Umoja Send Privacy Policy

COMPLETE UNABRIDGED VERSION

Effective Date: September 22, 2026 • Last Updated: September 22, 2026

This Policy applies solely to Umoja Send. It is a Product Supplement to the Umoja Send Terms and Conditions and, through those terms, to the Umoja Pay Terms and Conditions

Currently viewing: 1. Introduction, Purpose, and Status of This Policy

1. Introduction, Purpose, and Status of This Policy
2. Relationship to Other Umoja Documentation
3. Definitions and Rules of Interpretation
4. Who We Are: Controllers, Processors, and Group Structure
5. Scope: Whose Data This Policy Covers
6. Categories of Personal Data We Collect
7. Sources From Which We Collect Personal Data
8. Purposes of Processing and Legal Bases
9. Special Category and Biometric Data
10. Automated Decision-Making and Profiling
11. How and With Whom We Share Personal Data
12. Sub-Processors and Categories of Recipients
13. Cross-Border and International Data Transfers
14. Data Retention and Deletion
15. Data Security
16. Personal Data Breach Notification
17. Your Rights as a Data Subject
18. Jurisdiction-Specific Terms and Additional Rights
19. Cookies, SDKs, and Similar Tracking Technologies
20. Children’s Privacy
21. Marketing and Communications Preferences
22. Third-Party Websites, Services, and Integrations
23. Data Protection Officer, Privacy Contact, and Representatives
24. Complaints and Supervisory Authorities
25. Changes to This Privacy Policy
26. Miscellaneous and General Provisions
27. Governing Law and Jurisdiction
28. Contact Information
Annex A: Data Retention Schedule

1. Introduction, Purpose, and Status of This Policy
2. Relationship to Other Umoja Documentation
3. Definitions and Rules of Interpretation
4. Who We Are: Controllers, Processors, and Group Structure
5. Scope: Whose Data This Policy Covers
6. Categories of Personal Data We Collect
7. Sources From Which We Collect Personal Data
8. Purposes of Processing and Legal Bases
9. Special Category and Biometric Data
10. Automated Decision-Making and Profiling
11. How and With Whom We Share Personal Data
12. Sub-Processors and Categories of Recipients
13. Cross-Border and International Data Transfers
14. Data Retention and Deletion
15. Data Security
16. Personal Data Breach Notification
17. Your Rights as a Data Subject
18. Jurisdiction-Specific Terms and Additional Rights
19. Cookies, SDKs, and Similar Tracking Technologies
20. Children’s Privacy
21. Marketing and Communications Preferences
22. Third-Party Websites, Services, and Integrations
23. Data Protection Officer, Privacy Contact, and Representatives
24. Complaints and Supervisory Authorities
25. Changes to This Privacy Policy
26. Miscellaneous and General Provisions
27. Governing Law and Jurisdiction
28. Contact Information
Annex A: Data Retention Schedule

1. Introduction, Purpose, and Status of This Policy

1.1 This Umoja Send Privacy Policy (this “Policy”) sets out, in detail, how the Umoja Group collects, uses, discloses, retains, transfers, and otherwise Processes Personal Data in connection with the design, provision, operation, marketing, and support of the Services. It is intended to provide a comprehensive and transparent account of our data-processing practices sufficient to satisfy the notice and transparency obligations imposed on us under Applicable Law across the multiple Corridors and jurisdictions in which the Services are, or may in the future be, offered.

1.2 This Policy is drafted to apply, with the jurisdiction-specific modifications and additional rights set out in Section 18 and Annex C, to users and other Data Subjects located in, or whose Personal Data is Processed in connection with, any Corridor in which the Services are made available, including without limitation Kenya, Ghana, Rwanda, Nigeria, Tanzania, and such further African and non-African markets as Umoja may from time to time enable, as well as users in the European Economic Area, the United Kingdom, and the United States who interact with the Services, for example as diaspora Senders.

1.3 This Policy is a general, group-wide instrument. Where a Country Annex, Product Supplement, or Corridor-specific privacy disclosure has been published for a particular market, Corridor, or product, that Country Annex or Product Supplement supplements this Policy and, to the extent of any direct conflict, prevails over this Policy solely in relation to the matters it expressly addresses for that market, Corridor, or product.

1.4 This Policy does not, of itself, create third-party rights enforceable by any person other than the Data Subject to whom the relevant Personal Data relates, save to the extent that Applicable Law provides otherwise.

2. Relationship to Other Umoja Documentation

2.1 This Policy applies solely to Umoja Send. It is incorporated by reference into, and forms part of, the Umoja Send Terms and Conditions (the “Send Terms”), which are themselves issued as a product supplement under the Umoja Pay Terms and Conditions (the “General Terms”). This Policy should accordingly be read together with the Send Terms, the General Terms, and any Country Annex applicable to you. This Policy does not describe, and should not be relied upon as a description of, the data-processing practices of UmojaPay, the UMC Credit System, or any other Umoja Group product or service, each of which is addressed in its own privacy notice.

2.2 Capitalised terms used but not defined in this Policy have the meanings given to them in the General Terms or the Send Terms, as the context requires. In the event of any inconsistency between this Policy and the General Terms or the Send Terms as to the treatment of Personal Data specifically, this Policy prevails to the extent of that inconsistency; in all other respects, the General Terms and the Send Terms continue to apply according to their terms.

2.3 By creating an Account, completing identity verification, submitting a Send Request, initiating or accepting a Transfer, or otherwise accessing or using any part of the Services, you acknowledge that you have been given a reasonable opportunity to read this Policy and that your Personal Data will be Processed as described in it.

3. Definitions and Rules of Interpretation

3.1 Defined Terms

For the purposes of this Policy, the following terms have the meanings set out below. Terms defined in the singular include the plural and vice versa, unless the context requires otherwise.

Account means your registered user account with Umoja through which you access the Services.

Agent means a person or entity authorised to provide cash-in, cash-out, or collection services on behalf of a Sending Partner or Receiving Partner.

