Umoja Send Privacy Policy | How We Handle Your Data

COMPLETE UNABRIDGED VERSION

Effective Date: October 23, 2026 • Last Updated: October 23, 2026

Umoja Coin Privacy Policy

1. Introduction and scope

1.1 This Website Privacy Policy (the “Policy”) explains how UmojaTech Inc. collects, uses, shares, transfers, stores and protects personal data when you visit https://umojacoin.com and its subdomains (the “Website”), join our waitlist, contact us, chat with us, attend an event we promote on the Website, interact with our official social media pages, apply for a role through the Website or report a security issue to us. It also explains your privacy rights and how to use them.

1.2This Policy covers the Website only. It does not describe how personal data is handled when you use Umoja Send, Umoja Pay, UMC Credits or any other product (each a “Product”). Products involve additional processing, such as identity verification, transaction monitoring and payment processing, which is explained in each Product’s own privacy notice. That notice is shown to you before you start using the Product and is available on request from support@umojacoin.com.

1.3 Capitalised terms that we do not define here have the meaning given in our Website Terms of Use (Terms and Conditions). In this Policy, “personal data” means any information relating to an identified or identifiable individual, and includes “personal information” as defined in some laws.

1.41.4 This Policy is written to meet the transparency requirements of the laws listed in Section 15, including the EU and UK General Data Protection Regulations, Panama’s Law 81 of 2019 and the data protection laws of the African countries where we expect to operate.

At a glance

Question	Short answer
Who is responsible?	UmojaTech Inc., Panama, a subsidiary of Umoja Global Limited, London
What do we collect?	Your email address if you join the waitlist, what you tell us when you contact us, and technical data about your visit
Do we sell your data?	No. We do not sell or rent personal data, and we do not use advertising or cross-site tracking cookies on the Website
Who do we share it with?	Our parent company, carefully selected service providers, professional advisers and, where the law requires, authorities
Where is it processed?	In Panama, the United Kingdom, the United States, the European Union and other countries where our providers operate, with safeguards in place
How long do we keep it?	Only as long as we need it; for example, waitlist data for up to 24 months of inactivity (Section 11)
What are your rights?	Access, correction, deletion, restriction, portability, objection, withdrawal of consent and complaint (Section 14)
How do you contact us?	legal@umojacoin.com for privacy, support@umojacoin.com for general help

2. Who we are and how to contact us

2.1 Controller. UmojaTech Inc., a sociedad anónima incorporated in the Republic of Panama and registered with the Public Registry of Panama under Folio 155783364, with its registered office at 55th Street East, SL55 Building, 21st Floor, Office 3, Panama City, Republic of Panama (“UmojaTech”, “we”, “us” or “our”), is the controller of the personal data described in this Policy. This means we decide why and how it is processed and are responsible for it.

2.2 Parent company. UmojaTech Inc. is a wholly owned subsidiary of Umoja Global Limited, a private limited company based in London, United Kingdom (“Umoja Global”). Umoja Global sets group-wide privacy, information-security, risk and compliance standards and oversees how UmojaTech Inc. applies them. Where Umoja Global processes Website data on our behalf, for example for group administration, security monitoring, internal audit or compliance oversight, it acts as our processor under an intra-group data processing and transfer agreement. Where Umoja Global uses aggregated or de-identified Website information for its own group reporting, it does not identify you.

2.3 Umoja Group. “Umoja Group” means Umoja Global Limited, UmojaTech Inc. and any entity that controls, is controlled by or is under common control with Umoja Global Limited.

2.4 Privacy contact. Our legal team is responsible for overseeing questions about this Policy and handling privacy requests. You can contact them at legal@umojacoin.com or by post at the address in Section 2.1, marked “For the attention of the Legal Team (Privacy)”.

2.5 Representatives and officers. Where the law of a country requires us to appoint a data protection officer, a local representative (for example under Article 27 of the EU or UK GDPR) or to register with a data protection authority, we will do so and publish the relevant details in this Section.

