PREPAYLYNK: PRIVACY POLICY

This Policy applies to personal data we collect from Buyers, Sellers, and other visitors ("Users," "you") through the PrePaylynk website, mobile application, and related services, across all Order Categories (Real Estate, E-commerce, Freelance/Services, Vehicle Sales, and General/Other).

"Personal data" means any information relating to an identified or identifiable natural person, as defined under the DPPA.

2.1 Information You Provide Directly

• Account information: full name, email address, phone number, physical address, date of birth, username, and password.
• Identity verification (KYC) information: national ID number, passport number, driver's licence, photograph/selfie, and other government-issued identification, as described in Section 5.
• Order information: descriptions, values, currencies, and supporting documents for an Order (e.g., property titles, vehicle logbooks, service agreements, delivery confirmations, invoices).
• Payment information: bank account details, mobile money number, card details, or other payment-channel information needed to fund or receive an Order (processed via our payment partners; see Section 6).
• Communications: messages sent through the Platform, support tickets, Dispute submissions, and evidence uploaded for a Dispute under Section 9 of the Terms of Service.

2.2 Information Collected Automatically

• Device and log information: IP address, device identifiers, browser type, operating system, mobile network information, and crash/error logs.
• Usage information: pages viewed, features used, timestamps, and interactions with the Platform.
• Location information: approximate location derived from IP address or, where you enable it, precise device location (e.g., for Real Estate or Vehicle Sales Orders requiring location verification).

2.3 Information From Third Parties

• Identity verification providers, credit or fraud-screening services, and payment processors.
• Publicly available registries (e.g., land registries, vehicle title registries) where relevant to verifying a Real Estate or Vehicle Sales Order.
• Other Users, where they provide information about you in the context of an Order or Dispute (e.g., a counterparty's evidence submission).

We use personal data to:

• Create and manage your account and authenticate your identity.
• Create, fund, hold, release, and refund Orders through the Escrow Account.
• Perform KYC/AML checks and comply with legal and regulatory obligations.
• Facilitate and resolve Disputes under Section 9 of the Terms of Service.
• Calculate and collect Platform Fees.
• Process multi-currency transactions and currency conversions.
• Communicate with you about your account, Orders, Disputes, and Platform updates.
• Detect, investigate, and prevent fraud, money laundering, and other prohibited conduct.
• Improve, secure, and develop the Platform.
• Comply with lawful requests from courts, regulators, or law enforcement in Uganda.

We process personal data on one or more of the following bases:

• Performance of a contract: to provide the escrow service you have requested (e.g., holding, releasing, or refunding funds).
• Legal obligation: to comply with KYC/AML, tax, and other applicable Ugandan laws.
• Legitimate interest: to secure the Platform, prevent fraud, and improve our services, balanced against your rights and interests.
• Consent: where required, such as for certain marketing communications or optional location data, which you may withdraw at any time.

As described in Section 3 of our Terms of Service, PrePaylynk applies risk-based KYC and AML checks, particularly for higher-value Categories such as Real Estate and Vehicle Sales. This may require:

• Government-issued identification and proof of address.
• Proof of funds, source-of-funds declarations, or ownership documents (e.g., property title, vehicle logbook).
• Enhanced due diligence for high-value or high-risk Orders, which may include additional documentation or a manual review.

We retain KYC/AML records for the period required under applicable Ugandan law, which may extend beyond account closure (see Section 8).

We do not sell your personal data. We may share personal data with:

• Payment processors and financial institutions, to fund, hold, release, refund, and convert currency for Orders.
• Identity verification and fraud-screening providers, to complete KYC/AML checks.
• The other party to an Order (Buyer or Seller), to the extent necessary to complete the Order or resolve a Dispute (e.g., delivery details, evidence submitted in a Dispute).
• Professional advisers (legal, audit, compliance) under confidentiality obligations.
• Regulators, law enforcement, courts, or arbitral bodies, where required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of PrePaylynk, our Users, or the public.
• Service providers who support our operations (e.g., cloud hosting, customer support tools, analytics), under contractual confidentiality and data protection obligations.
• A successor entity, in the event of a merger, acquisition, or sale of assets, as described in Section 19 of our Terms of Service.

Because PrePaylynk supports multi-currency transactions and may use service providers located outside Uganda (e.g., cloud hosting, international payment processors), personal data may be transferred to and processed in other countries. Where we transfer personal data outside Uganda, we take steps required under the DPPA to ensure the recipient provides an adequate level of protection, including contractual safeguards, before the transfer takes place.

We retain personal data for as long as necessary to:

• Provide the Platform and maintain your account;
• Complete an Order and resolve any related Dispute;
• Comply with KYC/AML, tax, and other legal or regulatory retention requirements (which for financial and identity records is typically 2 years after account closure or the last transaction, as required under applicable Ugandan law); and
• Establish, exercise, or defend legal claims.

When personal data is no longer required, we securely delete or anonymise it.

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration, including encryption of data in transit, access controls, and segregation of Escrow Account data from general account data. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or from the Platform.

Subject to applicable exceptions, you have the right to:

• Be informed of the personal data we hold about you and how it is used.
• Access a copy of your personal data.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of personal data that we are not legally required to retain (e.g., under KYC/AML rules).
• Object to or restrict certain processing, including direct marketing.
• Withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint with the Personal Data Protection Office (PDPO) of Uganda, or the relevant successor regulator, if you believe your rights have been infringed.

To exercise these rights, contact us using the details in Section 17. We may need to verify your identity before actioning a request, and some requests may be limited where retention is required by law (e.g., KYC/AML or Dispute records).

We use cookies and similar technologies to operate the Platform, remember your preferences, keep you securely logged in, and understand how the Platform is used. You can manage cookie preferences through your browser or device settings; disabling certain cookies may limit some Platform functionality.

We may use automated checks (e.g., fraud-risk scoring, KYC verification matching) to support decisions about account approval, Order funding, or flagging a transaction for manual review. Significant decisions affecting your Orders or Disputes are reviewed by PrePaylynk staff, and you may request human review of an automated decision that materially affects you.

PrePaylynk is not intended for use by anyone under 18 years of age, in line with the eligibility requirement in Section 3 of our Terms of Service. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor, we will take steps to delete it.

If we become aware of a breach of personal data that is likely to result in a risk to your rights and freedoms, we will notify the Personal Data Protection Office and affected Users without undue delay, in accordance with the DPPA, and take reasonable steps to contain and remediate the breach.

The Platform may contain links to, or integrate with, third-party services (e.g., payment processors, identity verification providers). This Policy does not cover the privacy practices of those third parties, and we encourage you to review their respective privacy policies.

We may update this Policy from time to time to reflect changes in our practices or applicable law. Material changes will be notified to Users through the Platform or by email at least 5 days before taking effect, consistent with Section 18 of our Terms of Service. Continued use of PrePaylynk after the effective date of any update constitutes acceptance of the revised Policy.

For questions about this Policy, to exercise your data protection rights, or to raise a concern, contact:

• Data Protection Officer / Privacy Team: [Insert DPO Name/Team]
• Email: info@prepaylynk.com
• Phone: +256 788 127 712
• Registered Address: Najjera, Busibante Road, Kampala, Uganda
• Support Hours: 10:00 AM to 4:00 PM

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Office (PDPO) of Uganda.