Applicable Law means all statutes, regulations, statutory instruments, binding regulatory guidance, and rules of any competent authority applicable to Umoja, a Sending Partner, a Receiving Partner, a Sub-Processor, or the relevant Corridor, including, where applicable, data-protection, AML, sanctions, and payment-services law.

Automated Decision-Making means a decision based solely on automated Processing, including Profiling, which produces legal effects concerning a Data Subject or similarly significantly affects them.

Consent means any freely given, specific, informed, and unambiguous indication of a Data Subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the Processing of Personal Data relating to them.

Controller means the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

Corridor means a supported combination of a sending country or region and a receiving country or region through which a Transfer may be executed.

Cross-Border Transfer means any transfer of Personal Data from one jurisdiction to another, including a transfer to a Sub-Processor, Group Company, or Umoja-hosted system located outside the jurisdiction in which the Personal Data was originally collected.

Data Subject means an identified or identifiable natural person to whom Personal Data relates, including a Sender, Recipient, Agent, or other individual whose Personal Data we Process in connection with the Services.

General Terms means the Umoja Pay Terms and Conditions, as amended from time to time.

Group Company means Umoja Global Limited, London, UK, UmojaTech Inc., and any other entity that directly or indirectly Controls, is Controlled by, or is under common Control with Umoja Global Limited, London, UK.

Parent Company means Umoja Global Limited, London, UK, the ultimate parent company of the Umoja Group.

Personal Data means any information relating to an identified or identifiable natural person, including identifiers such as a name, identification number, location data, or online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, Personal Data transmitted, stored, or otherwise Processed.

Processing means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, transmission, dissemination, restriction, erasure, or destruction.

Processor means a natural or legal person which Processes Personal Data on behalf of a Controller.

Profiling means any form of automated Processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s economic situation, personal preferences, interests, reliability, behaviour, location, or movements.

Receiving Partner means the licensed payment institution, bank, mobile money operator, or other regulated or authorised entity responsible for disbursing funds to a Recipient in the receiving Corridor.

Recipient means the individual or entity designated to receive funds through a Transfer; for the purposes of this Policy the term also bears its data-protection meaning of a natural or legal person to which Personal Data is disclosed, as the context requires.

Send Request means a request initiated by a user through Umoja Send asking a permitted Sender to provide funds, and the corresponding instruction to transfer those funds to a Recipient.

Sender means the individual identified as the source of funds for a Transfer, whether initiating the Transfer directly or responding to a Send Request.

Send Terms means the Umoja Send Terms and Conditions, as amended from time to time.

Sending Partner means the licensed payment institution, bank, mobile money operator, card scheme, or other regulated or authorised entity responsible for collecting or debiting funds from a Sender.

Services means Umoja Send, the remittance and funds-transfer service described in the Send Terms, including the Send Request, Transfer, and Recipient-management functionality made available through the Umoja platform. Where a Transfer is funded from a Sender’s Umoja Wallet, the Services include the Processing of the Sender’s available UMC Credit balance strictly to the extent necessary to fund that Transfer, but the Services do not otherwise extend to UmojaPay, the UMC Credit System generally, or any other Umoja Group product, which are addressed in their own privacy notices.

Special Category Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the Processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, and any equivalent category of sensitive personal data recognised under Applicable Law.

Standard Contractual Clauses means the standard data-protection clauses adopted or approved by the European Commission, the UK Information Commissioner’s Office, or another competent authority for the purposes of enabling Cross-Border Transfers, as updated or replaced from time to time.

Sub-Processor means a Processor engaged by Umoja or another Processor to carry out specific Processing activities on behalf of a Controller.

Supervisory Authority means an independent public authority responsible for monitoring the application of data-protection law in the relevant jurisdiction.

Transfer means a completed or in-progress movement of funds from a Sender to a Recipient facilitated through Umoja Send; for the purposes of this Policy the term “data transfer” or “Cross-Border Transfer” is used where the context concerns Personal Data rather than funds.

Verified Recipient means a Recipient who has successfully completed the applicable identity-verification process described in the Send Terms.

3.2 Rules of Interpretation

3.2.1 References to “we,” “us,” “our,” or “Umoja” are references to the Umoja Group entity or entities responsible, as Controller or, where applicable, Processor, for the Processing of your Personal Data in connection with the Services you use, as further described in Section 4.

3.2.2 The words “include,” “includes,” and “including” are to be construed as if followed by the words “without limitation,” and general words are not to be given a restrictive meaning by reason of their being preceded or followed by words indicating a particular class of acts, matters, or things.

3.2.3 Section headings are inserted for convenience of reference only and do not affect the interpretation of this Policy.

3.2.4 A reference to “writing” or “written” includes communication by electronic means, including email and in-app notification, unless otherwise specified.

3.2.5 References to statutes, regulations, or other legal instruments include any amendment, re-enactment, or replacement of them from time to time.

4. Who We Are: Controllers, Processors, and Group Structure

4.1 The Umoja Group is led by Umoja Global Limited, London, UK, the Parent Company of the Umoja Group, and comprises UmojaTech Inc. and such other Group Companies as may, from time to time, own, operate, provide, support, or facilitate the Services in the relevant market or Corridor. Umoja Send is made available under the Umoja brand and the related UmojaSend product brand. This Policy does not cover UmojaPay, the UMC Credit System, or any other Umoja Group product or service, except to the extent that the Services expressly rely on them to fund a Transfer as described in the definition of Services in Section 3.1.

4.2 For the purposes of the current offering, and except as otherwise disclosed in a Country Annex, UmojaTech Inc., a company incorporated in the Republic of Panama under Folio 155783364, with its registered office at 55th Street East, SL55 Building, 21st Floor, Office 3, Panama City, Republic of Panama, acts as the operating entity and the Controller responsible for determining the purposes and means of Processing Personal Data collected through the Services, under the oversight of its Parent Company, Umoja Global Limited, London, UK.

