Data Retention

Purpose

This statement explains how long Dush Finance keeps personal data after you apply for or receive a loan. It supports our obligations to the Bank of Uganda, Uganda Revenue Authority (URA), and NITA-U registration.

Active loan period

While your loan is active (including application, approval, disbursement and repayment), we retain all data needed to service the facility, run collections, and meet regulatory reporting.

After closure

After a loan is closed (fully repaid, written off, or otherwise terminated), we typically retain:

• Loan agreement, schedules, and repayment records — 7 years
• KYC and identity verification artefacts — 7 years
• Consent records (including IP and policy version) — 7 years
• Collateral and SIMPO-related records — 7 years or longer if URA rules require
• Staff audit and compliance logs — generally 7 years

Communications

Marketing messages honour your opt-out. Transactional SMS, email and in-app notices related to an active obligation may continue until the loan is closed.

Deletion

When retention periods expire, data is deleted or anonymised unless a legal hold, dispute, or regulator request requires longer storage. Contact dpo@dush-finance.com to request erasure where the law allows.

Backups

Encrypted backups may persist for a limited period after deletion from live systems. Backups are destroyed on the same retention schedule where technically feasible.