Privacy Policy

 

OVERVIEW

QR Pay Africa Limited and our subsidiaries and affiliated companies ("we," "our," "us," "QR Pay Africa," "QR Pay Africa corporate group") provide this Privacy Policy to describe our collection, use, processing, storage, transfer, and disclosure of your Personal Information when you use your QR Pay Africa account(s), visit our websites ("Sites"), apply for, or use our Services.

This Privacy Policy applies to:

• Current and former users of QR Pay Africa Services
• Individuals who receive payments through QR Pay Africa
• Business customers, merchants, agents, and beneficial owners
• Visitors to our website and mobile applications
• Users who visit a Choice Microfinance Bank Limited branch in connection with a Partner Bank Account opened for them under our banking partnership (see Section 1A) for that branch visit, the Partner Bank's own Privacy Policy also applies

This Privacy Policy does not apply when Personal Information is processed by certain third parties, for example, authorities, credit bureaus, acquirers, and other financial institutions. The third parties' processing of your Personal Information is regulated by their own privacy policies. We encourage you to read those privacy policies and know your privacy rights before interacting with them.

If you reside in certain jurisdictions, we may process your Personal Information differently to comply with applicable privacy laws. You may also have specific privacy rights depending on your place of residence.

We may revise this Privacy Policy from time to time to reflect changes to our business, Services, or applicable laws. Where required by law, we will provide you with 30 days' prior notice by posting notice of the change on the Privacy Policy page of our website. Continued use of the Services after updates constitutes acceptance of the revised Policy.

1A. YOUR PARTNER BANK: CHOICE MICROFINANCE BANK LIMITED

A. The Partnership

QR Pay Africa has partnered with Choice Microfinance Bank Limited (the "Partner Bank"), a bank licensed and regulated by the Central Bank of Kenya. QR Pay Africa safeguards User funds by depositing them at the Partner Bank, and when you sign up for Services that require one, QR Pay Africa arranges for the Partner Bank to open a bank account in your own name (your "Partner Bank Account"). You are a customer of the Partner Bank with respect to your Partner Bank Account, in addition to being a customer of QR Pay Africa for the Services generally.

B. Who Controls What Data

QR Pay Africa and the Partner Bank each independently determine how they process certain of your Personal Information, and each is a separate data controller for its own part of the relationship. QR Pay Africa controls the data generated by your use of the app, wallet, QR payments, remittances, and cards. The Partner Bank independently controls the data it collects to open and maintain your Partner Bank Account, including data it collects directly from you at its branches (see Section 3.K) or through its own KYC process. Where QR Pay Africa shares your identification and KYC information with the Partner Bank so that it can open your Partner Bank Account, both QR Pay Africa and the Partner Bank act as controllers of that shared information for their respective purposes.

C. Two Privacy Policies Apply

This Privacy Policy governs QR Pay Africa's own processing of your Personal Information. The Partner Bank's own Privacy Policy governs its processing of Personal Information in connection with your Partner Bank Account, including data collected at its branches. Where this Policy describes a Partner Bank practice (for example, in Sections 3.K, 7.A, 9, 11, or 13), that description reflects our understanding of the Partner Bank's Privacy Policy and is provided for your convenience; the Partner Bank's own Privacy Policy controls for anything specific to your Partner Bank Account. You can request a copy of the Partner Bank's Privacy Policy from us or directly from the Partner Bank using the contact details in Section 20.

D. Change of Partner Bank

If QR Pay Africa changes which bank holds Partner Bank Accounts, we will update this Policy and notify affected Users in advance of any change that affects how their Personal Information is processed as a result.

1. REGULATORY COMPLIANCE

QR Pay Africa operates as a financial technology platform and processes personal data in accordance with applicable laws and regulatory requirements, including but not limited to:

• The Kenya Data Protection Act, 2019
• Applicable Central Bank of Kenya (CBK) regulations
• Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) laws
• Payment card network rules (including Visa)
• Applicable data protection laws in jurisdictions where we operate
• International sanctions and compliance frameworks
• General Data Protection Regulation (GDPR) where applicable
• Gramm-Leach-Bliley Act (GLBA) where applicable

Where cross-border data transfers occur, we implement appropriate safeguards as required under applicable law, including intra-company agreements and model contractual clauses.