4.3 Where a Sending Partner, Receiving Partner, Agent, or other regulated third party independently determines the purposes and means of Processing your Personal Data (for example, in performing statutory identity verification required of it under its own licence, or in disbursing funds under its own regulatory mandate), that entity acts as an independent Controller in that respect, and its own privacy notice governs its Processing of your Personal Data in that capacity, in addition to, and without limiting, this Policy.

4.4 Certain Group Companies, including Umoja Global Limited, London, UK in its capacity as Parent Company, and Sub-Processors, act as Processors on behalf of UmojaTech Inc. in providing technical infrastructure, hosting, group-level compliance oversight, customer support tooling, and similar functions. Umoja remains responsible, as Controller, for Processing carried out by its Processors in accordance with its instructions and Applicable Law.

4.5 Where a Country Annex identifies a different Group Company, licensed local entity, or joint Controller as responsible for Processing in a particular Corridor, that Country Annex controls for the purposes of identifying the responsible party in that Corridor, and references in this Policy to Umoja as Controller should be read as references to the entity so identified.

5. Scope: Whose Data This Policy Covers

5.1 This Policy applies to Personal Data we Process in relation to:

registered users of the Services, whether acting as a Sender, Recipient, or in another capacity;

individuals identified as a Recipient or counterparty by a user, including where that individual has not themselves registered an Account;

Agents and individuals associated with an Agent, to the extent Umoja Processes their Personal Data in connection with the Services;

prospective users who apply for, or express interest in, the Services, including through waitlists, promotional sign-ups, or pilot programmes;

visitors to Umoja’s websites, applications, and digital properties; and

individuals who contact Umoja’s customer support, complaints, or legal channels, whether or not they are users of the Services.

5.2 This Policy does not apply to Personal Data Processed by Umoja in its capacity as an employer in relation to its own personnel, which is addressed in separate internal policies, nor, except as expressly stated, to the independent Processing activities of a Sending Partner, Receiving Partner, or Agent acting as an independent Controller as described in Section 4.3.

6. Categories of Personal Data We Collect

We collect and Process the following categories of Personal Data. The specific data collected from a given Data Subject will depend on the Service used, the Data Subject’s role (Sender, Recipient, or Agent), Account tier, Corridor, and Applicable Law, and not every category will apply to every Data Subject.

6.1 Identity Data

Full legal name, former or alternative names, date and place of birth, nationality and citizenship, gender, government-issued identification numbers (such as national identity card, passport, driver’s licence, or tax identification numbers), copies or scans of identity documents, photographs, and signature.

6.2 Contact Data

Postal and residential address, email address, telephone and mobile numbers, and preferred means and language of communication.

6.3 Biometric and Verification Data

Facial images and facial geometry templates captured for liveness detection and document-to-selfie matching; voice data, where voice-based verification or support channels are used; and other biometric identifiers used to verify identity, together with the outcome, score, or flag generated by an identity-verification or biometric-matching provider. Biometric data used to uniquely identify a natural person constitutes Special Category Data and is addressed further in Section 9.

6.4 Financial and Account Data

Bank account and payment card details, mobile money account identifiers, source-of-funds and source-of-wealth information, UMC Credit balances, wallet identifiers, and information about your financial circumstances collected for enhanced due diligence or credit and risk-assessment purposes where applicable.

6.5 Transaction Data

Details of Send Requests, Transfers, and other transactions, including amounts, currencies, exchange rates, Fees, Corridors, counterparties, timestamps, transaction references, and records of transaction status, holds, declines, or reversals.

6.6 Relationship and Counterparty Data

Information about the stated relationship, connection, or purpose underlying a Transfer or Send Request as between a Sender and Recipient, including supporting information provided for compliance, fraud-prevention, or transaction-monitoring purposes as described in the Send Terms.

6.7 Device, Technical, and Usage Data

Internet Protocol address, device identifiers and fingerprints, operating system and version, browser type and settings, mobile network and carrier information, application version, log-in timestamps, session data, crash and diagnostic logs, and analytics regarding your use of the Services.

6.8 Location Data

Approximate location derived from IP address, and, where you have granted permission through your device settings, precise geolocation data, used for purposes including fraud prevention, Corridor eligibility, and regulatory compliance.

6.9 Communications Data

Records of correspondence with Umoja’s customer support, complaints, and legal teams, including the content of emails, in-app messages, and chat transcripts, and, where legally permitted and disclosed to you at the time, recordings of telephone calls.

6.10 Marketing and Preference Data

Your marketing preferences and consent status, records of your interaction with marketing communications, and your responses to surveys or feedback requests.

6.11 Data Concerning Other Individuals

Where you provide Personal Data about another individual (for example, as a Recipient’s contact details in connection with a Send Request), you are responsible for ensuring that you have the necessary authority and, where required by Applicable Law, that individual’s consent, to provide that Personal Data to Umoja, and for informing that individual of the Processing described in this Policy or directing them to it.

6.12 Data From Third Parties and Public Sources

Information received from Sending Partners, Receiving Partners, Agents, identity-verification and biometric-KYC providers, sanctions and AML screening providers, credit reference agencies, fraud-prevention consortia, and publicly available sources, including sanctions and politically exposed persons lists and adverse media.

7. Sources From Which We Collect Personal Data

We collect Personal Data: (a) directly from you, including when you register an Account, complete identity verification, initiate or respond to a Send Request, contact customer support, or otherwise interact with the Services; (b) automatically, through your use of our applications and websites, including via cookies and similar technologies described in Section 19; (c) from Sending Partners, Receiving Partners, and Agents involved in a Transfer; (d) from identity-verification, biometric, sanctions-screening, and fraud-prevention Service Providers; and (e) from publicly available sources and, where lawful, from third parties such as credit reference agencies.

8. Purposes of Processing and Legal Bases

The table below sets out, for each principal purpose of Processing, representative examples of the Processing activities involved and the legal basis or bases on which we ordinarily rely under the General Data Protection Regulation (“GDPR”)-equivalent framework applied by this Policy as a baseline standard. Where Applicable Law in your jurisdiction characterises legal bases differently, Section 18 and the applicable Country Annex govern, and this table is to be read as an illustrative cross-reference rather than an exhaustive statement of the position under every Applicable Law.