3. Personal data we collect

3.1 We collect only the personal data we need for the purposes in Section 5. The table below sets out each category, what it includes and when we collect it.

Category	What it includes	When we collect it
Identity and contact data	Name, email address, telephone number (optional), country of residence, preferred language, organisation and job title (optional)	When you join the waitlist, fill in a form, email us, chat with us or register for an event
Waitlist data	Email address; date and time of sign-up; the page and campaign you signed up from; confirmation status; any preferences, Products or countries of interest you select; any waitlist position or referral code	When you join, confirm or update your waitlist place
Consent records	What you consented to, the wording and version of the notice you saw, the date and time, your IP address and browser at the time, and any later withdrawal	When you give, change or withdraw consent
Enquiry and correspondence data	The content of your messages, attachments, subject lines, our replies, and the date, time and channel of each message	When you contact us by form, email, live chat, social media or post
Live chat and support data	Chat transcripts, name and email if given, ticket references, satisfaction ratings, and device and session identifiers used to run the chat	When you use live chat or the help centre
Technical and device data	IP address; approximate location (country, region and city derived from the IP address); browser type and version; operating system; device type, model and screen size; language and time-zone settings; referring URL; pages viewed; links clicked; time spent; date and time of visits; error, performance and security logs	Automatically, when you use the Website
Cookie and similar identifiers	Cookie identifiers, consent identifiers and analytics client identifiers	When cookies are set, as described in our Website Cookie Policy
Marketing and preference data	Your subscription status, communication preferences and, if you consented to analytics, whether you opened our emails or clicked their links	When you subscribe, unsubscribe or interact with our emails
Feedback, survey and research data	Your answers, ratings, comments and, if you take part in user research, recordings or notes of the session with your consent	When you choose to respond or take part
Event data	Event registrations, attendance, dietary or accessibility requirements you choose to tell us, and questions you ask	When you register for or attend an event we promote
Security report data	Your name and contact details if given, details and evidence of the issue you report, and our correspondence with you	When you report a vulnerability or suspected fraud
Fraud and abuse data	Signals that indicate bots, fake or duplicate sign-ups, impersonation or misuse, such as IP reputation, request patterns and disposable-email indicators	Automatically, and when others report misuse to us
Recruitment data	Your CV, cover letter, work history, qualifications, right-to-work information, references and interview notes	If you apply for a role through the Website
Business contact data	Name, organisation, role, business email and telephone number, and the content of our dealings	If you contact us as a journalist, partner, supplier or investor
Social media data	Your public profile name and handle, and messages, comments or mentions you direct to our official accounts	When you interact with our official social media pages

3.2 Sensitive data. We do not ask for, and do not intentionally collect, special category or sensitive personal data through the Website, such as data about racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, health, sex life or sexual orientation, genetic or biometric data, or criminal convictions and offences. Please do not include this kind of information in forms, chat or emails. If you tell us about an accessibility or dietary need for an event, we use it only to meet that need, with your explicit consent, and delete it after the event. If we receive sensitive data we did not ask for, we delete it unless we have a lawful reason to keep it.

3.3 Financial and identity data. We do not collect bank account details, card numbers, identity documents, selfies or biometric data through the Website. Identity verification and payments happen only inside Products, under their own privacy notices. We will never ask for your password, PIN, full card number or one-time code through the Website.

3.4 Information about other people. If you give us personal data about someone else (for example a colleague or a person you refer), you must have their authority to do so and must make sure they know about this Policy.

3.5 If you do not provide data. Most information is optional. If you do not give us an email address, we cannot add you to the waitlist; if you do not give us contact details, we may not be able to reply to your enquiry.

4. Where we get personal data from

4.1 We collect personal data from the following sources:

Directly from you, when you fill in forms, join the waitlist, contact us, chat with us, respond to surveys, register for events, apply for a role or report an issue.

Automatically, from your device and browser when you use the Website, including through cookies and similar technologies (see our Website Cookie Policy) and server logs.