2. NON-ACCOUNT HOLDERS

Our Services may be accessed by individuals without a QR Pay Africa account or profile. We will collect Personal Information from you even if you are a non-account holder when you use our Services for example, when you receive a payment through QR Pay Africa from an account holder, or when you interact with our merchant payment systems.

If you pay without a QR Pay Africa account, we may link your transaction information with your QR Pay Africa account if you create one later.

3. TYPES OF PERSONAL DATA WE COLLECT

We collect personal data necessary to provide regulated financial services, prevent fraud, and comply with legal obligations. Categories of Personal Information collected from you include:

A. Identification and KYC Information

• Full name and business name
• Date of birth
• National ID / Passport number
• KRA PIN (where applicable)
• ID photo or biometric verification data
• Residential and postal address
• Email address and phone number
• Signature (including electronic signature)
• Government-issued identification documents

B. Financial Information

• M-Pesa number and mobile money account details
• Bank account and routing numbers
• Payment card details (including card type, country code, CVV, IBAN)
• Transaction history and transaction details
• Wallet balances and account header information
• Remittance information
• Income information (where applicable)
• Online shopping cart and checkout information

C. Device and Technical Information

• IP address
• Device type and identifiers
• Operating system and platform
• Browser type and browser ID
• Machine ID
• Time zone, language, and screen resolution settings
• Cookie preferences
• Data collected through cookies and tracking technologies

D. Geolocation Information

We may collect precise or approximate location data through GPS, Wi-Fi, or mobile networks for fraud detection, regulatory compliance, risk monitoring, and to provide location-based services. We collect precise geolocation data from users while they are logged into their financial account. If location permissions are disabled, certain Services may not function properly.

E. Biometric Information

Where legally permitted and with your consent, we may collect facial recognition or biometric verification data, voice identification, photo identification, or face scans for identity authentication and fraud prevention including to verify your identity before you access accounts, recover passwords, update profile information, or manage payments.

Where you open a Partner Bank Account, the Partner Bank may also capture fingerprint biometric data as part of its own in-branch or KYC identity-verification process; this is collected and controlled by the Partner Bank under its own Privacy Policy, as described in Section 1A.

F. Communications and Support Data

• Call recordings when you contact customer service
• Chat transcripts and email correspondence
• Survey responses
• Information you provide about others if you choose to share it
• Vulnerability-related information provided by you

G. Professional and Business Information

• Business registration details
• Tax identification numbers and KRA PIN
• Beneficial ownership information
• Job title and contact details

H. Transaction and Experience Information

• Account balances and purchase history
• Seller and buyer information
• Shipping address and order tracking information
• Shopping activity and goods or services considered on partner sites

I. Inferred and Derived Data

Such as income estimates, browsing and purchasing habits, creditworthiness assessments, fraud and risk scores, and your preferences and shopping behaviour which we may infer based on your transactions and interactions with our Services.

J. Information Related to Legal Requirements

Such as information from external sanction lists, including name, date of birth, place of birth, and occupation, consistent with applicable law.

K. Partner Bank Premises and Account-Opening Information

If you visit a Choice Microfinance Bank Limited branch in connection with your Partner Bank Account, the Partner Bank collects and controls the following data under its own Privacy Policy, not this one: (i) CCTV footage recorded at its premises for safety, security, and crime-prevention purposes; and (ii) where you use the Partner Bank's guest WiFi, your email address and device information, together with logs of sites visited and traffic duration/timing. QR Pay Africa does not control or receive this data except where the Partner Bank shares it with us as permitted by its own policy and applicable law.