Purpose	Representative Processing Activities	Legal Basis
Account creation and administration	Registering and maintaining your Account, authenticating log-ins, managing settings	Performance of a contract
Identity verification and onboarding (KYC)	Verifying identity documents, biometric liveness and matching checks, screening against watchlists	Legal obligation; substantial public interest (AML); consent (biometric)
Processing Send Requests and Transfers	Calculating Fees and exchange rates, instructing Sending/Receiving Partners, disbursement	Performance of a contract
Compliance, AML, and sanctions screening	Transaction monitoring, sanctions and PEP screening, suspicious-activity reporting	Legal obligation
Fraud prevention and platform security	Device fingerprinting, anomaly detection, risk scoring, account-takeover prevention	Legitimate interests
Customer support and complaints handling	Responding to enquiries, investigating and resolving disputes	Performance of a contract; legitimate interests
Product development and analytics	Aggregated usage analysis, A/B testing, service improvement	Legitimate interests
Marketing communications	Sending product updates, offers, and research invitations	Consent, where required by Applicable Law; otherwise legitimate interests
Legal, regulatory, and audit obligations	Record-keeping, responding to regulator and law-enforcement requests, statutory reporting	Legal obligation
Establishing, exercising, or defending legal claims	Litigation, arbitration, and regulatory proceedings	Legitimate interests; legal obligation

9. Special Category and Biometric Data

9.1 The identity-verification processes used in connection with the Services involve the Processing of biometric data (in particular, facial geometry derived from a live selfie capture, compared against the photograph on a government-issued identity document) for the purpose of uniquely identifying you. This constitutes Special Category Data under the GDPR-equivalent standard applied by this Policy and equivalent sensitive-personal-data categories under other Applicable Law.

9.2 We Process biometric data for identity verification on the basis of: (a) your explicit Consent, obtained before the relevant verification step, which you may withdraw prospectively at the cost of being unable to complete verification and, consequently, to access the affected feature of the Services; and/or (b) where Consent is not the applicable basis under Applicable Law, on the basis that the Processing is necessary for reasons of substantial public interest in the prevention of financial crime, money laundering, and terrorist financing, on a basis proportionate to that aim and subject to appropriate safeguards, including the measures described in Section 15.

9.3 Biometric templates generated for identity verification are Processed by specialised identity-verification and biometric-KYC Service Providers engaged by Umoja under contractual terms requiring appropriate technical and organisational security measures, purpose limitation, and retention consistent with Section 14 and Annex A. Biometric templates are not used for any purpose other than identity verification, fraud prevention, and associated compliance obligations, and are not used to derive racial, ethnic, health, or other inferences beyond what is strictly necessary for those purposes.

9.4 We do not otherwise seek to collect Special Category Data, such as data concerning health, religious belief, or political opinion, and you should not include such information in free-text fields, support communications, or elsewhere unless specifically requested and necessary, for example where you disclose a disability to request a reasonable accommodation in using the Services.

10. Automated Decision-Making and Profiling

10.1 We use automated tools, including risk-scoring, device-fingerprinting, and transaction-monitoring systems, to support identity verification, fraud prevention, and sanctions and AML screening. These tools may produce a decision to delay, hold, restrict, or decline a Send Request, Transfer, or Account action, including without human review in the first instance, where necessary to meet time-critical compliance or fraud-prevention requirements.

10.2 Where a decision described in Section 10.1 is based solely on Automated Decision-Making and produces a legal effect concerning you or similarly significantly affects you, you have the right, subject to Applicable Law and any applicable exemption (including exemptions necessary for compliance with AML and sanctions obligations), to: (a) obtain human intervention and review of the decision; (b) express your point of view; and (c) contest the decision, in each case by contacting us using the details in Section 28.

10.3 We periodically review the logic, significance, and consequences of our automated risk-scoring and screening models to seek to ensure they remain accurate, proportionate, and free from unlawful bias, without prejudice to the confidentiality of the underlying methodology, which we withhold to the extent necessary to prevent circumvention of our fraud-prevention and compliance controls.

11. How and With Whom We Share Personal Data

We do not sell Personal Data to third parties for monetary consideration. We disclose Personal Data only as reasonably necessary for the purposes described in this Policy, and, where required by Applicable Law, under contractual terms imposing confidentiality, purpose limitation, and security obligations on the recipient. We may share Personal Data with the following categories of recipients:

11.1 Sending Partners, Receiving Partners, and Agents

To collect or debit funds from a Sender, disburse funds to a Recipient, or provide cash-in or cash-out services, we share the Personal Data reasonably necessary to execute the relevant Transfer, including identity, contact, financial, and transaction data.

11.2 Identity-Verification, Biometric, and Compliance Service Providers

We engage specialised Service Providers to perform identity-document verification, biometric liveness and matching checks, and sanctions, AML, and adverse-media screening. These providers Process Personal Data, including Special Category Data described in Section 9, as Processors acting on our instructions, or, where required by their own regulatory status, as independent Controllers in respect of statutory checks they are separately required to perform.

11.3 Digital-Asset Infrastructure and Custody Providers

Where a Transfer is funded from your Umoja Wallet, we share the minimum Personal Data necessary with infrastructure and institutional custody providers to operate the wallet, execute the on-platform funding step, and maintain the integrity of the UMC Credit balance used to fund that Transfer.

11.4 Cloud Hosting, IT, and Analytics Providers

We use reputable cloud-hosting, data-storage, customer-relationship-management, communications, and analytics providers to operate the Services, each engaged under data-processing terms consistent with Section 15.

11.5 Group Companies

We share Personal Data among Group Companies for Account administration, compliance, risk management, customer support, and coordinated service delivery across markets, subject to this Policy and, where applicable, an intra-group data-transfer agreement incorporating the Standard Contractual Clauses or an equivalent safeguard.

