Kumo Privacy Notice

Please read this Privacy Notice carefully.

By accepting this Privacy Notice when signing up, registering, using our services, or visiting and using the Site, you acknowledge that you have read and understood this Privacy Notice and are consenting to our collection, use, and disclosure of your personal information in accordance with our Privacy Notice.

Created 18 November 2021

INTRODUCTION

You care about your personal information and how it is used. At Kumo, we also care about this. This is why we take your personal information seriously. When you use our Services, you’ll share some information about you with us. Some of this information may be private.

Because we care about your privacy, we have prepared this Privacy Notice to give you some peace of mind (as every experience with Kumo should be). With this Privacy Notice, you will know what information we collect, how we use it, and whom we share it with. You will also know the level of access and control you have over the information you share.

This Privacy Notice describes Kumo’s policies on the collection, use, and disclosure of your information in connection with your use of our Services and through other interactions and communications you have with us. These policies apply to persons anywhere in the world who use our Services.

Kumo allows users access seamless payment solutions from Africa to the world. These policies apply to persons anywhere in the world who use our Services to integrate Kumo as a checkout on your website, enabling you to accept payments with cards, bank accounts, and cryptocurrencies; use Kumo e-Wallet, enabling you complete transactions using your credit/debit cards, bank accounts, cryptocurrencies, and more; and use Kumo Card, a cryptocurrency card that enables spend select cryptocurrencies at competitive rates anywhere in the world.

Whenever you use our Services, you consent to the collection, storage, transfer, and use of your information as described in this Privacy Notice. This includes any information you choose to provide that is deemed sensitive under applicable laws and regulations.

We respect your right to privacy and we promise to abide by this Privacy Notice and applicable data protection and privacy laws or regulations.

Kumo has partners and supplies to whom we provide a variety of fulfillment, e-commerce-related services, and technology support. When you use Kumo, some of the Services we provide to you may connect you to our partners’ and suppliers’ sites. Kumo, its subsidiaries, and affiliated companies respect the privacy of our partners, suppliers, and clients and their customers. This Privacy Notice applies to the Kumo Site and App. It does not apply to websites or services that are neither owned nor controlled by Kumo. With this Privacy Notice, we are giving you the information you need to make the right choices and exercise the right options regarding the integrity, safety, and security of your personal information on our Website and App.

This Privacy Notice governs the manner in which Kumo collects, uses, maintains, and discloses information collected from users (a “User”) of the website http://Kumo.africa (“Site” or “Services”) or Kumo App. This Privacy Notice applies to the Site and App and all services offered by Kumo Africa. At Kumo ("we", "us" or "our"), we are committed to protecting and respecting your privacy. The security of your personal information is very important, hence this conversation. When you use the services on Kumo, you’ll share some information about you with us. With this Privacy Notice, you will know what information we collect, how we use it, and whom we share it with. You will also know the level of access and control you have over the information you share.

Whenever you use our Services, you consent to the collection, storage, transfer, and use of your information as described in this Privacy Notice. This includes any information you choose to provide that is deemed sensitive under applicable laws and regulations. In order to continue to improve your experience and services we offer to you on our platform at all times, we may need access to certain data on your mobile phone, PC, tablet, or other devices. We respect your right to privacy and we will protect it as we promise to abide by this Privacy Notice and applicable data protection and privacy laws or regulations.

INFORMATION THAT WE COLLECT AND HOW THE INFORMATION IS COLLECTED

When you visit our Website or use our App: We collect your Personal Information if you use http://kumo.africa or use our App and open an account to use the platform or perform any

transactions on the platform. We collect personal information such as email address and password to enable you sign up for our services.

When you create an account with us, we collect your Personal Information for your user profile namely your full name, phone number, and your local currency. And when you have a Kumo e- Wallet, we collect the information that you provide to fund your wallet such as through credit/debit card to wallet and crypto to wallet; transfer funds wallet to wallet, wallet to account, and wallet to crypto; to store details of your transaction history; complete utilities transactions such as purchase airtime, pay for data, tv subscription, electricity bills, send SMS, etc; and update your profile. Please note that if you refuse to share your Personal Information for this purpose we will not be able to provide the Services to you.

Apart from getting your personal information when you register or sign up at Kumo Site or App, we may also obtain your personal information through verification. This personal information may include full name, email address, identity card, business registration or incorporation certificates, and phone number, and other additional personal information we may require to complete your transactions.