From our service providers, such as our hosting, security, form, email delivery, analytics and live-chat providers, who collect data on our behalf.

From Umoja Group companies, for example where Umoja Global Limited passes us an enquiry about the Website that you sent to it.

From third parties, such as people who refer you to us, event co-organisers, recruitment agencies, fraud-prevention and IP-reputation services, and social media platforms when you interact with our pages.

From public sources, such as public social media profiles, company registers and news media, where relevant to a business or press contact or to investigating impersonation.

5. How we use your personal data and our legal bases

5.1 Where data protection law requires us to have a legal basis for using your personal data, we rely on one or more of the following: your consent; the need to take steps at your request before entering into a contract, or to perform a contract; our compliance with a legal obligation; and our legitimate interests, or those of a third party, where these are not overridden by your interests or fundamental rights. Section 15 explains where local law uses different bases.

Purpose	What we do	Data used	Legal basis
Run the waitlist	Add and confirm you, manage your preferences, tell you about launches and availability in your country, send early-access invitations	Identity and contact, waitlist, consent records	Consent; steps at your request before a contract
Respond to you	Answer enquiries, provide live chat and support, handle complaints and requests	Identity and contact, enquiry, live chat, technical	Legitimate interests (helping people who contact us); steps at your request
Marketing	Send news, offers, event invitations and research invitations; tailor them to your country and language	Identity and contact, marketing and preference, waitlist	Consent where required by law; otherwise legitimate interests (promoting our Products), with a right to object at any time
Email measurement	Understand whether emails are opened or clicked, to improve them	Marketing and preference, technical	Consent
Operate the Website	Host and deliver the Website, remember your settings, balance load, fix errors	Technical, cookie identifiers	Legitimate interests (providing a working Website); consent for non-essential cookies
Security and fraud prevention	Detect and block bots, attacks, fake sign-ups, impersonation, phishing and abuse; investigate incidents	Technical, fraud and abuse, security report	Legitimate interests (protecting the Website, our users and the Umoja Group); legal obligation where it applies
Financial-crime and sanctions screening	Screen sign-ups and contacts against sanctions lists where required, and block access from sanctioned territories	Identity and contact, technical	Legal obligation; legitimate interests (preventing financial crime)
Analytics and improvement	Understand how the Website is used, test new features and content, measure campaigns in aggregate	Technical, cookie identifiers	Consent (analytics cookies)
Research and feedback	Run surveys and user research to improve the Website and Products	Feedback, survey and research	Consent
Events	Manage registrations, attendance and any requirements	Event data, identity and contact	Steps at your request; explicit consent for accessibility or dietary needs
Recruitment	Assess applications, communicate with candidates and meet employment law	Recruitment, identity and contact	Steps at your request before a contract; legitimate interests; legal obligation
Business relationships	Manage dealings with journalists, partners, suppliers and investors	Business contact	Legitimate interests; contract
Group oversight	Group reporting, internal audit, risk management and compliance monitoring by Umoja Global Limited	All categories, in de-identified or aggregated form where possible	Legitimate interests (managing a group of companies responsibly); legal obligation where it applies
Legal compliance	Keep records, respond to lawful requests from regulators, courts and authorities, handle privacy requests	All relevant categories	Legal obligation
Legal claims	Establish, exercise or defend legal claims and enforce our Terms	All relevant categories	Legitimate interests; legal obligation
Corporate transactions	Due diligence and completion of any merger, acquisition, financing, reorganisation or sale of all or part of our business	All relevant categories, minimised	Legitimate interests

5.2 Legitimate interests. Where we rely on legitimate interests, we have carried out a balancing test to make sure our interests are not overridden by yours. You can ask us for information about this test, and you can object to processing based on legitimate interests at any time (Section 14).

5.3 Consent. Where we rely on consent, you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal. You can withdraw marketing consent using the unsubscribe link in any email, and cookie consent using “Cookie preferences” in the Website footer, or by writing to legal@umojacoin.com.

5.4 New purposes. We will use your personal data only for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose that is compatible with the original one. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis that allows us to do so.