11.6 Regulators, Law Enforcement, and Courts

We disclose Personal Data to regulators, tax authorities, law-enforcement agencies, and courts or tribunals where required by Applicable Law, a valid court order, or a lawful regulatory request, or where we reasonably believe disclosure is necessary to prevent harm, fraud, or a breach of Applicable Law.

11.7 Professional Advisers and Insurers

We share Personal Data with our auditors, external legal counsel, and insurers to the extent reasonably necessary for the provision of their services to us, subject to confidentiality obligations.

11.8 Corporate Transactions

In connection with a proposed or actual merger, acquisition, reorganisation, financing, or sale of some or all of Umoja’s business or assets, we may disclose Personal Data to prospective or actual counterparties and their advisers, subject to appropriate confidentiality protections, and will notify affected Data Subjects where required by Applicable Law if their Personal Data becomes subject to a different privacy policy as a result.

11.9 With Your Consent or at Your Direction

We may share Personal Data with other third parties where you have given Consent or otherwise directed us to do so, for example where you use a third-party application that integrates with the Services.

12. Sub-Processors and Categories of Recipients

Annex B lists, by functional category, the types of Sub-Processors and recipients we engage to support the Services. We maintain an up-to-date register of specific Sub-Processors and will make it available on request to the extent required by Applicable Law or by a data-processing agreement to which we are a party. We impose written contractual terms on each Sub-Processor requiring, at a minimum, confidentiality, purpose limitation, appropriate technical and organisational security measures, cooperation with audits to the extent required by Applicable Law, and provisions governing Cross-Border Transfer consistent with Section 13. We remain responsible for our Sub-Processors’ compliance with these obligations to the extent required by Applicable Law.

13. Cross-Border and International Data Transfers

13.1 Because the Services are provided across multiple Corridors and rely on Service Providers and infrastructure located in various jurisdictions, Personal Data may be transferred to, stored in, and Processed in countries other than the country in which you reside or in which the Personal Data was originally collected, including countries that may not have been assessed as providing an equivalent level of data protection.

13.2 Where we make a Cross-Border Transfer of Personal Data originating from a jurisdiction whose Applicable Law restricts such transfers absent an appropriate safeguard, we rely, as applicable and available, on one or more of the following mechanisms: (a) a determination by the competent authority that the receiving jurisdiction ensures an adequate level of protection; (b) the Standard Contractual Clauses or another form of legally recognised standard data-protection clauses, together with a transfer risk assessment where required; (c) binding corporate rules, where adopted; (d) approved codes of conduct or certification mechanisms, where available; or (e) a derogation permitted under Applicable Law for the specific situation, such as your explicit Consent to the proposed transfer after having been informed of the possible risks, or the necessity of the transfer for the performance of a contract with you, including the execution of a cross-border Transfer that you have requested.

13.3 Where Applicable Law in a particular Corridor imposes specific cross-border data-transfer requirements (for example, requirements to obtain regulatory approval, to maintain a local copy of certain data, or to satisfy a locally defined adequacy or safeguard standard), we comply with those requirements as set out in the applicable Country Annex, which forms part of, and should be read together with, this Section 13.

13.4 You may request further information about the safeguards applicable to a specific Cross-Border Transfer of your Personal Data by contacting us using the details in Section 28.

14. Data Retention and Deletion

14.1 We retain Personal Data for no longer than is necessary for the purposes for which it was collected, taking into account the need to satisfy Applicable Law (including AML and payment-services record-keeping obligations, which commonly require retention of transaction and identity-verification records for a minimum period, typically five years, following the end of the business relationship or the date of the relevant transaction, subject to variation under Applicable Law in the relevant Corridor), to resolve disputes, to enforce our agreements, and to establish, exercise, or defend legal claims.

14.2 Indicative retention periods by category of Personal Data are set out in Annex A. Actual retention periods may vary where a longer period is required by Applicable Law in a specific Corridor, where Personal Data is subject to a legal hold in connection with actual or anticipated litigation, investigation, or regulatory proceedings, or where a shorter period is required following a valid erasure request that is not subject to an applicable exemption.

14.3 Upon expiry of the applicable retention period, we securely delete, anonymise, or irreversibly aggregate the relevant Personal Data in accordance with our internal data-retention and disposal procedures, save to the extent that anonymised or aggregated data, from which you are no longer identifiable, may be retained indefinitely for statistical, research, or product-development purposes.

15. Data Security

15.1 We maintain a written information-security programme comprising administrative, technical, and physical safeguards designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access, proportionate to the nature, scope, context, and purposes of Processing and the risk to Data Subjects.

15.2 Without limitation, our safeguards include, as applicable and appropriate to the relevant system: encryption of Personal Data in transit and, where appropriate, at rest; role-based access controls and the principle of least privilege; multi-factor authentication for privileged access; network segmentation and firewalling; logging and monitoring of access to systems holding Personal Data; regular vulnerability assessment and penetration testing; secure software-development practices; vendor and Sub-Processor security due diligence; and periodic staff training on data protection and information security.

15.3 No method of electronic transmission or storage is completely secure, and we cannot guarantee the absolute security of Personal Data. You are responsible for maintaining the confidentiality of your Account credentials, for using a strong and unique password, and for promptly notifying us of any suspected unauthorised access to, or use of, your Account through the channels described in Section 28.

16. Personal Data Breach Notification

16.1 We maintain an incident-response process designed to detect, investigate, contain, and remediate a Personal Data Breach without undue delay.

16.2 Where required by Applicable Law, we will notify the competent Supervisory Authority of a Personal Data Breach within the timeframe prescribed by that Applicable Law (which is commonly, though not universally, seventy-two hours of becoming aware of the breach), unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

16.3 Where a Personal Data Breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, describing in plain language the nature of the breach, its likely consequences, the measures taken or proposed to address it, and recommended steps you may take to protect yourself, except where an applicable exemption under Applicable Law applies, such as where we have implemented measures rendering the affected Personal Data unintelligible (for example, encryption) or where notification would require disproportionate effort, in which case we will use a public communication or similar measure instead.

