This Privacy and Data Protection Policy applies to all personal data processed by Yo! Uganda Limited (“Yo!”, “we”, “us”, “our”) in connection with the Yo! Payments service, in accordance with the Data Protection and Privacy Act, 2019 of Uganda.
1. Data We Collect
We collect and process the following categories of personal data:
- Identity data: full name, date of birth, national identity number, passport or other government-issued identification.
- Contact data: e-mail address, mobile phone number, postal address.
- Financial data: mobile money account details, transaction history, payment amounts, balances.
- Technical data: IP address, device identifiers, browser type and version, time zone, operating system.
- Usage data: information about how you use our Service, including pages visited, features used, and frequency of access.
- Business data: for Business Account holders, company registration details, trade license, director information, and beneficial ownership.
2. Purpose of Processing
We process your personal data for the following purposes:
- To register you as a new user and manage your Payment Account.
- To process and complete payment transactions you initiate or receive.
- To verify your identity and prevent fraud, money laundering, and other financial crimes.
- To comply with legal and regulatory obligations, including anti-money laundering and know-your-customer requirements.
- To communicate with you about your account, transactions, and changes to our terms or policies.
- To improve, maintain, and protect our Service and systems.
- To resolve disputes, collect fees, and troubleshoot problems.
3. Legal Basis for Processing
We process personal data under the following legal bases as provided under the Data Protection and Privacy Act, 2019:
- Performance of a contract: processing necessary for the performance of the User Agreement between you and Yo!.
- Legal obligation: processing necessary for compliance with a legal obligation to which Yo! is subject.
- Consent: where you have given consent to the processing of your personal data for one or more specific purposes.
- Legitimate interests: processing necessary for the legitimate interests pursued by Yo!, except where such interests are overridden by your rights and freedoms.
4. Recipients of Personal Data
We may share your personal data with:
- Our Affiliates, for the purposes described in this policy.
- Mobile money providers and financial institutions that process transactions on our behalf (Processors).
- Regulatory and law enforcement authorities, where required by law or in response to valid legal process.
- Third-party service providers who assist us with identity verification, fraud prevention, data analysis, customer support, and other operational functions.
- Professional advisers, including lawyers, auditors, and insurers.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
5. International Transfers
Where we transfer your personal data outside of Uganda, we will ensure that adequate safeguards are in place in accordance with the Data Protection and Privacy Act, 2019, including ensuring that the recipient country provides an adequate level of protection or that appropriate contractual measures are in place.
6. Data Retention
We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data, and whether we can achieve those purposes through other means.
Transaction records are retained for a minimum of seven (7) years from the date of the transaction, in accordance with applicable financial regulations and anti-money laundering requirements.
7. Your Rights
Under the Data Protection and Privacy Act, 2019, you have the following rights in relation to your personal data:
- Right of access: you have the right to request a copy of the personal data we hold about you.
- Right to correction: you have the right to request that we correct any personal data that is inaccurate or incomplete.
- Right to deletion: you have the right to request the deletion of your personal data where there is no compelling reason for its continued processing, subject to any overriding legal obligation to retain it.
- Right to object: you have the right to object to the processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object.
- Right to withdraw consent: where we are relying on consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, please contact our Data Protection Officer.
8. Data Protection Officer
We have appointed a Data Protection Officer (DPO) to oversee compliance with this policy and applicable data protection laws.
Data Protection Officer: SCHOLAH AMURON (Operations Manager)
Yo! Uganda Limited
P.O. Box 27105
Kampala, Uganda
Email: info@yo.co.ug
If you have concerns about our use of your personal data, you also have the right to lodge a complaint with the Personal Data Protection Office of Uganda.
9. Changes to This Policy
We may update this Privacy and Data Protection Policy from time to time. Any changes will be posted on our Site and, where appropriate, notified to you by email or SMS. We encourage you to review this policy periodically to stay informed about how we are protecting your personal data.