Privacy Policy

Kabi Investment Limited ("we", "us", "our") operates the KabiPay payment platform accessible at kabipay.com and through our API. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

By using KabiPay, you agree to the collection and use of information in accordance with this policy. We are committed to protecting your personal data and complying with applicable data protection laws in Tanzania and across East Africa.

We collect different types of information depending on how you interact with us:

**2.1 Information you provide directly:** • Full name, email address, phone number, and password when creating an account • Business name, registration number, business type, and country of operation • Government-issued identification documents for KYB/KYC verification • Bank account details and mobile money wallet information for settlement • Communications you send us, including support requests and enquiries

**2.2 Information collected automatically:** • IP address, browser type, operating system, and device identifiers • Pages visited, time spent on pages, links clicked, and referring URLs • Transaction data including amounts, methods, timestamps, and statuses • API request logs, webhook delivery records, and error logs • Cookies and similar tracking technologies (see Section 7)

**2.3 Information from third parties:** • Identity verification results from Didit KYC/KYB provider • Payment confirmation data from mobile money operators (M-Pesa, Airtel, TigoPesa, Halopesa) • Fraud signals and risk assessments from our security partners

We use the information we collect to:

• **Provide our services:** Process payments, initiate settlements, deliver webhooks, and maintain your merchant account • **Verify your identity:** Complete KYB/KYC checks required under Tanzanian payment regulations and BOT licensing requirements • **Prevent fraud:** Detect, investigate, and prevent fraudulent transactions, money laundering, and other illegal activities • **Communicate with you:** Send transaction confirmations, settlement notifications, account alerts, and product updates • **Improve our platform:** Analyse usage patterns, diagnose technical issues, and develop new features • **Comply with legal obligations:** Meet requirements under Tanzanian law, BOT regulations, and AML/CFT obligations • **Customer support:** Respond to your enquiries, resolve disputes, and provide technical assistance

We process your personal data on the following legal bases:

• **Contract performance:** Processing necessary to provide the KabiPay services you have signed up for • **Legal obligation:** Processing required to comply with Tanzania's Payment Systems Act, Anti-Money Laundering Act, and Bank of Tanzania regulations • **Legitimate interests:** Fraud prevention, security monitoring, and improving our services — where these do not override your rights • **Consent:** Where we have asked for and received your explicit consent (e.g. marketing communications)

You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

We do not sell your personal data. We may share your information with:

**5.1 Payment network partners:** Mobile money operators (Vodacom/M-Pesa, Airtel Tanzania, Tigo Tanzania, Halotel) and card networks (Visa, Mastercard) necessary to process your transactions.

**5.2 Identity verification providers:** Didit (our KYC/KYB partner) to verify the identity of merchants and comply with regulatory requirements.

**5.3 Banking partners:** Settlement banks and financial institutions required to disburse funds to merchant accounts.

**5.4 Service providers:** Cloud hosting (AWS/Railway), database providers (Neon), email delivery services, and other technology partners who process data on our behalf under strict confidentiality agreements.

**5.5 Regulatory authorities:** The Bank of Tanzania (BOT), Tanzania Revenue Authority (TRA), Financial Intelligence Unit (FIU), and law enforcement where required by law or court order.

**5.6 Business transfers:** If Kabi Investment Limited is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• **Account data:** Retained for the duration of your account plus 7 years after closure (required by Tanzanian financial regulations) • **Transaction records:** Retained for a minimum of 7 years (AML/BOT compliance requirement) • **KYC/KYB documents:** Retained for 5 years after the end of the business relationship • **Support communications:** Retained for 3 years • **Website analytics:** Retained for 2 years in aggregated form

After the applicable retention period, your data is securely deleted or anonymised.

We use cookies and similar technologies to:

• **Essential cookies:** Maintain your login session, security tokens, and platform functionality • **Analytics cookies:** Understand how users interact with KabiPay (using anonymised data) • **Preference cookies:** Remember your settings and preferences

You can control cookies through your browser settings. Disabling essential cookies may affect platform functionality. We do not use third-party advertising cookies.

We implement industry-standard security measures to protect your information:

• **Encryption:** All data transmitted between your browser/application and KabiPay is encrypted using TLS 1.3 • **Encryption at rest:** Sensitive data including payment credentials is encrypted at rest using AES-256 • **Access controls:** Strict role-based access controls limit who within our organisation can access personal data • **API key security:** Secret API keys are hashed and never stored in plaintext • **Regular audits:** We conduct regular security assessments and penetration testing • **Incident response:** We have documented procedures for identifying, containing, and reporting data breaches

Despite these measures, no method of transmission over the internet is 100% secure. We encourage you to use strong, unique passwords and enable two-factor authentication on your account.

Subject to applicable law, you have the following rights regarding your personal data:

• **Right of access:** Request a copy of the personal data we hold about you • **Right to rectification:** Request correction of inaccurate or incomplete data • **Right to erasure:** Request deletion of your personal data (subject to legal retention obligations) • **Right to restrict processing:** Request that we limit how we process your data in certain circumstances • **Right to data portability:** Receive your data in a structured, machine-readable format • **Right to object:** Object to processing based on legitimate interests • **Right to withdraw consent:** Withdraw consent at any time for consent-based processing

To exercise any of these rights, please contact us at privacy@kabipay.com. We will respond within 30 days. We may need to verify your identity before processing your request.

KabiPay is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@kabipay.com and we will promptly delete such information.

Your information may be transferred to and processed in countries other than Tanzania, including where our cloud infrastructure and service providers are located (including the United States and European Union). We ensure such transfers are subject to appropriate safeguards, including standard contractual clauses and data processing agreements that provide equivalent protection to Tanzanian data protection standards.

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Sending an email to the address associated with your KabiPay account • Displaying a prominent notice on the KabiPay dashboard • Updating the "Last updated" date at the top of this page

Your continued use of KabiPay after changes become effective constitutes your acceptance of the revised policy. We encourage you to review this policy periodically.

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

**Data Protection Officer** Kabi Investment Limited Dar es Salaam, Tanzania, East Africa Email: privacy@kabipay.com General: info@kabipay.com

If you are not satisfied with our response, you may lodge a complaint with the relevant data protection authority in Tanzania.