17. Your Rights as a Data Subject

Subject to Applicable Law and the exemptions, restrictions, and qualifications set out in this Section and elsewhere in this Policy, you have the following rights in relation to your Personal Data. The precise scope, conditions, and response timeframes for these rights vary by jurisdiction and are further addressed in Section 18 and Annex C; the following is a consolidated, GDPR-equivalent baseline description.

17.1 Right of Access

You may request confirmation of whether we Process your Personal Data and, where we do, access to that Personal Data together with specified supplementary information, including the purposes of Processing, the categories of Personal Data concerned, the recipients or categories of recipients, and, where possible, the envisaged retention period.

17.2 Right to Rectification

You may request that we correct inaccurate Personal Data concerning you or complete incomplete Personal Data, including by means of providing a supplementary statement.

17.3 Right to Erasure (“Right to Be Forgotten”)

You may request erasure of your Personal Data where, among other grounds, it is no longer necessary for the purposes for which it was collected, you withdraw Consent on which the Processing was based and no other legal basis applies, or the Processing is otherwise unlawful. This right does not apply to the extent that Processing is necessary for compliance with a legal obligation (including AML and payment-services record-keeping obligations described in Section 14), or for the establishment, exercise, or defence of legal claims.

17.4 Right to Restriction of Processing

You may request that we restrict Processing of your Personal Data in specified circumstances, including while the accuracy of the data is contested or while we assess whether our legitimate grounds override an objection made under Section 17.6.

17.5 Right to Data Portability

Where the legal basis for Processing is Consent or performance of a contract and the Processing is carried out by automated means, you may request to receive the Personal Data you have provided to us in a structured, commonly used, and machine-readable format, and, where technically feasible, to have that data transmitted directly to another controller.

17.6 Right to Object

You may object, on grounds relating to your particular situation, to Processing of your Personal Data based on legitimate interests, including Profiling based on those provisions. You may object at any time, without needing to demonstrate particular grounds, to Processing for direct-marketing purposes, including related Profiling, and we will cease such Processing upon receipt of your objection.

17.7 Rights Related to Automated Decision-Making

As described in Section 10, you have the right not to be subject to a decision based solely on Automated Decision-Making that produces legal or similarly significant effects, subject to applicable exemptions, and, where an exemption applies, the right to obtain human intervention, to express your point of view, and to contest the decision.

17.8 Right to Withdraw Consent

Where Processing is based on Consent, you may withdraw that Consent at any time, without affecting the lawfulness of Processing based on Consent before its withdrawal, and without prejudice to Processing that continues to be lawful on another legal basis, such as compliance with a legal obligation.

17.9 Right to Lodge a Complaint

You have the right to lodge a complaint with the competent Supervisory Authority in your habitual residence, place of work, or the place of the alleged infringement, as further identified in Annex C, without prejudice to any other administrative or judicial remedy available under Applicable Law.

17.10 Exercising Your Rights

To exercise any of the rights described in this Section, please contact us using the details in Section 28. We will respond to a verified request without undue delay and, save where a longer period is permitted by Applicable Law, within one calendar month of receipt, which period we may extend by a further two calendar months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and the reasons for the delay within the initial one-month period. We do not ordinarily charge a fee to respond to a request, save where permitted by Applicable Law in the case of manifestly unfounded, excessive, or repetitive requests, in which case we may charge a reasonable administrative fee or decline to act on the request. We may request additional information reasonably necessary to confirm your identity before responding to a request.

18. Jurisdiction-Specific Terms and Additional Rights

This Section sets out additional, jurisdiction-specific terms that apply to you where you are located in, or your Personal Data is otherwise subject to the data-protection law of, the jurisdictions listed below. Where a specific provision of this Section conflicts with the general provisions of this Policy, the provision in this Section prevails for Data Subjects in the relevant jurisdiction. This Section is provided on a best-efforts basis as a summary of key additional obligations and does not purport to be an exhaustive statement of local law, which may change from time to time.

18.1 Kenya

Where you are located in Kenya, Processing of your Personal Data is additionally subject to the Data Protection Act, 2019 and its subsidiary regulations. You have the rights described in Section 17 as recognised under that Act, and you may lodge a complaint with the Office of the Data Protection Commissioner. Where required, we will register or notify our Processing activities with the Data Protection Commissioner and will only transfer Personal Data outside Kenya where an adequate level of protection is demonstrated or another lawful transfer ground under the Act applies.

18.2 Ghana

Where you are located in Ghana, Processing of your Personal Data is additionally subject to the Data Protection Act, 2012 (Act 843). You may exercise the rights described in Section 17 to the extent recognised under that Act and may lodge a complaint with the Data Protection Commission. Where required by the Act, Umoja or the applicable local entity will register as a data controller with the Data Protection Commission.

18.3 Rwanda

Where you are located in Rwanda, Processing of your Personal Data is additionally subject to Law No. 058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy. You may exercise the rights described in Section 17 to the extent recognised under that law and may lodge a complaint with the National Cyber Security Authority or such other supervisory body as may be designated from time to time. Cross-border transfers of Personal Data from Rwanda are made subject to the conditions prescribed by that law, including, where applicable, demonstration of an adequate level of protection in the receiving country or use of an approved safeguard.

18.4 Nigeria

Where you are located in Nigeria, Processing of your Personal Data is additionally subject to the Nigeria Data Protection Act, 2023 and any subsidiary regulations issued by the Nigeria Data Protection Commission. You may exercise the rights described in Section 17 to the extent recognised under that Act and may lodge a complaint with the Nigeria Data Protection Commission. Where the Act’s registration or filing obligations apply to Umoja as a data controller of major importance, Umoja or the applicable local entity will comply with those obligations, including as to the conduct of data-protection impact assessments and the cross-border transfer requirements prescribed by the Act.

18.5 Tanzania

Where you are located in Tanzania, Processing of your Personal Data is additionally subject to the Personal Data Protection Act, 2022 and its regulations. You may exercise the rights described in Section 17 to the extent recognised under that Act and may lodge a complaint with the Personal Data Protection Commission. Registration of Umoja or the applicable local entity as a data collector or data controller will be undertaken where required by the Act.