As a payment-solutions platform, we also collect transactional information and all reasonable information relating to the transaction. This may include account name, account number, email address, transaction amount, geolocation, IP, and participant/recipient data.

If you contact our support team, we collect the information you give us during the interaction. Sometimes, we monitor or record these interactions for training purposes and to ensure high-quality service.

If you participate in our surveys, we collect your insights into the Services and responses to our questions. You may choose whether to participate in any survey.

When you visit our Website or App, we may also collect information that does not necessarily reveal your identity directly but may include information about the specific device you are using or location, such as the hardware model, operating system version, web-browser software (such as Chrome, FireFox, Internet Explorer, Safari, etc) and your Internet Protocol (IP) address/MAC address/device identifier. In some countries, this information may be considered Personal Information under applicable data protection laws.

We also automatically collect and store certain information in server logs such as: statistics on your activities on our Website, and products; information about how you came to and used our Website, and products; your IP address; device type and unique device identification numbers, device event information (such as crashes, system activity and hardware settings, browser type, browser language, the date and time of your request and referral URL), broad geographic location (e.g. country or city-level location) and other technical data collected through cookies, pixel tags, and other similar technologies that uniquely identify your browser. We may also collect information about how your device has interacted with our website, including pages accessed and links clicked. In some countries, this information may be considered Personal Information under applicable data protection laws.

Information collected through Third Parties: As a payment-solutions platform that work with partners and supplies, we may collect personal information from third-party source. The purpose is to fulfill a service to you on their behalf. Third parties that assist us with our business operations also collect information through the Services. We may engage service providers to collect information to help us secure the Services and detect and prevent fraud. We may receive information about you from our advertising partners such as when advertising campaigns are published through the Services. Some of this information is collected through the technology described below.

Cookies: Like most major websites, Kumo uses cookies on the Website. Cookies are pieces of information that a website transfers to a user’s hard drive for record-keeping purposes while visiting a Website. Cookies make using the Internet easier by, among other things, saving your passwords and preferences for you. For example, a cookie lets the Website remember that you have registered, which allows us to speed up your future activities on the Website, and which allows you to enter your password/log in ID less frequently while visiting the Website. Our cookies do not contain any personally identifying information, though cookies may enable us to relate your use of the Website to personally identifiable information that you previously submitted.

The Services use the following cookies: Strictly necessary cookies, which are required for the operation of the Services. Without them, for example, you would not be able to register or log in for the Services that we may offer. Analytical/performance cookies, which allow us to recognize and count the number of visitors, to learn how visitors navigate the Services and to help us to improve the way Services function. Functionality cookies, which are used to recognize you when you return to the Services. We also use Google Analytics which is a Google service that collects information about use of the Services. Google Analytics does not identify individual users.

Your Control of Cookies: Some web browsers (including some mobile web browsers) provide settings that allow you to control or reject cookies or to alert you when a cookie is placed on your computer, mobile device, or tablet. You also may be able to reject mobile-device identifiers by activating the appropriate setting on your mobile device. Although you are not required to accept cookies or mobile device identifiers, if you block or reject them, you may not have access to all features available through the Services.

Our Policy on Do Not Track (DNT) Signals: Some web browsers including Chrome, Firefox, Internet Explorer, and Safari incorporate a DNT or similar feature that signals to websites that a user does not want to have his or her online activity and behaviour tracked. If a website that responds to a particular DNT signal receives the DNT signal, the browser can block that website from collecting certain personal information about the browser’s user. Not all browsers offer a DNT option and DNT signals are not yet uniform. For this reason, many website operators, including Kumo, do not respond to DNT signals.

In connection with using certain Kumo services, we may automatically collect certain data relating to the performance and configuration of the Kumo services, our customers’ and their end-users’ consumption of and interaction of such services (Usage Data). Usage Data is generally technical information obtained from product software or systems hosting the services, devices accessing these products and services, and/or log files generated during such use which typically does not directly identify an end-user.

