FinControl Group · Corporate platform
Privacy policy
1. Operator and scope
The Fonland Operations workspace is provided by SIA “FIN CONTROL GROUP” (FinControl Group), a Latvian company, registration number 42103075251. Registered address: Ganību iela 191–18, Liepāja, LV-3407, Latvia. Correspondence address: Zigfrīda Annas Meierovica bulvāris 16, Rīga, LV-1050, Latvia. Contact: office@fincontrolgroup.com.
This is a corporate work platform for Fonland and its authorised employees and service team. It supports Weekly payments, Downpayments and Backoffice operations. It is not a public customer portal, a loan application service or a general consumer privacy notice for Fonland’s financial products.
FinControl Group is responsible for operating and securing the platform and for the account, support and security information it uses for those purposes. For payment and customer information entered on Fonland’s behalf, Fonland determines the business purpose and instructions; FinControl Group provides processing and operational support under the relevant service arrangements. A platform-provider role does not transfer all of Fonland’s responsibilities for its underlying business records to FinControl Group.
2. Information processed
| Category | Operational use |
|---|---|
| Business account email, verified identity and configured profile details | Identify the employee or service account and apply access permissions. |
| Membership identifiers, membership state and member type for designated Google Chat spaces; resulting module eligibility | Verify eligibility for Weekly, Downpayments or Backoffice when Chat-based access is enabled. Other basic member fields may be returned by Google but are not needed for this access decision. |
| Transaction references, amounts, phone numbers where supplied, customer or loan identifiers, assignment instructions, reasons and operational comments | Submit, review, clarify and record payment-administration requests on Fonland’s instructions. |
| Request IDs, outcomes, timestamps and underlying staff identities in restricted audit records | Maintain accountability, investigate errors and support authorised reporting. |
| Session and diagnostic information, including network and request metadata recorded by the hosting infrastructure | Maintain sign-in, diagnose faults and protect availability and security. |
Business records are supplied by authorised users. Account identity and membership results come from Google, and technical records are generated through use of the service. Do not include passwords, authentication codes, API credentials, unrelated personal details or unnecessary sensitive information in a request.
3. Purposes and access to records
Information is used to deliver the contracted business service, apply appropriate access, process and clarify requests, maintain an audit trail, provide support, prevent misuse and meet applicable legal and accounting requirements. Where a particular activity requires consent or another lawful basis, that requirement must be met; signing in is not blanket consent to unrelated uses.
Requesters access records allowed for their account. Authorised Payment Team staff process operational work and authorised administrators manage configuration and inspect the private audit trail. Payment staff are displayed to requesters as Payment Team. The label conceals staff names in the requester-facing interface; it does not make the recorded actions anonymous to authorised administrators.
4. Google account and Chat permissions
The separate Chat membership integration requests openid, email and https://www.googleapis.com/auth/chat.memberships.readonly. Identity permissions verify the account authorising the integration; read-only membership access checks whether a person belongs to the designated Weekly, Downpayments and Backoffice spaces.
The Chat grant is provided by an authorised Fonland integration account. Individual users’ sign-in identity and that integration grant have different purposes. No user is asked to give the platform their Google password.
The membership integration does not request Gmail or Drive access, permission to read Chat conversations, or permission to add or remove Chat members. Google’s granted scope can cover spaces accessible to the authorising account, but the application check is limited to the three designated operational spaces. Membership information is not used for credit scoring, loan eligibility or payment decisions.
Membership decisions are briefly cached to reduce repeated API calls. The prepared checker keeps positive results for at most 60 seconds, so a membership change may not be reflected immediately. External access and membership enforcement must be activated and verified separately; publication of this notice does not enable them.
Google user data is not sold or used for advertising, data-broker services, surveillance or training general-purpose AI models. Its use and any transfer are limited to providing the disclosed service, necessary security/support work or legal requirements. The service’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable.
5. Service providers and Chat notifications
Google Cloud supplies hosting and data-storage infrastructure. Google identity services and Google Chat process information needed for sign-in and membership verification. Access by authorised support providers is limited to what is necessary for their service, security or legal responsibilities.
Where operational Chat notifications are enabled, selected request details and links can be sent through incoming webhooks to the designated Fonland spaces. Members of the receiving space can read the notification even if the application restricts their access to the associated individual request. Administrators must choose notification content and space membership accordingly.
Information may be disclosed to competent authorities where legally required or to authorised advisers where necessary to address a legal or security matter. It is not made public through these information pages. Identifiable Google data is not made available for unrestricted human review; any necessary access is limited to the purposes permitted by the Google policy and applicable law.
6. Location and protection
The initial operational market is Kenya. The platform is operated by a Latvian provider using Google Cloud infrastructure; operational services are deployed in Google Cloud’s Belgium region, europe-west1. Provider support and Google identity or Chat processing can involve other locations. This is not a Kenya-only data-hosting commitment.
The applicable service arrangements must address processing instructions, confidentiality, relevant service providers and any required international-transfer safeguards. This notice is not a substitute for those contractual arrangements and does not claim that a regulator has approved them.
Company-specific records, server-side permissions, restricted administrative access, encrypted transport and protected secret storage support platform security. Authorisation credentials are not intended to appear in public pages, browser responses, source control or request comments. No system can guarantee absolute security; report suspected compromise promptly.
7. Retention and deletion
Information is kept for the period necessary for its recorded business purpose and applicable accounting, legal, regulatory, security or dispute-resolution requirements. Client records are handled in accordance with the relevant service arrangements and lawful client instructions. There is no single automatic deletion period for every record type.
Operational requests, audit events, diagnostic logs, backups, cached membership results and authorisation credentials have different purposes. Completing a request, clearing an access cache or revoking a Google grant does not itself erase payment or audit records. Where retention is no longer justified, deletion or de-identification should be arranged through the administrator, including the applicable backup lifecycle.
Deletion requests are reviewed for identity, authority and any obligation to retain particular records. FinControl Group will coordinate requests concerning Fonland’s underlying business records with the responsible Fonland administrator. Legal restrictions on a request will be explained where applicable.
8. Requests, corrections and complaints
Depending on the processing and applicable law, you may request information about and access to your personal data, correction, deletion, restriction or objection, and portability where available. A request may require identity verification and is subject to applicable legal exceptions.
For platform privacy matters contact office@fincontrolgroup.com. For Fonland request-content or employee-access matters contact payments_team@fonlend.co.ke. We will route a request to the appropriate responsible organisation rather than treat the platform as the originator of every client record.
You may also complain to the relevant data-protection authority, including Kenya’s Office of the Data Protection Commissioner or Latvia’s Data State Inspectorate, where within their jurisdiction.
9. Revoking Google access
The authorising account can review or revoke the integration grant in Google Account connections. The administrator should also disable the integration and remove its stored grant when it is no longer required. A previously issued access token or short membership cache may remain usable briefly; revocation is not a deletion request for previously recorded business data.
10. Cookies and changes
The sign-in infrastructure may use essential authentication cookies. These public information pages do not load advertising, analytics trackers, external fonts or third-party scripts. External websites have their own privacy practices.
This notice will be updated if platform practices change. Material new uses of Google data must be disclosed before they begin, with renewed permission where required. The effective date appears at the top of the page.