4. DATA FROM THIRD PARTIES

We may obtain personal data from the following categories of sources:

• Licensed financial institutions and partner banks
• Payment processors and card networks (e.g., Visa)
• Mobile money operators (e.g., M-Pesa / Safaricom)
• Identity verification providers
• Fraud prevention and AML screening services
• Credit reference bureaus and public/private credit databases
• Government agencies and regulatory authorities
• Merchants and business partners
• Members of the QR Pay Africa corporate group
• Third-party applications you choose to use (e.g., app stores, social networks)
• Linked accounts you authorize (bank, card, or investment accounts)

We may combine information obtained from third parties with data you provide directly to us.

5. PURPOSES FOR PROCESSING PERSONAL DATA

We process personal data for lawful purposes, including:

Providing Our Services

• Enabling payment, wallet, remittance, and virtual card services
• Processing and settling transactions
• Displaying account balances and transaction history
• Administering purchases and verifying contact information
• Sending and receiving transactions and confirming execution

Identity Verification (KYC)

• Verifying your identity through KYC checks
• Authenticating access to your account
• Using electronic signatures and biometric verification
• Assessing creditworthiness in connection with our Services

Fraud Prevention and Financial Crime

• Preventing fraud and detecting suspicious activity
• Conducting AML and sanctions screening
• Risk monitoring and financial risk management
• Investigating and enforcing violations of our User Agreement

Regulatory Compliance

• Complying with regulatory reporting obligations
• Complying with AML, KYC, and bookkeeping laws
• Reporting to tax authorities and law enforcement where required
• Conducting sanctions screening

Dispute Management

• Managing disputes and chargebacks
• Defending legal claims and establishing legal rights

Analytics and Service Improvement

• Improving Services and conducting analytics
• Developing new products and features
• Data analysis, testing, and research
• Generating aggregated business insights

AI and Automated Decision Making

We may use Personal Information to train AI models that power our Services and help us deliver more secure, efficient, and personalized services. QR Pay Africa uses Automated Decision Making to conduct risk analysis, fraud prevention, and risk management. See Section 14 for more details.

Communication

• Communicating important account updates
• Responding to customer service inquiries
• Marketing our Services where permitted

Security

• Ensuring system and platform security
• Preventing unauthorized access to our Services

We do not sell personal data.

6. LEGAL BASIS FOR PROCESSING

We process personal data based on one or more of the following lawful grounds:

• Performance of a contract — to provide the Services you have requested
• Compliance with legal and regulatory obligations — including AML, KYC, and financial regulations
• Legitimate business interests — such as fraud prevention, risk management, and improving our Services
• Your consent — where required by applicable law, including for biometric data and precise geolocation

Where consent is required, you may withdraw it at any time, subject to regulatory limitations. Withdrawal of consent will not affect the lawfulness of processing conducted prior to withdrawal.

Under the EU and UK GDPR, we apply equivalent lawful bases, including "legitimate interests" and "vital interests" where applicable.

7. DISCLOSURE OF PERSONAL DATA

We may disclose personal data to the following categories of recipients.

We will not disclose your Personal Information to any individual or entity that we know is acting beyond its legal mandate.

A. Financial and Payment Partners

Including Choice Microfinance Bank Limited, our Partner Bank, which independently controls Personal Information relating to your Partner Bank Account (see Section 1A); correspondent banks; card networks (e.g., Visa) and payment processors; and mobile money and interoperability providers, including M-Pesa, Airtel Money, T-Kash, and ATM switch providers.

B. Regulatory and Law Enforcement Authorities

Where required by law, subpoena, court order, regulatory request, or where we have a good faith belief that sharing the information is necessary to comply with applicable law, prevent physical harm, or report suspected illegal activity.

C. Service Providers

Third-party vendors assisting with fraud monitoring and prevention; cloud hosting and IT infrastructure; payment processing; AI and data analytics; audit and compliance services; and marketing, research, and customer service operations. All service providers are contractually obligated to protect personal data and may only use it for the purposes for which it was disclosed.

D. Transaction Counterparties

When you send or receive funds, certain information (such as your name, phone number, email, and transaction details) may be disclosed to the other party involved in the transaction as necessary to complete the payment and deliver goods or services.