6. Marketing communications

6.1 We send marketing emails only where you have consented or where the law otherwise allows us to, for example where you are a business contact and have not objected. Every marketing email includes a clear unsubscribe link.

6.2 We may tailor marketing to your country, language and stated interests so that you only receive information about Products available, or planned, where you live. This is a limited form of segmentation; we do not build detailed behavioural profiles and we do not combine Website data with data bought from third parties for marketing.

6.3 We send marketing only by email, unless you separately opt in to another channel such as SMS or WhatsApp, which will have its own opt-in and opt-out.

6.4 We do not share your personal data with third parties for their own marketing. We do not use your data for advertising on social media platforms, such as uploading email lists to create custom or lookalike audiences, without first updating this Policy and obtaining your consent where required.

6.5 You can unsubscribe at any time by clicking “unsubscribe” in any email, or by writing to support@umojacoin.com. We act on unsubscribe requests within 10 business days, and usually much sooner. We will keep a minimal suppression record (your email address, stored in a form that prevents reuse) so we do not email you again.

7. Automated decision-making and profiling

7.1 We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, through the Website.

7.2 We use automated tools to protect the Website. These tools may, for example, block traffic from known malicious IP addresses, challenge suspected bots or flag disposable email addresses and duplicate sign-ups. If you believe you have been blocked or removed from the waitlist in error, write to support@umojacoin.com and a member of our team will review the decision.

7.3 Products may use automated decision-making, for example for fraud prevention or identity checks. That processing is explained in each Product’s privacy notice.

8. Who we share personal data with

8.1 We share personal data only where necessary for the purposes in Section 5, only to the extent needed and, for service providers, only under written contracts that require them to process data on our instructions, keep it confidential and secure, help us meet our legal obligations, and delete or return it at the end of the service. Our contracts prohibit service providers from using your data for their own purposes, including advertising or sale.

Recipient	Purpose	Typical location
Umoja Global Limited (parent company)	Group administration, security monitoring, internal audit, risk and compliance oversight, support	United Kingdom
Other Umoja Group companies	Support and operations where they help run the Website	Where they are based
Hosting and infrastructure providers	Hosting and serving the Website, databases and backups	United States, European Union
Content delivery and security providers (for example Cloudflare)	Fast and secure delivery, bot protection, attack mitigation	Global network
Form and website-plugin providers (for example WPForms)	Running the waitlist and contact forms	United States
Email delivery and marketing platform	Sending confirmation, service and marketing emails	United States, European Union
Live-chat and help-centre provider (for example Intercom)	Live chat and support tickets	United States, European Union
Analytics provider (for example Google Analytics)	Aggregated Website analytics, only with your consent	United States
Consent-management provider	Recording and honouring your cookie choices	European Union, United States
Fraud-prevention and IP-reputation services	Detecting bots, fraud and abuse	United States, European Union
Survey, research and event tools	Running surveys, research sessions and events	United States, European Union
Recruitment platforms	Managing job applications	United States, European Union
Professional advisers	Legal, audit, accounting, tax and insurance advice, under confidentiality duties	Panama, United Kingdom, other
Authorities, regulators, courts and law enforcement	Where required by law, court order or regulation, or where necessary to prevent fraud, financial crime or harm	Where they are based
Buyers, investors and their advisers	In connection with a merger, acquisition, financing, reorganisation or sale of all or part of our business, under confidentiality terms	Where they are based
Partners and others you ask us to share with	Where you ask us to, or where you move from the Website into a Product that needs them	Where they are based

8.2 Disclosures to authorities. We disclose personal data to public authorities only where we are legally required to, or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of any person, prevent fraud or financial crime, or respond to an emergency. Where the law allows, we review each request for legality and proportionality and disclose only what is necessary.

8.3 Corporate transactions. If the Umoja Group is involved in a merger, acquisition, financing, reorganisation, insolvency or sale of assets, personal data may be transferred as part of that transaction. We will require the recipient to protect it in line with this Policy and will tell you if your data becomes subject to a different privacy policy.

