Regulations.

6.2 Operational Service Providers

• Our technology partner (core lending platform, loan origination, and management system provider): accesses data under a Data Processing Agreement (DPA) and is bound by equivalent data protection standards.

• M-Pesa/Safaricom (Daraja API): For loan disbursement (B2C), repayment collection (STK Push, Paybill), and transaction status queries.

• CRB aggregator (Peleza or equivalent): For CRB bureau queries and data submission.

• IPRS verification provider: For National ID and biometric verification.

• PEP/Sanctions screening provider: For AML watchlist screening (e.g., Dow Jones Risk & Compliance or equivalent).

• SMS gateway and communication provider: For loan notifications, payment reminders, and OTP delivery.

• Cyber insurance provider: As required for insurance coverage of data security incidents.

• Legal counsel and debt collection agents: For enforcement and recovery purposes, limited to data necessary for that purpose.

6.3 Aggregators and Partners

• Employer Aggregators: Where your loan is employer-linked, your employer receives aggregate portfolio data (total outstanding, collection rates) and the minimum individual data necessary to process payroll check-off deductions. Your employer does not receive your full credit profile or CRB data.

• Invoice Buyers/Payers: For invoice financing, the buyer organisation receives only confirmation of invoice assignment and payment instructions.

• Pension Administrators: For pension-backed loans, the administrator receives only the deduction instruction and loan reference.

• Insurance Companies: For insurance-backed loans, the insurer receives the irrevocable assignment documentation and, on default, settlement instructions.

• Fund Administration Clients: Group officials receive aggregated portfolio data for their group's members. Individual member data is shared with group administrators only to the extent necessary and with the member's consent.

6.4 Creditors and Investors

Pato Capital's creditors (lenders of capital to Pato Capital) receive only portfolio-level aggregated data (total deployed, PAR30 metrics, returns). They do not receive individual borrower data, names, or personal information. This boundary is maintained throughout all phases of operations.

6.5 Consent-Based Sharing

Where we seek to share your data for any purpose not covered above, we will obtain your separate, explicit, and freely given consent before doing so, including specifying the purpose, recipient, and duration of the sharing.

7. INTERNATIONAL DATA TRANSFERS

All personal data collected by Pato Capital is stored and processed in Kenya or within the East African Community (EAC) region, in data centres that comply with the data residency requirements of the Data Protection Act, 2019. We do not routinely transfer personal data outside Kenya.

In the event that any transfer of personal data outside Kenya becomes necessary, we will ensure compliance with Section 49 of the Data Protection Act, 2019, including:

• Transferring only to jurisdictions with equivalent data protection laws.

• Implementing appropriate safeguards (such as Standard Contractual Clauses or binding corporate rules).

• Notifying the ODPC as required.

• Obtaining your explicit consent to the transfer where required.

8. DATA RETENTION

We retain your personal data for the periods set out below, after which data is securely deleted, anonymised, or archived in a form that no longer identifies you:

9. YOUR DATA RIGHTS UNDER THE DATA PROTECTION ACT, 2019

As a data subject, you have the following rights under the Data Protection Act, 2019. You may exercise any of these rights by contacting us at info@patocapital.com or through the in-app privacy settings:

9.1 Right to Access (Section 26, DPA 2019)

You have the right to request confirmation of whether we process your personal data and to receive a copy of that data. We will respond within 21 days. The first request is free; reasonable fees may apply for repeat requests.

9.2 Right to Rectification (Section 26, DPA 2019)

You have the right to request correction of inaccurate or incomplete personal data. We will update records and, where required, notify relevant third parties (including CRBs) of corrections.

9.3 Right to Erasure (Right to be Forgotten) (Section 26, DPA 2019)

You may request deletion of your personal data where it is no longer necessary for the purpose collected, or where consent is withdrawn and no other legal basis applies. Note that we cannot delete data we are legally required to retain (such as KYC records under POCAMLA or CRB data under CRB Regulations). We will inform you of any limitations on erasure.

9.4 Right to Object (Section 26, DPA 2019)

You have the right to object to processing based on legitimate interests, including direct marketing. Where you object to direct marketing, we will stop processing for that purpose immediately. Where you object to other processing on legitimate interests grounds, we will assess whether our interests override your rights and respond within 21 days.

9.5 Right to Restrict Processing

You may request restriction of processing in certain circumstances, such as while the accuracy of data is being contested or where processing is unlawful but you prefer restriction to erasure.

9.6 Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.

9.7 Rights Related to Automated Decision-Making

In accordance with Regulation 57 of the NDTCP Regulations, 2026, you have the right to: request a human review of any automated credit decision; receive an explanation of the main factors (top 5 drivers) that influenced the decision; and contest any automated decision that significantly affects your credit access.

9.8 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time by adjusting your app settings or contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal or your obligations under existing Loan Agreements.

