Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Aventus Technologies Ltd, which owns the digital lending platform Lendplus, was found liable for violating the provisions of the DPA19. The company failed to implement appropriate technical measures to ensure privacy by design and by default, thereby failing to protect the privacy of the Complainant.

Facts

Aventus Technologies Ltd are the proprietor of the digital lending platform, Lendplus

The Complainant, Daniel Ndambuki, accuses the Respondent of calling him incessantly over a debt that he did not know about and which was extended by the Respondent to a third party.

He alleges that the Complainant has continued to call him over the debt notwithstanding his repeated request to them not to do so.

The Respondents alleged that their system request a person to confirm acceptance to be a contact person through a prompt (pop up message) sent to their phone. Further the contacts became colour coded once the request was accepted. The contacts would subsequently be used when the borrower defaulted on the loan and could not be traced.

The ODPC found that:

• there was no evidence that the Respondent collected data directly from the Complainant, and knowing the Third-party is not consent.
• The Complainant was not informed of the fact of the collection or use of his personal data.
• No evidence through appropriate logs of the pop up message sent to the Complainant or colour change in the system.
• Further log IDs of the events/transactions in question were not similar or aligned in the Complainant's system.
• The Complainant further misrepresented the dates the confirmations were allegedly made by the Complainant.