8.4 Aggregated and de-identified data. We may share aggregated or de-identified information that cannot reasonably be used to identify you, for example statistics about Website traffic, with Umoja Global Limited, Partners, investors or the public.

9. We do not sell your personal data

9.1 We do not sell, rent or trade personal data, and we do not “share” it for cross-context behavioural advertising as those terms are defined in US state privacy laws. We do not use advertising or cross-site tracking cookies on the Website, we do not provide your data to data brokers, and we do not build advertising profiles about you.

9.2 If we ever plan to change this, we will first update this Policy and our Website Cookie Policy, provide any required notice and opt-out, and obtain your consent where the law requires.

10. International transfers

10.1 UmojaTech Inc. is based in Panama, our parent company Umoja Global Limited is based in the United Kingdom, and our service providers operate in many countries, including the United States and member states of the European Union. As a result, your personal data will be transferred to, and processed in, countries other than the one where you live, which may not provide the same level of data protection.

10.2 Whenever we transfer personal data internationally, we take steps to make sure it receives an appropriate level of protection, using one or more of the following safeguards:

transfers to countries that the European Commission, the UK Government or another competent authority has decided provide an adequate level of protection;

standard contractual clauses approved by the European Commission, the UK International Data Transfer Addendum or Agreement, or equivalent clauses approved under other laws, together with a transfer risk assessment and supplementary measures where required;

our intra-group data processing and transfer agreement between UmojaTech Inc. and Umoja Global Limited;

providers’ certification under recognised frameworks, such as the EU-US Data Privacy Framework and its UK Extension, where applicable;

authorisation from, or notification to, a data protection authority where local law requires it; or

where no other safeguard is available, a derogation permitted by law, such as your explicit consent after being told of the risks, or a transfer necessary to take steps you have requested.

10.3 You can ask for more information about the safeguards for a particular transfer, and request a copy of them, by writing to legal@umojacoin.com. We may redact commercially sensitive terms.

11. How long we keep personal data

11.1 We keep personal data only for as long as necessary for the purposes for which we collected it, including to meet legal, regulatory, tax, accounting or reporting requirements, and to establish or defend legal claims. The table below shows our standard retention periods.

Data	Standard retention period
Waitlist data	Until you unsubscribe from everything or leave the waitlist; or 24 months after you joined or last interacted with us, unless you confirm you want to stay; or until you open an account with a Product, when that Product’s notice takes over
Unconfirmed waitlist sign-ups	30 days
Unsubscribe suppression record	As long as needed to make sure we do not email you again
Consent records	For as long as the consent is relied on, plus 2 years after it is withdrawn or expires
Enquiry, correspondence and support data (including chat)	3 years from your last message
Complaints	5 years from closure
Security report and incident data	3 years after the report or incident is closed
Fraud and abuse data	Up to 5 years from the event, where needed to prevent repeat fraud
Server, security and technical logs	Up to 18 months
Analytics data from cookies	Up to 14 months at user level; aggregated reports may be kept indefinitely
Feedback, survey and research data	2 years from collection; research recordings 12 months
Event data	12 months after the event; accessibility and dietary information deleted within 30 days after the event
Recruitment data (unsuccessful candidates)	12 months after the decision, or longer with your consent to be considered for future roles
Business contact data	For the duration of the relationship plus 3 years
Privacy request records	3 years from completion
Data subject to a legal hold, claim or investigation	Until it is resolved, plus the applicable limitation period

11.2 Where the law requires a longer or shorter period, that period applies. When a retention period ends, we securely delete the data or irreversibly anonymise it so that it can no longer identify you. Backups are overwritten on a rolling cycle, normally within 90 days.