E. Other QR Pay Africa Account Holders

In accordance with your account settings, your information (such as username, profile photo, name, email, and city) may be seen by other account holders to facilitate a transaction. You can adjust these settings in your account's Data and Privacy section.

F. Merchants and Business Partners

We may disclose Personal Information with merchants and partners to enable their use of our Services, facilitate your transactions, and where you have consented, to personalize services and offers.

G. Credit Reporting and Debt Collection Agencies

We may disclose Personal Information with credit reference bureaus and debt collection agencies to manage creditworthiness, collect unpaid debts, and prevent fraud. These parties' own privacy policies govern their processing of your data.

H. Corporate Transactions

In the event of merger, acquisition, restructuring, or insolvency, personal data may be transferred to relevant parties subject to confidentiality protections and applicable data protection terms.

I. Your Authorized Agent or Legal Representative

We may disclose Personal Information to your agent or legal representative, such as the holder of a power of attorney, a guardian, or another authorized representative.

J. Fraud Prevention and Identity Verification Agencies

We may disclose Personal Information with fraud prevention agencies and identity verification companies across industries to assist in detecting activities suggestive of fraud, money laundering, or financial crime.

8. CROSS-BORDER DATA TRANSFERS

QR Pay Africa may store and process data in jurisdictions outside Kenya, including the United States and other countries where our service providers operate. These countries do not always afford a level of privacy protection equivalent to the protection offered in your country.

We have taken and will continue to take specific steps to protect your Personal Information in cross-border transfers, including intra-company data transfer agreements, model contractual clauses approved by relevant regulators, and other appropriate safeguards as required by applicable law.

By using our Services, you acknowledge and consent to international data transfers as described in this Policy.

9. DATA RETENTION

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following criteria: maintaining your account throughout the duration of your relationship with us; complying with AML, KYC, and regulatory requirements (minimum 7-10 years for financial transaction data, or longer if required by law); fulfilling contractual obligations and enforcing our agreements; resolving disputes and defending legal claims; and compliance with applicable bankruptcy laws.

Biometric data is retained for as long as needed for the purpose for which it was collected and no more than 3 years after your account closes, unless otherwise required by applicable law.

Where retention is required by ongoing litigation, investigations, audit and compliance practices, or to protect against legal claims, we retain data for the least amount of time necessary for those purposes.

Records relating to your Partner Bank Account are additionally retained by the Partner Bank in accordance with its own retention schedule and applicable Central Bank of Kenya banking-records requirements, which may differ from the retention periods above; see the Partner Bank's Privacy Policy for details.

10. SECURITY MEASURES

We implement administrative, technical, and physical safeguards to protect your Personal Information against loss, misuse, interference, unauthorized access, disclosure, and alteration. Our security measures include encryption of data in transit and at rest; firewalls and intrusion detection systems; physical access controls to our data centres; information access authorization controls; secure servers and monitoring systems; and regular security audits and compliance reviews.

You are responsible for safeguarding your login credentials and maintaining the privacy of your account information. We are not responsible for protecting Personal Information shared with a third party based on a linked account connection that you authorized.

In the event of a data breach, we will notify affected users and relevant regulatory authorities as required by applicable law, including the Kenya Data Protection Act, 2019.

11. CHILDREN'S PRIVACY

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors without lawful authority. If we obtain actual knowledge that we have collected Personal Information from someone under the age of 18 or otherwise not allowed to use our Services, we will promptly take steps to delete it, unless retention is legally required.

Where a Partner Bank Account would otherwise be opened for a User under 18 (including under any limited Services available to younger users in specific jurisdictions), the Partner Bank will only open that Account where a parent or legal guardian additionally registers on the minor's behalf, consistent with the Partner Bank's own policy. We encourage you to review our Terms and this section together, and we are working to align the age thresholds stated across our Terms and this Policy.

Please contact us at privacy@qrpayafrica.com if you believe that we have mistakenly or unintentionally collected information from a minor.

