INTRODUCTION

Kirabo TECH Limited is a licensed and regulated technology company operating a digital gifting and rewards platform that enables individuals, businesses, and merchants to buy, send, receive, and redeem electronic vouchers (e‑vouchers).

We are committed to protecting the privacy, confidentiality, and security of personal information entrusted to us in accordance with the Data Protection and Privacy Act, Cap. 97 (Uganda), the Data Protection and Privacy Regulations, 2021 and applicable global data protection principles, including GDPR standards.

This Privacy Notice applies to all users of Kirabo’s platform, including individual users, corporate clients, and merchants. By using our website, applications, or services, you acknowledge and agree to the practices described in this Notice.

This Notice is issued in compliance with the Data protection and Privacy legal framework applicable in Uganda and under the oversight of the Personal Data Protection Office as established under the Data Protection and Privacy Regulations, 2021.

PURPOSE OF THIS PRIVACY NOTICE

This Privacy Notice explains how Kirabo TECH Limited collects, uses, stores, shares, safeguards, and retains personal data. It also outlines your rights as a data subject and how you may exercise those rights.

Protecting your personal data is fundamental to maintaining trust in our digital voucher ecosystem. Kirabo Tech Limited has implemented company‑wide governance, policies, and security controls to ensure that personal data is processed lawfully, fairly, transparently, and securely.

DEFINITIONS

For purposes of this Privacy Notice:

1. Data Controller means the natural or legal person who determines the purposes and means of processing personal data.
2. Data Processor means a natural or legal person who processes personal data on behalf of the Data Controller.
3. Data Subject means any information relating to an identified or identifiable natural person.
4. Personal Data means any digital or electronic voucher issued via the Platform, redeemable with approved merchants under their specific terms.
5. Processing means any operation performed on personal data, whether automated or manual, including collection, recording, storage, use, disclosure, or deletion.
6. Consent means a freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they agree to the processing of their personal data.
7. Kirabo refers to Kirabo TECH Limited.

TYPES OF PERSONAL DATA WE COLLECT

We may collect and process the following categories of personal data depending on your relationship with us:

1. Identification Information: Full name, company name, registration details, national identification or passport information, date of incorporation.
2. Contact Information: Email address, phone number, registered office address, physical address.
3. Merchant & Business Information: Business permits, TIN, bank details, settlement information, transaction records.
4. Transaction Data: Voucher purchases, redemptions, transfers, payment confirmations, and related logs.
5. Technical & Usage Data: IP address, device information, browser type, login data, cookies, and platform usage data.
6. Communications: Correspondence between you and Kirabo Tech Limited via email, phone, chat, or support channels.

Where you provide personal data relating to another person (e.g., directors, authorized representatives, or employees), you confirm that you are authorized to do so.

Note: Kirabo Tech Limited does not knowingly process personal data of Children under the age of 18 years without verified parental or guardian consent.

Kirabo tech limited does not collect special personal data such as religious, political, health, sexual life except where an explicit consent or a legal obligation exists.

HOW WE COLLECT PERSONAL DATA

We collect personal data through:

1. Direct Interactions: When you register, onboard as a user or merchant, purchase or redeem vouchers, contact support, or communicate with us.
2. Automated Technologies: Cookies and similar technologies used on our website and platforms.
3. Third‑Party Sources: Payment service providers, merchant partners, regulators, and service providers strictly for service delivery, compliance, and fraud prevention.

RIGHTS OF DATA SUBJECTS

As a data subject, you have the right to:

1. Be informed about how your data is processed
2. Access your personal data
3. Request correction of inaccurate or incomplete data
4. Request deletion of personal data where legally applicable
5. Restrict or object to certain processing activities
6. Request data portability where processing is automated and based on consent or contract
7. Object to direct marketing communications
8. Not be subject to decisions based solely on automated processing where such decisions have legal or significant effects

Requests may be submitted using the contact details provided at the end of this Notice and all such requests for access, correction, deletion, or objection shall be processed within 7 days in line with the Data Protection and Privacy Act, Cap. 97 and the Data protection and privacy Regulations, 2021.