HOW WE USE THE INFORMATION WE COLLECT

Kumo may use information collected when you visit our Website for the following business purposes:

• To provide and maintain our services;

  
  

• To allow you to open and operate an Account;

  
  

• To set up and maintain your Account and Wallets;

  
  

• To enable you to complete Transactions on the platform;

  
  

• To notify you about changes to Kumo

  
  

• To correspond with you in relation to your Account and your Transactions;

  
  

• To analyse use of Our Site and the services we provide;

• To provide Customer care and support;

  
  

• To monitor the usage of Our website;

  
  

• To detect, prevent, and address technical issues;

  
  

• To allow you to participate in interactive features of Kumo when you choose to do so;

  
  

• As required for legal and regulatory purposes, including for dispute- resolution purposes;

  
  

• To provide you with information about services and promotions that may be of interest to you, from ourselves and third parties;

• For market research e.g. surveying our Users’ needs and opinions on issues, such as our performance.

  
  

• To ensure legal compliance;

  
  

• Comply with legal requirements; and

  
  

• Enforce or exercise our rights and for other legitimate purposes.

Legal Bases for Collecting Your Personal Information

Please note that you are not obliged to share your Personal Information with Us. But if you refuse to share the Personal Information we require from you for the purpose of providing our services, we will not be able to provide our services to you. To use your information as described above, we rely on the following legal bases:

Provide the Services to You: We process your information to perform the contract (Terms of Service) that you have with us.

Legitimate interests: We use your information for legitimate business interests when permitted by law. For example, we analyse users’ behaviour on the Services to improve them, for direct marketing and for administrative use, fraud detection, and other legal purposes.

Consent: From time to time, we may ask for your consent to use your information for certain specific reasons. You may withdraw your consent at any time by contacting us using the contact information provided at the end of this Privacy Notice.

HOW WE SHARE INFORMATION WE COLLECT

We may share personal information about you with third parties in the following circumstances:

Kumo Family of Companies: We may share your information with our parent companies, subsidiaries, or affiliates. This information may be shared and used to provide services and support, provide recommendations to optimize product and service use, provide customers and prospective customers with information about our range of available products and services, and for the purposes otherwise described in this Privacy Notice.

Corporate Transaction: We may share and transfer information if we are involved in a merger, sale, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy, or other change of ownership or control by Kumo or any affiliated company (in each case, whether in whole or in part).

Service Providers: We may share your information with third parties, such as agents, consultants, vendors, and other service providers who work on our behalf. Examples include service providers and vendors who provide assistance with billing, customer service, data analysis and insight, processing credit or debit card payments, and technical support. Unless described in this Privacy Notice, we do not share, sell, rent, or trade any of your personal information with third parties for their own promotional purposes.

Google Analytics

Kumo controls the personal data of the user’s and the Google Analytics serves also as a controller and processor. Google Analytics is a web-analytics service offered by Google. It tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network.

You can opt-out of having your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visits activity.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en

Vital interests: We may disclose information where we deem it necessary for the purposeof protecting the vital interests of any person.

Compliance with Laws: In compliance with laws or any competent law-enforcement body, court, government agency, regulatory body, or third party, we may disclose information where we believe disclosure is necessary or required (i) by law or regulation, in order to comply with legal process or government requests (including in response to public authorities to meet national security or law enforcement requirements); (ii) to exercise, establish, or defend our legal rights; (iii) to prevent or investigate possible wrongdoing in connection with our website; or (iv) to protect the personal safety of users of our website or the public.

Kumo will not give you notice of requests for your personal information made by law enforcement. If Kumo is required to respond to court orders, subpoenas, or required to respond to other legitimate requests for your personal data from appropriate law enforcement, we are mandated to comply. Our compliance is necessary to protect against fraud, money laundering, or terrorism financing. We will also release such personal information to cooperate with law enforcement or other governmental investigations to comply with all valid court orders or subpoenas; protect our legal rights and those of our users; or when we believe it is needed for protecting against fraud or reducing credit risk. Kumo also reserves the right to report any activities that we believe to be unlawful and this will be without prior notice to you.

With your consent: We may disclose your personal information for any purpose with your consent subject to compliance with law.

Other legitimate business purposes: We may share your personal information when it is necessary for other legitimate purposes such as protecting Kumo confidential and proprietary information or where necessary to support, respond to, and provide our products and services to our customers. As a general rule, Kumo will not share, rent, sell, or otherwise disclose any of your personal information, except with your permission. We use and disclose personal information for the purposes that we have disclosed to you, except as otherwise permitted by law. We will request your consent before we use or disclose your information for any materially different purpose. Unless

specifically described below, consent may be obtained in any legally sufficient method. For example, depending on the circumstance and the laws of your jurisdiction, consent may be obtained by providing you with notice and the opportunity to opt-out.

