This document outlines how we process your personal data in accordance with GDPR and applicable Papua New Guinea data-protection requirements. The legal team will fill in the definitive content here; this skeleton sets out the structure.
1. Who we are
Handy Finance Limited (the "controller") is responsible for the personal data you provide to us. Our registered office and contact details for privacy enquiries will be listed here.
2. What data we collect
We collect identity data (name, date of birth, NRC/NID number, passport), contact data (email, mobile, address), employment and income details, banking information, KYC documents you upload, references you provide, and information about your loan applications, accounts, and payments.
3. Lawful basis for processing
We process your data on the basis of: (a) the contract for any loan you take with us, (b) our legal obligations under PNG financial regulations, (c) our legitimate interests in fraud prevention and credit assessment, and (d) your explicit consent for KYC processing, credit-bureau checks, and any marketing communications.
4. How we share your data
We share data with credit bureaus (with your consent), regulators, payment processors, and approved partners where strictly necessary. We do not sell your data.
5. Retention
Loan records are retained for a minimum of 7 years after the loan is closed, as required by PNG financial regulations. Other personal data is retained only as long as necessary for the purposes described.
6. Your rights
You have the right to access, correct, port, or (subject to our retention obligations) erase your personal data, and to object to or restrict processing. You can exercise these rights through the My Privacy & Data page once logged in.
7. Contact
For privacy enquiries please contact our Data Protection Officer at the address listed in section 1.