HOW WE USE YOUR PERSONAL DATA

Kirabo processes personal data for the following purposes:

1. To operate and manage the digital voucher platform
2. To onboard users and merchants
3. To process voucher transactions and settlements
4. To prevent fraud and ensure platform security
5. To comply with legal and regulatory obligations
6. To improve platform performance, features, and user experience
7. To communicate service‑related updates, alerts, and notifications
8. To provide marketing communications where consent has been given

LEGAL BASES FOR PROCESSING

We process personal data on the following lawful bases:

1. Contractual Necessity: To provide and manage our services
2. Legal Obligations: Compliance with applicable laws and regulatory requirements
3. Consent: For marketing communications and optional data processing activities
4. Legitimate Interests: Platform security, service improvement, fraud prevention, and business operations

You may withdraw consent at any time, subject to legal or contractual limitations.

DATA SHARING AND DISCLOSURE

We may share personal data with:

1. Payment and financial service providers
2. Merchant partners (only where necessary for voucher redemption)
3. Technology and infrastructure service providers
4. Regulators, courts, or law enforcement authorities where required by law

We ensure appropriate contractual and technical safeguards are in place for all third‑party processors.

INTERNATIONAL DATA TRANSFERS

Where personal data is be transferred outside Uganda, it shall be only to jurisdictions with adequate protection recognized by the Personal Data protection Office (PDPO) Uganda or with the explicit data subject consent. Kirabo Tech Limited ensures that adequate safeguards are implemented in accordance with the Data Protection and Privacy Act, Cap. 97, the regulations made thereunder and the applicable international standards.

DATA SECURITY

We implement appropriate technical and organizational measures, including encryption, access controls, and monitoring, to protect personal data against unauthorized access, loss, or misuse.

DATA RETENTION

Personal data is retained only for as long as necessary to fulfill legal, contractual, and business purposes, after which it is securely deleted or anonymized.

COMMUNICATIONS AND MARKETING

We may contact you regarding service updates, security alerts, and platform notifications. Marketing communications are sent only where consent has been provided, and you may opt out at any time.

COOKIES

Kirabo Tech Limited uses cookies and similar technologies strictly in line with its Cookie Policy. Cookies are used to ensure platform functionality, enhance security, analyze performance, and improve user experience. Users may manage cookie preferences through their browser settings. Disabling certain cookies may affect platform functionality.

ALIGNMENT WITH TERMS & CONDITIONS

This Privacy Notice should be read together with our Terms & Conditions. Where personal data is processed in connection with voucher purchases, redemptions, merchant settlements, or platform access, such processing is necessary for the performance of the contractual relationship between you and Kirabo Tech Limited. In the event of any conflict, the Terms & Conditions shall govern contractual obligations, while this Privacy Notice governs personal data protection.

Kirabo Tech Limited uses cookies in accordance with its Cookie Policy to enhance user experience, analyze performance, and improve platform functionality.

SOCIAL MEDIA

Interactions on social media platforms are subject to the respective platform’s privacy policies. Kirabo Tech Limited will never request sensitive account information through public channels.

POLICY UPDATES

This Privacy Notice may be updated periodically. The latest version will always be available on our website.

MERCHANT-SPECIFIC PRIVACY ADDENDUM

This section applies specifically to merchants onboarded on the Kirabo platform.

Merchant Data Collected

In addition to general user data, Kirabo Tech Limited may collect and process the following merchant-related information: - Business registration documents and licensing information - Tax Identification Number (TIN) - Settlement and payout bank account details - Authorized representative and signatory details - Voucher redemption records and reconciliation reports

Purpose of Merchant Data Processing

Merchant data is processed strictly for: - Merchant onboarding and verification - Voucher redemption and settlement - Fraud prevention and dispute resolution - Compliance with applicable legal and regulatory requirements - Platform analytics and service improvement

Merchant Responsibilities

Merchants are responsible for ensuring that any personal data they share with Kirabo Tech Limited is collected lawfully and that they have obtained any necessary consents from their staff or representatives.

Merchants shall indemnify Kirabo Tech Limited against any data claims or penalties arising from their breach of their data protection obligations.

DATA BREACH NOTIFICATION

Kirabo Tech Limited will notify the PDPO and affected data subjects immediately upon discovery of a data breach in accordance with the Act and the Regulations.

CONTACT DETAILS & COMPLAINTS

For questions, requests, or complaints regarding this Privacy Notice or the processing of personal data, contact:

• Kirabo TECH Limited
• Plot 9–21, Port Bell Road, Nakawa
• Kampala, Uganda
• Email: info@Kirabo.shop
• Website: www.kirabo.shop

If you are dissatisfied with our response, you may escalate your complaint to the Personal Data Protection Office (Uganda).