In addition, Kumo may aggregate information collected through the Services and remove identifiers so that the information no longer identifies or can be used to identify an individual (Aggregated Information). Kumo shares Aggregated Information with third parties and does not limit third parties’ use of the Aggregated Information.

HOW WE SECURE YOUR INFORMATION

Except as described above, we do not reveal information about you to unaffiliated third parties. We restrict access to nonpublic personal information about you to those Kumo employees who need to know that information to provide products or services to you. Kumo maintains (and requires its service providers to maintain) appropriate organizational and technical measures designed to secure your information and to protect it against unauthorized or unlawful use and accidental loss or destruction, including: Employing physical access controls, encryption, Internet firewalls, intrusion detection, and network monitoring depending on the nature of the information and the scope of processing; providing access to your information to the minimum extent necessary, subject

to confidentiality restrictions where appropriate, and on an anonymized basis wherever possible; and requiring our employees to keep all personal information confidential.

All information you provide to us are stored on secure servers in a controlled environment with limited access. Any payment transactions will be encrypted using Secure Socket Layer (SSL) technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

While no transmission of information via the internet is completely secure, we take reasonable measures to protect your personal data. We cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

You are responsible for maintaining the security of your account, including the device on which you store your wallet. Access to the services through your account is treated as authorized by you.

Unauthorized access to password-protected or secure areas is highly prohibited and may lead to criminal prosecution. We may suspend your use of all or part of the Services with or without notice if we suspect or detect any breach of security. If you believe that the information you provided to us is no more secure, please notify or contact us immediately using the contact information provided below.

We keep your personal information in identifiable form only as long as we need it for the lawful purpose for which we collected it, or if longer or shorter, to comply with Law, to resolve disputes, or to enforce agreement with you.

HOW LONG WE RETAIN YOUR INFORMATION?

We will retain personal information we collect from you where we have a justifiable business need to do so or for as long as it is needed to fulfil the purposes outlined in this Privacy Notice. Unless a longer retention period is required or permitted by law (such as tax, legal, or other purposes), we retain your information securely throughout the duration of your relationship with us and for a minimum of three years thereafter as necessary to comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. You can request deletion of your personal information at any time (see ‘Your Privacy Rights’ section below for further information) and we will consider your request in accordance with applicable laws.

When we have no justifiable business need to process your personal information, we will either delete or anonymize it, or if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

YOUR PRIVACY RIGHTS

Updating Your Information: If you would like to update personal information that you have provided to us, please logon to https://kumo.africa/settings/profile/

<strong> Additional Rights for the EEA and Certain Other Territories: </strong If you reside in certain territories (such as the European Economic Area), you may have the right to exercise certain privacy rights available to you under applicable laws such as the General Data Protection Regulation (GDPR). We will process your request in accordingly. We may need to retain certain information for record-keeping purposes or to complete transactions that you began prior to requesting any deletion.<br>

<strong> Right not to provide consent or right to withdraw consent: <strong>We may seek to rely on your consent in order to process certain personal information. Where we do so, you have the right not to provide your consent or right to withdraw your consent at any time. This does not affect the lawfulness of the processing based on consent before its withdrawal or information for which consent is not required.<br>

<strong> Right of access :</strong> You may have the right to access the personal information that we hold about you. For details on how to access your personal information collected and held by us, and how to update that information or correct factual errors in it, please contact us

at dataprivacy@kumo.africa. We may retain original and updated information for reasons such as agreement enforcement, dispute resolution, record-retention requirements, technical constraints, troubleshooting. For security purposes, we may request information to help verify your identity before granting access or making changes to the information.<br>

<strong> Right of erasure :</strong>: In certain circumstances, you may have the right to the erasure of personal information that we hold about you (for example if it is no longer necessary for the purposes for which it was originally collected) except, where it is not consistent with our legal and regulatory obligations.<br>

<strong> Right to object to processing: </strong>You may have the right to request that we stop processing your personal information or stop sending you marketing communications.<br>

<strong> Right to correct </strong>: You may have the right to require us to correct any inaccurate or incomplete personal information.