18.6 European Economic Area and United Kingdom

Where you are located in the European Economic Area or the United Kingdom (for example, as a diaspora Sender), Processing of your Personal Data is additionally subject to the GDPR and, in the United Kingdom, the UK GDPR and the Data Protection Act 2018. In addition to the rights described in Section 17, you may lodge a complaint with your local Supervisory Authority or, in the United Kingdom, the Information Commissioner’s Office. Where required by Article 27 of the GDPR or the equivalent UK provision, Umoja will designate a representative in the European Union or the United Kingdom, details of which will be made available through the contact channels in Section 28 or a dedicated Country Annex.

18.7 United States (California)

Where you are a California resident, this Section supplements the rest of this Policy as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). We do not sell or share (as those terms are defined under the CCPA) your personal information for cross-context behavioural advertising. You have the right to know the categories and specific pieces of personal information we have collected about you, the right to request deletion of your personal information (subject to statutory exceptions, including for AML and payment-services record-keeping), the right to correct inaccurate personal information, the right to limit the use of sensitive personal information, and the right to non-discrimination for exercising any of these rights. You may exercise these rights using the contact details in Section 28; we will verify your request before responding and will not require you to create an account to do so.

18.8 Other Jurisdictions

Where you are located in a jurisdiction not specifically addressed in this Section, the general provisions of this Policy apply, together with any additional or different rights, obligations, or protections mandated by the Applicable Law of that jurisdiction, whether or not expressly stated in this Policy. Umoja will publish a Country Annex addressing a particular jurisdiction’s requirements as and when the Services are formally launched in that jurisdiction.

19. Cookies, SDKs, and Similar Tracking Technologies

19.1 We and our Service Providers use cookies, mobile software development kits (“SDKs”), pixels, and similar technologies (together, “Tracking Technologies”) in connection with our websites and applications for the purposes described below.

19.1 Categories of Tracking Technologies

Strictly necessary: required for core functionality, such as authentication, session management, and security; cannot be disabled without affecting the operation of the Services.

Functional: remember your preferences, such as language or display settings.

Analytics and performance: help us understand how the Services are used, diagnose performance issues, and improve functionality.

Marketing and advertising: used, where enabled and permitted, to measure the effectiveness of marketing campaigns; we do not use these to sell or share personal information for cross-context behavioural advertising as described in Section 18.7.

19.2 Managing Your Preferences

Where required by Applicable Law, we present a cookie or tracking-preference banner or in-app control allowing you to accept or reject non-essential Tracking Technologies. You may also control cookies through your browser or device settings, including by blocking or deleting cookies, although doing so may affect the functionality of the Services. Where required by Applicable Law, we honour recognised opt-out preference signals to the extent technically supported.

20. Children's Privacy

The Services are not directed to, and are not intended for use by, individuals under the minimum age required to hold an Account under Applicable Law in the relevant Corridor, which is in no event lower than the age of thirteen. We do not knowingly collect Personal Data from a child below the applicable minimum age. If we become aware that we have collected Personal Data from a child in violation of this Policy, we will take reasonable steps to delete that data promptly and to terminate any associated Account, and a parent or guardian who believes we have inadvertently collected such data may contact us using the details in Section 28 to request deletion.

21. Marketing and Communications Preferences

21.1 Where permitted by Applicable Law, we may send you information about Umoja products, features, promotions, or research opportunities by email, SMS, push notification, or other electronic means.

21.2 You may opt out of marketing communications at any time using the unsubscribe mechanism included in the relevant communication, through your Account settings, or by contacting us using the details in Section 28. Opting out of marketing communications does not affect our ability to send you transactional or service communications that are necessary for the operation of your Account and the Services, such as security alerts, transaction confirmations, and notices of changes to this Policy or the General Terms or Send Terms.

22. Third-Party Websites, Services, and Integrations

The Services may contain links to, or integrations or interoperate with, third-party websites, applications, application programming interfaces, or services that are not owned or controlled by Umoja, including Sending Partners’ and Receiving Partners’ own digital channels. This Policy does not apply to the privacy practices of any such third party, and we encourage you to review the applicable privacy notice of any third-party service before providing Personal Data to it or through it.

23. Data Protection Officer, Privacy Contact, and Representatives

23.1 We have appointed a privacy contact point responsible for overseeing questions in relation to this Policy and, where required by Applicable Law, a formally designated Data Protection Officer. You may contact our privacy team using the details in Section 28.

23.2 Where required by Applicable Law, we will designate a local representative in a jurisdiction in which we do not have an establishment, including, where applicable, a representative in the European Union or the United Kingdom as referenced in Section 18.6, details of which will be made available through the contact channels in Section 28 or a dedicated Country Annex.

24. Complaints and Supervisory Authorities

If you have a concern about our Processing of your Personal Data, we encourage you to contact us first using the details in Section 28 so that we may attempt to resolve your concern directly. This does not affect your right to lodge a complaint at any time with the competent Supervisory Authority for your jurisdiction, a non-exhaustive list of which is set out in Annex C, or to seek judicial remedy, without prejudice to the dispute-resolution provisions of the General Terms and the Send Terms, which apply to disputes generally and do not limit your non-waivable rights to make a complaint to, or seek redress from, a competent regulatory or governmental authority.

25. Changes to This Privacy Policy

We may amend this Policy from time to time to reflect changes in our practices, the Services, the jurisdictions in which the Services are offered, or Applicable Law. We will post the updated Policy with a revised “Last Updated” date and, where the change is material or required by Applicable Law, provide additional notice, which may include in-app notification, email, or a requirement that you affirmatively acknowledge the updated Policy before continuing to use the Services. Your continued use of the Services after the effective date of an updated Policy constitutes acceptance of the update to the extent permitted by Applicable Law; where Applicable Law requires your affirmative Consent to a material change, we will seek that Consent before the change takes effect as to you.