9.9 Right to Lodge a Complaint with the ODPC

If you believe we have violated your data rights, you may lodge a complaint with the Office of the Data Protection Commissioner. Contact: Office of the Data Protection Commissioner, Nairobi, Kenya. Website: www.odpc.go.ke. Email: info@odpc.go.ke.

10. DATA SECURITY

Pato Capital implements the following technical and organisational security measures to protect your personal data:

• Encryption at rest: AES-256 encryption for all personal and financial data stored in our systems.

• Encryption in transit: TLS 1.3 for all API communications between systems and users.

• Role-Based Access Control (RBAC): Data is accessible only to authorised staff on a need-to-know basis.

• Multi-Factor Authentication (MFA): Required for all privileged system access.

• Audit logging: All data access, modification, and export events are logged with user ID, timestamp, and IP address. Logs are immutable and retained for 7 years.

• Column-level encryption: Sensitive fields (National ID numbers, payment details) use additional encryption with keys rotated quarterly.

• Password management: Passwords are hashed using Argon2 and are never stored in plain text.

• Penetration testing: Pato Capital conducts periodic security assessments and penetration tests by independent third parties.

• Data centre controls: All data is hosted in Kenya or EAC-region data centres with physical access controls.

• Cyber insurance: Pato Capital maintains appropriate cyber insurance coverage.

• Business continuity: Recovery Point Objective (RPO) of 4 hours and Recovery Time Objective (RTO) of 2 hours.

Data breach response: In the event of a personal data breach, Pato Capital will notify the ODPC within 72 hours of discovery and notify affected individuals within 7 days where the breach is likely to result in a risk to their rights and freedoms.

11. COOKIES AND TRACKING TECHNOLOGIES

Our website (www.patocapital.com) and mobile application may use the following tracking technologies:

11.1 Cookies

Session cookies are used to maintain your login session and application state. These are essential for the Platform to function and cannot be disabled. Preference cookies remember your language and display settings. Analytics cookies (where your consent is obtained) help us understand how users interact with our Platform to improve the user experience. You may manage cookie preferences through your browser settings, noting that disabling essential cookies may impair Platform functionality.

11.2 App Analytics

Where you have provided consent, we may use analytics tools to analyse usage patterns within the mobile application. All analytics data is anonymised or pseudonymised before use in reporting. We do not permit third-party advertisers to place tracking technologies on our Platform or in our application.

11.3 Do-Not-Track

Our website currently does not respond to browser Do-Not-Track (DNT) signals, as there is no universal standard for these signals in Kenya. We will update this position if a standard is established and legally required.

12. CHILDREN'S DATA

Pato Capital's services are not directed at, and we do not knowingly collect personal data from, persons under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will delete that data immediately. If you believe we have collected data from a minor, please contact us at info@patocapital.com.

13. CONSENT MANAGEMENT AND GRANULARITY

Pato Capital operates a granular consent model. Each data-sharing relationship requires separate, specific consent. You may grant or withdraw consent for each of the following independently:

• M-Pesa SMS read access for credit scoring

• Contact list access for transaction facilitation

• Location data collection

• Push notifications

• Marketing communications from Pato Capital

• Data sharing with employer (for check-off products)

• Credit bureau enquiry and reporting

Consent management is available through your account settings in the Pato Capital mobile application. Withdrawal of consent for certain categories (e.g., IPRS verification) will affect your eligibility for credit products, as we cannot assess or approve loans without completing required identity verification.

14. SOCIAL MEDIA AND THIRD-PARTY DATA

Pato Capital does not scrape, harvest, or process data from your personal social media profiles or those of your contacts. Customers may voluntarily provide links to business social media pages solely to verify business activity for certain product types. We do not collect social media friends, likes, followers, behavioural data, or personal contacts from social media platforms.

Where our Platform contains links to third-party websites or services, please note that we are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access.

15. CHANGES TO THIS PRIVACY POLICY

Pato Capital reserves the right to update this Privacy Policy at any time to reflect changes in law, regulation, business practices, or technology. We will notify you of material changes by:

• SMS notification to your registered mobile number.

• In-app notification with a summary of changes.

• Updating the "Last Reviewed" date at the top of this document.

Your continued use of our services after the effective date of changes constitutes acceptance of the updated Policy. If you do not accept the updated Policy, please contact us to discuss your options, including account closure.

The Privacy Policy is reviewed at least annually by Pato Capital's Data Protection Officer and legal counsel, and updated as required by the ODPC or CBK.

16. HOW TO CONTACT US

For any data protection matters, including to exercise your rights, report a data breach, or raise concerns about how we handle your data:

• Email: info@patocapital.com

• Phone: +254 108 238171 (Monday to Friday, 8:00 AM to 6:00 PM EAT)

• Web: www.patocapital.com

• Post: Pato Capital Limited, PO BOX 51957-00100, Nairobi, Kenya

We aim to respond to all data-related requests within 21 days. For urgent matters (such as data breaches or safety concerns), we will respond as soon as practically possible.

If you remain dissatisfied with our response, you may contact the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.