12. COOKIES AND TRACKING TECHNOLOGIES

When you interact with our Services, open emails we send you, or visit third-party websites for which we provide Services, we and our partners use Cookies to: authenticate users and grant access to our Sites and Services; recognize you as a user and remember your preferences; prevent fraud and promote trust and safety; analyse usage and improve our Services; serve interest-based advertising; and perform analytics and generate device information.

Certain aspects and features of our Services are only available through the use of Cookies. If you choose to disable or decline Cookies through your device or browser settings, your use of the Sites and Services may be limited or not possible.

Do Not Track

Some web browsers have an optional "Do Not Track" (DNT) setting. Because many of our services rely on tracking data to function, we do not respond to DNT settings unless required by applicable law.

Third-Party Cookies

We may use authorized service providers to help serve you relevant advertisements on our Services and other places on the internet. These service providers may place cookies on your device and collect information that helps them identify your device, such as IP address or other unique identifiers.

13. YOUR DATA PROTECTION RIGHTS

Subject to applicable law and certain exceptions, you may have the following rights regarding your Personal Information:

• Right to Access — Request a copy of the Personal Information we have collected about you
• Right to Correct — Request correction of inaccurate or incomplete data
• Right to Delete — Request deletion of your Personal Information (subject to regulatory retention obligations)
• Right to Restrict Processing — Request that we restrict processing in certain circumstances
• Right to Object — Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent — Where processing is based on consent, withdraw it at any time
• Right to Data Portability — Receive your data in a structured, machine-readable format where applicable
• Right to Lodge a Complaint — With the Office of the Data Protection Commissioner (Kenya) or other relevant supervisory authority

Certain rights may be limited where processing is required by financial regulations, AML obligations, or other applicable law.

How to Exercise Your Rights

To exercise any of the above rights, you or an authorized agent may: log in to your QR Pay Africa account and access your account settings; contact us at privacy@qrpayafrica.com; or write to us at the address listed in Section 20.

For anything specific to your Partner Bank Account, you may also exercise your rights directly with the Partner Bank by visiting any Choice Microfinance Bank Limited branch or emailing risk@choice-bank.com; see Section 20 for the Partner Bank's Data Protection Officer contact details.

We may need to verify your identity before responding to your request. If we cannot verify your identity, or if we deny your request in whole or in part, we will provide you with the reasons and information on how to appeal or lodge a complaint.

Authorized Agents

If we receive your request from an authorized agent, we may ask for evidence of a power of attorney or other valid written authority confirming the agent is authorized to act on your behalf.

Non-Discrimination

We will not discriminate against you or deny Services, charge different prices, or provide a different level of service solely because you exercised your privacy rights. However, certain personalized Services may not provide the same level of personalization if you limit the Personal Information you share with us.

14. AI AND AUTOMATED DECISION MAKING

Automated Decision Making

QR Pay Africa uses Automated Decision Making technology to make assessments or decisions, including those related to risk, fraud, and creditworthiness, where permitted and in accordance with applicable law. Our Automated Decision Making technology may use profiling techniques to evaluate personal aspects about you including analysis of your economic situation, reliability, and behavior to assess whether you display traits indicating possible credit or financial risk, money laundering, or fraudulent activity.

If we determine that you pose a credit, fraud, money laundering, or other risk, we may refuse to provide new services, stop providing services you currently use, or place limits on the services you use.

QR Pay Africa maintains ongoing oversight of our decision models and random sampling in individual cases to ensure decisions are appropriate. If you have concerns about an automated decision outcome, please contact us at privacy@qrpayafrica.com and we will review whether the procedure was performed appropriately.

In jurisdictions where applicable law provides such rights, you may seek a review of, or object to, an Automated Decision that has legal or similarly significant effects on you.

AI-Powered Tools

QR Pay Africa may, directly or through trusted partners, provide AI-powered tools designed to operate with a degree of autonomy to perform tasks, make recommendations, and assist with certain actions on your behalf. These tools leverage generative AI technology to enhance your experience on the QR Pay Africa platform.

These tools are intended to provide general assistance and are not designed to make decisions with legal, medical, financial, or employment implications. You should not rely on them to replace your own judgment and expertise.