12. How we protect personal data

12.1 We use appropriate technical and organisational measures, designed in line with recognised information-security standards and the group policies set by Umoja Global Limited, to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include:

encryption of data in transit using TLS, and encryption at rest where supported by our providers;

role-based access controls, the principle of least privilege and regular access reviews;

multi-factor authentication for administrative and privileged access;

network protection, web application firewalls, bot management and distributed denial-of-service mitigation;

logging and monitoring of systems for suspicious activity;

secure software development practices, change management and regular patching;

vulnerability scanning, penetration testing and a responsible disclosure process;

due-diligence and contractual security requirements for service providers;

confidentiality obligations and data protection training for staff and contractors; and

incident response and business continuity plans that are tested regularly.

12.2 No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. You can help by using strong, unique passwords, keeping your devices updated and being alert to phishing. If you have reason to believe your interaction with us is no longer secure, contact legal@umojacoin.com immediately.

12.3 Personal data breaches. If a personal data breach occurs, we will act promptly to contain and investigate it. Where the law requires, we will notify the competent data protection authority within the required time (for example within 72 hours under the GDPR and the Nigeria Data Protection Act) and tell affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

13. Children

13.1 The Website is not directed to children, and the waitlist and our forms are for people aged 18 or over (or the age of majority in their country, if higher). We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we will delete it promptly and remove the child from the waitlist. If you are a parent or guardian and believe that we hold your child’s data, please contact legal@umojacoin.com.

14. Your rights

14.1 Depending on where you live and subject to the conditions and exceptions in Applicable Law, you have the following rights in relation to your personal data:

Right	What it means
Right to be informed	To receive clear information about how we use your personal data, which is the purpose of this Policy
Right of access	To ask whether we process your personal data and to receive a copy of it, together with information about how we use it
Right to rectification	To ask us to correct inaccurate personal data or complete incomplete data
Right to erasure	To ask us to delete your personal data, for example where it is no longer needed, you withdraw consent or you object and there is no overriding reason to keep it
Right to restriction	To ask us to limit how we use your personal data, for example while we check its accuracy or consider an objection
Right to data portability	To receive personal data you gave us in a structured, commonly used, machine-readable format, and to ask us to send it to another controller where technically feasible
Right to object	To object to processing based on legitimate interests or carried out for direct marketing; we will always stop direct marketing when you object
Right to withdraw consent	To withdraw consent at any time, without affecting processing that took place before
Rights related to automated decisions	Not to be subject to a decision based solely on automated processing that significantly affects you, and to obtain human review
Right to non-discrimination	Not to be treated less favourably for using your privacy rights
Right to complain	To lodge a complaint with a data protection authority (Section 19)

14.2 How to make a request. Write to legal@umojacoin.com with the subject “Privacy request”, telling us which right you want to use and giving enough information for us to find your data, such as the email address you used. You do not need to use any particular form.

14.3 Verifying your identity. To protect your data, we will take reasonable steps to verify your identity before acting on a request, normally by asking you to confirm control of the email address associated with your data. We will not ask for more information than we need, and we will use it only to verify your request.

14.4 Authorised agents. You may use an authorised agent or legal representative to make a request on your behalf. We will ask for written proof of their authority and may still need to verify your identity directly.

14.5 Timing. We will acknowledge your request promptly and respond within one month of receiving a verified request. Where a request is complex or we receive many requests, we may extend this by up to two further months, and will tell you why within the first month. Where local law sets a shorter deadline (for example 45 days under the CCPA, or the periods set by Panama’s regulations), we follow it.

14.6 Fees. We do not charge for responding to requests. We may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded, excessive or repetitive, and will explain why.

14.7 If we cannot comply. Some rights are not absolute. If we cannot fully comply with your request, for example because we must keep certain data by law, we will explain why and tell you about your right to complain.

14.8 Appeals. If we decline your request and your local law gives you a right to appeal (for example in several US states), you may appeal by replying to our decision or writing to legal@umojacoin.com with the subject “Privacy appeal”. A different member of our legal team will review the decision and respond within the time required by law, normally within 45 to 60 days.

15. Country-specific information

15.1 This Section applies in addition to the rest of this Policy and prevails if there is any conflict, for individuals in the countries concerned.