26. Miscellaneous and General Provisions

26.1 Severability. If any provision of this Policy is held by a court or Supervisory Authority of competent jurisdiction to be invalid, illegal, or unenforceable, that provision will be severed from the remainder of this Policy, which will otherwise remain in full force and effect, and the parties (or, as applicable, Umoja and the Data Subject) will negotiate in good faith to replace the invalid provision with a valid provision that most closely reflects the original intent.

26.2 No Waiver. No failure or delay by Umoja in exercising any right under this Policy operates as a waiver of that right, nor does any single or partial exercise of a right preclude any other or further exercise of that right or the exercise of any other right.

26.3 Assignment. Umoja may transfer or assign its rights and obligations under this Policy, including the Personal Data held by it as Controller, to a Group Company or to a successor in interest in connection with a merger, acquisition, reorganisation, or sale of assets, subject to Section 11.8 and Applicable Law.

26.4 Language. This Policy is drafted in English. Where a translated version is made available for convenience in a particular Corridor, the English-language version prevails in the event of any inconsistency, except where Applicable Law in that Corridor requires the local-language version to prevail.

26.5 Survival. The provisions of this Policy that by their nature should survive termination of your Account or cessation of your use of the Services (including those relating to data retention, security, cross-border transfer, liability, and dispute resolution), survive any such termination or cessation.

26.6 Notices. Any notice we are required to give you under this Policy will be given by the means described in the General Terms, including in-app notification, email to your registered address, or posting within the Services.

26.7 Entire Understanding on Privacy Matters. This Policy, together with any applicable Country Annex or Product Supplement, constitutes the entire understanding between you and Umoja regarding the Processing of your Personal Data in connection with the Services and supersedes any prior privacy notice issued by Umoja in relation to the Services, without prejudice to the General Terms and the Send Terms, which continue to govern the Services generally.

27. Governing Law and Jurisdiction

This Policy is governed by the laws of the Republic of Panama, consistent with the governing-law provisions of the General Terms, without prejudice to: (a) any mandatory data-protection or consumer-protection rights available to you under the Applicable Law of the jurisdiction in which the Services are provided or in which you reside, which are not excluded or limited by this Section; and (b) the dispute-resolution provisions of the General Terms and the Send Terms, including the requirement to attempt good-faith resolution through Umoja’s complaints procedure before referring an unresolved dispute to arbitration, which apply to disputes arising under this Policy save to the extent Applicable Law provides a non-waivable right to pursue a complaint, regulatory review, mediation, adjudication, or proceedings before a court or other competent authority.

28. Contact Information

Privacy and Data Protection Queries:

Email: privacy@umojacoin.com

Address: 55th Street East, SL55 Building, 21st Floor, Office 3, Panama City, Republic of Panama.

Customer Support / Complaints:

Email: support@umojacoin.com

Address: 55th Street East, SL55 Building, 21st Floor, Office 3, Panama City, Republic of Panama.

Formal Legal Notices:

Email: legal@umojacoin.com

Address: 55th Street East, SL55 Building, 21st Floor, Office 3, Panama City, Republic of Panama.

Annex A: Data Retention Schedule

The following schedule sets out indicative retention periods by category of Personal Data. Actual periods may vary as described in Section 14.

Category of Personal Data	Indicative Retention Period	Basis
Identity and verification data (including biometric templates)	Duration of relationship plus 5 years (or longer if required by Applicable Law in the relevant Corridor)	AML/KYC record-keeping obligations
Transaction data	Duration of relationship plus 5 years	AML/payment-services record-keeping obligations
Account and profile data	Duration of relationship plus 1 year following account closure	Legitimate interests; dispute resolution
Communications with customer support	3 years from the date of the last communication	Legitimate interests; dispute resolution
Marketing preference and consent records	Duration of relationship plus 2 years, or until consent is withdrawn	Legal obligation to evidence consent; legitimate interests
Device, technical, and usage data	Up to 18 months, or longer where aggregated/anonymised	Legitimate interests; security
Data subject access, rectification, and erasure request records	3 years from the date of the request	Legal obligation; accountability
Data relevant to an actual or anticipated legal claim or regulatory investigation	Until final resolution of the matter plus the applicable limitation period	Legitimate interests; legal obligation

Annex B: Categories of Sub-Processors and Recipients

The following table describes, by functional category, the types of Sub-Processors and recipients engaged in connection with the Services. This Annex describes categories of processing function rather than naming every current vendor; an up-to-date vendor-specific register is available on request as described in Section 12.

Category	Function	Location(s) (Representative)
Identity verification and biometric KYC	Document verification, liveness detection, facial-match scoring	Relevant Corridor jurisdictions
Sanctions, AML, and adverse-media screening	Watchlist and PEP screening, transaction monitoring	Relevant Corridor jurisdictions
Digital-asset infrastructure and custody	Ledger infrastructure, institutional digital-asset custody	Relevant Corridor jurisdictions
Cloud hosting and infrastructure	Application hosting, data storage, backups	Multiple regions, with regional hosting options where required
Customer engagement and support tooling	Ticketing, live chat, email delivery	Relevant Corridor jurisdictions
Analytics and product tooling	Usage analytics, crash reporting, A/B testing	Relevant Corridor jurisdictions
Sending/Receiving Partners and Agents	Collection and disbursement of funds	Relevant Corridor jurisdictions

Annex C: Jurisdiction-Specific Supervisory Authorities

The following is a non-exhaustive list of Supervisory Authorities that may be relevant depending on your location. This list is provided for convenience and does not limit your right to contact any other competent authority under Applicable Law.

Jurisdiction	Supervisory Authority
Kenya	Office of the Data Protection Commissioner
Ghana	Data Protection Commission
Rwanda	National Cyber Security Authority (or successor designated body)
Nigeria	Nigeria Data Protection Commission
Tanzania	Personal Data Protection Commission
United Kingdom	Information Commissioner’s Office
European Economic Area	The Supervisory Authority of your EU/EEA member state of habitual residence
United States (California)	California Privacy Protection Agency