Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

David Owuor and two others sued Ceres Tech (Rocketpesa) for sending unsolicited promotional messages urging them to take loans without consent or an opt-out option. The ODPC found the Respondent liable for violating data rights. The company received an Enforcement Notice and was ordered to pay the Complainants compensation.

Facts

The Office of the Data Protection Commissioner (the Office or ODPC) received three complaints from David Owuor (1st Complainant), Dennis Mwenda (2nd Complainant), and Richard Abongo (3rd Complainant). The complaints were filed on 10th October 2023, 10th October 2023, and 7th November 2023, respectively, against Ceres Tech Limited (the Respondent), which is a digital credit provider lending money through its mobile application 'Rocketpesa'.

The specific allegations made by the Complainants were:

• 1st Complainant (David Owuor): Alleged he had been receiving promotional messages and calls from the Respondent despite having not registered with them or given his contact. He stated he had contacted them to request them to stop, but they continued sending the promotional messages and calls. He provided screenshots of the messages as proof.
• 2nd Complainant (Dennis Mwenda): Alleged he had been receiving unsolicited messages from different phone numbers claiming to be the Respondent’s representatives and urging him to take a loan. He further stated he had blocked their SMS and calls, but the SMS were still getting through. He also provided screenshots of messages sent to him by the Respondent.
• 3rd Complainant (Richard Abongo): Alleged that he had been receiving unsolicited promotional messages from the Respondent’s agents about the loan app called Rocketpesa without his subscription or consent. He provided screenshots of the messages sent to him by the Respondent as proof.

The Respondent, Ceres Tech Limited, provided its response via two letters, both dated 4th December 2023.

The Respondent's main points were:

• 1st and 2nd Complainants: In response to the complaints filed by the 1st and 2nd Complainants, the Respondent stated that it had carried out thorough investigations and found no evidence that its company sent the messages in question.
• 3rd Complainant: In response to the complaint filed by the 3rd Complainant, the Respondent vehemently disputed the allegations that unsolicited messages were disseminated by its marketers.
• The Respondent stated that its internal investigations revealed that its marketing team strictly adheres to established protocols, including the implementation of measures to prevent the transmission of unsolicited messages.