Panama

15.2 UmojaTech Inc. is incorporated in Panama, so Law 81 of 26 March 2019 on Personal Data Protection and its regulations (Executive Decree 285 of 28 May 2021) apply. You have the rights of access, rectification, cancellation, opposition and portability. We process personal data on the basis of your consent or another basis permitted by Law 81, and we keep records of consent and of international transfers as the law requires. You may complain to the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI).

United Kingdom

15.3 Where the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 apply, including to processing by our parent company Umoja Global Limited, you have the rights described in Section 14. The legal bases we rely on are set out in Section 5. You may complain to the Information Commissioner’s Office.

European Economic Area and Switzerland

15.4 Where the EU General Data Protection Regulation (or the Swiss Federal Act on Data Protection) applies, you have the rights described in Section 14, and the legal bases are set out in Section 5. You may complain to the supervisory authority in the country where you live, work or where the alleged infringement took place.

Nigeria

15.5 Where the Nigeria Data Protection Act 2023 applies, together with the General Application and Implementation Directive 2025 and other directions of the Nigeria Data Protection Commission, we process your data on the lawful bases recognised by the Act, which correspond to those in Section 5. You have the rights to information, access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and not to be subject to solely automated decisions. You may complain to the Nigeria Data Protection Commission.

Kenya

15.6 Where the Data Protection Act, 2019 and its regulations apply, you have the rights to be informed, to access, to object, to correction, to deletion and to portability. Transfers outside Kenya are made in line with the Act and its regulations. You may complain to the Office of the Data Protection Commissioner.

Ghana

15.7 Where the Data Protection Act, 2012 (Act 843) applies, you have the rights of access, correction and deletion, and to object to processing for direct marketing. You may complain to the Data Protection Commission.

Rwanda

15.8 Where Law No. 058/2021 of 13/10/2021 on the Protection of Personal Data and Privacy applies, you have the rights to information, access, objection, portability, rectification, erasure and restriction, and not to be subject to solely automated decisions. Transfers outside Rwanda are made only as permitted by that law. You may complain to the National Cyber Security Authority.

Tanzania

15.9 Where the Personal Data Protection Act, 2022 and its regulations apply, you have the rights of access, rectification, erasure and objection, and to compensation for damage caused by unlawful processing. You may complain to the Personal Data Protection Commission.

Uganda

15.10 Where the Data Protection and Privacy Act, 2019 and its regulations apply, you have the rights of access, rectification, deletion and objection, including to direct marketing. You may complain to the Personal Data Protection Office.

South Africa

15.11 Where the Protection of Personal Information Act, 2013 (POPIA) applies, you have the rights to be notified, to access, to request correction or deletion, to object, including to direct marketing, and to complain. We will only send you unsolicited electronic marketing with your consent, as POPIA requires. You may complain to the Information Regulator.

Canada

15.12 Where the Personal Information Protection and Electronic Documents Act (PIPEDA) or a substantially similar provincial law applies, we rely on your consent, which may be express or implied depending on the sensitivity of the information. You may access and correct your personal information and withdraw consent, subject to legal or contractual restrictions. Your personal information may be stored and processed outside Canada and may be accessible to authorities in those countries. You may complain to the Office of the Privacy Commissioner of Canada.

United States

15.13 California. This Section is our notice at collection and privacy policy for the purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). In the last 12 months we have collected the following categories of personal information:

CCPA category	Examples	Source	Business purpose	Disclosed to	Sold or shared
Identifiers	Name, email address, IP address, cookie identifiers	You; your device	Waitlist, communications, security, analytics	Service providers; Umoja Global Limited	No
Customer records	Telephone number, organisation, job title	You	Responding to you; business relationships	Service providers; Umoja Global Limited	No
Internet or network activity	Pages viewed, links clicked, referring URL, interactions with emails	Your device	Operating, securing and improving the Website	Service providers	No
Geolocation (approximate)	Country, region and city derived from IP address	Your device	Security; showing relevant Products	Service providers	No
Professional or employment information	CV, work history	You	Recruitment	Recruitment platforms; advisers	No
Inferences	Interest in particular Products or countries	Your choices	Tailoring communications	Service providers	No

15.14 We do not collect sensitive personal information through the Website, other than as strictly needed for recruitment, and we do not use it to infer characteristics about you. We keep each category for the periods in Section 11. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.