<strong> Right to restrict processing </strong>: You may have the right to request that we restrict processing of your personal information in certain circumstances (for example, where you believe that the personal information we hold about you is not accurate or lawfully held). If our client requests Kumo to remove the data, we will respond to it and delete, amend or block access to any Personal Information that we are storing only if we receive a written request to do so from our client who is responsible for such Personal Information, unless we have a legal right to retain such Personal Information. We reserve the right to retain a copy of such data for archiving purposes or to defend our rights in litigation.

LINKED WEBSITES AND OTHER THIRD PARTIES

This Privacy Notice only addresses the use and disclosure of information we collect from you. There may be links from our sites or App and resources provided by third parties. This Privacy Notice applies only to our sites or App. Accessing those third-party sites or sources requires you to leave our sites. We do not control those third-party sites or any the content contained therein, and you agree that we are in no way responsible or liable for any of those third-party sites, including, without limitation, their content, failures, policies, promotions, products, services, or actions and any damages, losses, failures or problems caused by, related to, or arising from those sites. We encourage you to review all policies, regulations, rules, and terms, including the privacy policies, of each site you visit or app you use.

Third Parties A: Airtime Service Providers

Third Parties B: Data Service Providers

Third Parties C: Cable TV Providers

Third Parties D: Electricity Services Providers

Third Parties E: Educational Services e.g WEAC (Scratch Card)

Third Parties F: SMS Service Providers

INTERNATIONAL DATA TRANSFERS

Your information, including Personal Data, may be transferred to countries other than the one you live in. This means your Personal Data may be maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction. Personal information, including personal information collected in the European Economic Area (EEA) or Switzerland, may be transferred, stored, and processed by us and our services providers, partners, and affiliates in Nigeria, the United States, and potentially other countries whose data protection laws may be different to the laws of your country, for example to Canada. We will not transfer Personal Information originating in the EU or Switzerland to third parties unless such third parties have met the requirement of providing at least the same level of privacy protection to your Personal Information as required by the Principles of the EU-US Privacy Shield Framework, the Swiss-US Privacy Shield Framework, andthe Data Protection Guidelines 2019 of the National Information Technology Development Agency (NITDA) in Nigeria

We will only transfer data to our agents, resellers, or third party service providers (such as accountants, attorneys, consultants, and other service providers) who need the information in order to provide services to or perform activities on behalf of Kumo, including in connection with the delivery of services or products, Kumo administration, management, or legal responsibilities.

Your consent to this Privacy Notice by use of the Services followed by your submission of such information represents your agreement to that transfer.

Kumo will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

BLOGS AND SOCIAL MEDIA

Our Website may include social media features, such as Facebook Like button and widgets such as the Share button. These features may collect your IP address, which page you are visiting on our site, and may set a cookie to enable the feature to function properly. Social media features and widgets are hosted on our site or by a third party, and your interactions with these features are governed by the Privacy Notice of the company providing it.

Our website or other online community may include publicly accessible blogs or community forums. Any information you provide in these areas may be read, collected and used by others who access them. This includes information posted on our public social media accounts. Be advised to guard your personal data responsibly.

CHILDREN'S PRIVACY

Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and monitor and guide

children’s online activity. Our Website, products, and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from such individuals. If you become aware that a child has provided us with Personal Information, please contact us at dataprivacy@Kumo.africa If we become aware that an individual under the age of 18 has provided us with personal information, we will take steps to delete such information.

CHANGES TO THIS PRIVACY NOTICE

We may update our Privacy Notice from time to time. We will notify you of any changes by posting the new Privacy Notice on this page. We will let you know via email or with a prominent notice on our Website, prior to the change becoming effective and update the effective date at the top of this Privacy Notice. Your continued use of the Services after the effective date constitutes your acceptance of the amended Privacy Notice. The amended Privacy Notice supersedes all previous versions. You are advised to review this Privacy Notice periodically for any changes.

CONTACT US

If you have any questions about our privacy policies; want to exercise your right to see a copy of the information that we hold about you; think that information we hold about you may need to be corrected; want to delete all or any part of your information; want to object to the processing on legitimate grounds; or you have a particular complaint, please email dataprivacy@Kumo.africa with enquiry topic ‘Data privacy’ or alternatively send a signed letter addressed to:

Data Protection Officer