AI tools require access to certain information to function, including your queries, preferences, interests, transaction history, and payment information.

15. CREDITWORTHINESS AND FINANCIAL RISK MANAGEMENT

Pursuant to applicable law, we will use and exchange Personal Information about you with Credit Reference Bureaus (CRBs) to: assess creditworthiness and product suitability; check your identity; trace and recover debts; prevent fraud and criminal activity; and support compliance with capital adequacy requirements.

This information may be supplied by CRBs to other organizations to perform similar checks and to trace your whereabouts and recover debts that you owe.

16. THIRD-PARTY LINKS AND PLATFORMS

Our Services may contain links to third-party platforms, websites, or services. QR Pay Africa is not responsible for the privacy practices or content of those third parties. We encourage you to read the privacy policies of any third-party services you interact with.

17. LIMITATION OF LIABILITY

To the maximum extent permitted by law, QR Pay Africa shall not be liable for indirect, incidental, or consequential damages arising from unauthorized access to personal data, except where caused by our gross negligence or wilful misconduct.

18. COMMUNICATIONS AND YOUR CHOICES

You can control how Personal Information is collected or disclosed, as well as how we communicate with you:

Communication Preferences

• Click the unsubscribe link in any QR Pay Africa marketing email
• Opt out of text messages by replying "STOP"
• Turn off notifications in your device or account settings

You cannot opt out of messages that are considered necessary for the Services, such as transaction receipts and alerts about account changes or security events.

Linked Accounts

If you link your QR Pay Africa account to a third-party service, you may manage how your Personal Information is collected and used by visiting your Security settings in your account.

Controlling Data Shared with Merchants

You may be able to adjust or limit the Personal Information shared with merchants and partners in the Data and Privacy section of your account settings.

19. DEFINITIONS

The following terms have the meanings set out below for the purposes of this Privacy Policy:

• Automated Decision Making refers to the process of making a decision by automated means without or with limited human involvement, which may have a legal or similarly significant effect on you.
• Cookies means tracking technologies such as cookies, pixel tags, web beacons, and similar technologies.
• Device Information means data automatically collected from any device used to access the Services, including device type, network connections, IP address, and browser information.
• Personal Information means any information that directly or indirectly identifies you or is reasonably capable of being associated with you, including your identity, finances, and online behaviour, as defined under applicable privacy laws.
• Profiling means analysis of an individual's personality, behaviour, interests, and habits to make predictions or decisions about them.
• Sensitive Personal Information means data such as National ID/Passport numbers, bank account and routing numbers, payment card information, biometric data, and precise geolocation data, as defined under applicable privacy laws.
• Services refers to all QR Pay Africa-branded payment, wallet, remittance, virtual card, merchant tools, and financial technology products and solutions, including related websites, platforms, mobile applications, and APIs.
• Sites means the websites, mobile apps, official social network platforms, or other online properties through which QR Pay Africa offers the Services.
• Users means account holders and non-account holders of the QR Pay Africa Services.
• Partner Bank means Choice Microfinance Bank Limited, the bank with which QR Pay Africa safeguards User funds and which opens and holds a Partner Bank Account for each User who signs up for Services that require one.
• Partner Bank Account means the bank account opened in your name at the Partner Bank as described in Section 1A.

20. CONTACT INFORMATION

If you have questions regarding this Privacy Policy, wish to exercise your rights, or want to report a concern, please contact:

Data Protection Officer

QR Pay Africa Limited; Email: privacy@qrpayafrica.com · Website: www.qrpayafrica.com

For complaints, you may also contact the Office of the Data Protection Commissioner (ODPC) of Kenya: www.odpc.go.ke

Partner Bank Data Protection Officer

For questions specific to your Partner Bank Account: Data Protection Officer, Choice Microfinance Bank Limited, Riverside Square, Riverside Drive, P.O. Box 29796–00100, Nairobi. Tel: +254 729 114 444 · Mobile: +254 731 225 879 · Email: risk@choice-bank