15.15 California residents have the right to know what personal information we collect, use and disclose; to access and receive a copy of it; to correct it; to delete it; to opt out of its sale or sharing (although we do not sell or share it); to limit the use of sensitive personal information; and not to be discriminated against for using these rights. To use them, follow Section 14. We will respond within 45 days, which may be extended by a further 45 days where reasonably necessary. California’s “Shine the Light” law also allows California residents to ask whether we disclose personal information to third parties for their own direct marketing; we do not.

15.16 Other US states. Residents of Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia and other states with comprehensive privacy laws may have similar rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale and certain profiling. We do not engage in targeted advertising, sale or such profiling. To use your rights or appeal a decision, follow Section 14.

Other countries

15.17 If you live in a country not listed above, the general provisions of this Policy apply, together with any additional rights your local law gives you. Contact legal@umojacoin.com for details.

16. Social media pages

16.1 We operate official pages on social media platforms. When you visit or interact with them, the platform operator also collects personal data under its own privacy policy. For some features, such as page insights, we and the platform may be joint controllers; in that case, the platform is primarily responsible for handling your rights in relation to the data it collects, and you can also contact us. We receive only aggregated statistics about page visitors and the public information and messages you send to our pages.

17. Third-party websites and embedded content

17.1 The Website may link to or embed content from other websites and services. This Policy does not apply to them, and we are not responsible for their privacy practices. Embedded content may behave as if you had visited the other website, and its operator may collect data about you. Where possible, we load embedded content only after you accept the relevant cookie category.

18. Cookies and similar technologies

18.1 We use cookies and similar technologies on the Website. Strictly necessary cookies are always active; all other cookies are used only with your consent. Our Website Cookie Policy explains what they are, which ones we use, how long they last and how to change your choices.

19. Contact, complaints and regulators

19.1 If you have any questions about this

Policy, wish to use your rights or want to make a complaint about how we handle your personal data, please contact legal@umojacoin.com or write to UmojaTech Inc., 55th Street East, SL55 Building, 21st Floor, Office 3, Panama City, Republic of Panama, marked “For the attention of the Legal Team (Privacy)”. For general help with the Website or the waitlist, contact support@umojacoin.com.

19.2 We will acknowledge privacy complaints within 5 business days and aim to resolve them within one month. We would appreciate the chance to address your concerns first, but you have the right to complain to a data protection authority at any time.

Country or region	Authority
Panama	Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI)
United Kingdom	Information Commissioner’s Office (ICO)
EU / EEA	The data protection supervisory authority in your member state
Switzerland	Federal Data Protection and Information Commissioner (FDPIC)
Nigeria	Nigeria Data Protection Commission (NDPC)
Kenya	Office of the Data Protection Commissioner (ODPC)
Ghana	Data Protection Commission
Rwanda	National Cyber Security Authority (NCSA)
Tanzania	Personal Data Protection Commission (PDPC)
Uganda	Personal Data Protection Office (PDPO)
South Africa	Information Regulator
Canada	Office of the Privacy Commissioner of Canada
United States (California)	California Privacy Protection Agency, or the California Attorney General

20. Changes to this Policy

20.1 We review this Policy regularly and may update it to reflect changes in our practices, Products, service providers, group structure, technology or Applicable Law. The “Last Updated” date at the top shows when it was last changed.

20.2 Where we make material changes, we will give at least 30 days’ notice by a prominent notice on the Website and, if you are on the waitlist, by email, before the changes take effect. Where the law requires your consent to a change, we will ask for it before applying the change to you.

20.3 Earlier versions of this Policy are available on request from legal@umojacoin.com.