Funamu Privacy Policy

This policy explains what personal data Funamu collects, why, who sees it, where it is stored, how long it is kept and the rights you have. It applies to everyone who uses Funamu: customers, merchants and their workers, Delivery Partners, PUDO Partners, Funamu workers, job applicants and visitors to funamu.com.

1. Who is responsible

DOBOKAKA UG LTD (registration number 80034078892868), which runs Funamu, is the data controller for the personal data described here. Address: Kisenyi, Kakiri Town Council, Wakiso District, Uganda; P.O. Box 118605, Wakiso. Email: info@funamu.com. Telephone: 0794 517 813.

We follow the Data Protection and Privacy Act, 2019 of Uganda and its Regulations. Our data protection officer can be reached at info@funamu.com (subject: "Data protection").

2. What we collect, and whether you must give it

Account (all users). Name, email address, date of birth (to confirm you are 18 or older), gender, password (stored only in a protected form we cannot read), profile picture if you add one, and your Google account's name and email if you choose Continue with Google. Name, email, date of birth and password are needed to open an account; without them we cannot open one. A profile picture is optional.

Shopping. Orders, carts, favourites, delivery locations you save and the location you choose for a delivery, returns, refunds, reviews, and the messages and photos you send in chats. These are needed to take and deliver your orders.

Payments (financial information). The mobile money number you pay with or are paid to, the amounts, payment results and payout history. For merchants and partners: your payout account and earnings. We never see or store your mobile money PIN. The law treats financial information as special personal data; we process it with your consent, given when you create your account, and only to take payments, pay refunds and payouts, keep accounts and prevent fraud.

Partners.

• Merchants: business and owner details, documents needed for verification and for licensed products, the payout account, listings, photos and videos.
• Delivery Partners: an identity document and a face photo for verification, vehicle details, and your location while you are online (section 5).
• PUDO Partners: location details, opening hours, the people who work there, identity documents for verification and the activity at the counter.

Handover records. Who handed over, who received, the time and, where the phone allows it, the place. PINs are stored only in a protected form.

Funamu workers and job applicants. Application details and CVs, employment and payroll records, the modules and cities a worker may use, and a log of what each worker opens and changes.

Technical. Device type, app version, error reports, security logs, and the sign-in sessions on your devices. Product usage events are collected only if Funamu switches them on, and are deleted after the period set for them.

Website and cookies. funamu.com uses only cookies needed for it to work, such as keeping a merchant signed in on the website. We use no advertising or tracking cookies, so we do not ask for cookie consent. If you leave your email for the app launch list, we use it only to tell you when the app is available.

3. Why we use it, and on what basis

| Purpose | Basis under the Act |

|---|---|

| Running your account, orders, payments, delivery, collection, returns, refunds and payouts | Performance of the contract with you (s.7(2)(c)); your consent for financial information (s.9(3)(b)) |

| Confirming who is who: email codes, verification of merchants, Delivery Partners and PUDO Partners, handover PINs | Contract; legal obligations where a licence or the law requires the check |

| Keeping Funamu safe: preventing fraud and off-platform deals, settling disputes, enforcing our rules | Contract; prevention and detection of offences (s.7(2)(b)(iii)) |

| Help: Funamu AI, the Help Center and Funamu Support | Contract; your consent when you choose to use Funamu AI |

| Messages about your orders and account by email and app notifications | Contract |

| Offers from Funamu or from a merchant | Your consent only; you can withdraw it at any time |

| Accounts, tax and legal records | Legal obligation (s.7(2)(e)) |

We do not sell personal data. We do not make decisions that significantly affect you based only on automated processing: automated fraud and messaging checks only flag a case, and a person decides. If that ever changes, you have the right to ask for a person to reconsider (s.27).

4. Who can see it

Only the people who need it for an order see it, and only what they need:

• The merchant sees your name, what you ordered and how it reaches you. A merchant may contact you about offers only if you agreed to offers from that merchant in the app.
• The Delivery Partner carrying your order sees your name, the delivery location and a way to contact you while the delivery is open.
• The PUDO Partner holding your parcel sees what they need to hand it over to you.
• Funamu workers see what their job needs, limited to their modules and cities, and their access is logged.

Service providers who process data for us under contract:

| Provider | What for | Where |

|---|---|---|

| Amazon Web Services (AWS) | Hosting the service and database, sending email | Sweden (European Union) |

| Paytota | Taking payments and sending payouts and refunds, through MTN Mobile Money and Airtel Money | Uganda |

| Cloudflare | Storing photos, videos and files; the funamu.com domain | Global network; storage location chosen by Cloudflare |

| Mapbox | Maps, addresses and routes | United States |

| OpenAI | Producing Funamu AI's replies when you use it | United States |

| Google | Continue with Google, if you use it | United States |

| Expo and your phone's notification service | Delivering app notifications | United States |

We may disclose information when the law requires it, or to protect the safety of people using Funamu.

5. Location

• Customers: we use the delivery location you choose, and your phone's location only when you allow it, for example to find nearby merchants and PUDOs.
• Delivery Partners: while you are online, the app shares your location so offers, tracking and handovers work. When you go offline, location sharing stops.
• Handovers record the place where the phone allows it.

6. Storage outside Uganda

Our servers are in Sweden, in the European Union, whose data protection law is at least equivalent to Uganda's. Some providers in the table above process data in the United States or on a global network. The Act allows this where the protection is adequate or where you consent (s.19). When you create your account you consent to this storage and processing outside Uganda. We choose providers that contract to keep your data confidential and secure. Those providers may not pass it on except as their contract with us allows.

7. Funamu AI

When you chat with Funamu AI, your messages and the information needed to answer (such as product results and your cart) are sent to OpenAI to produce a reply. Funamu AI only sees what your own account can see. Conversation content is deleted after 90 days. Do not share passwords, PINs or payment details in a chat.

8. How long we keep it

| Data | Kept for |

|---|---|

| Account details | While your account is open. On deletion your name and contact details are removed |

| Your messages and photos in chats, after you delete your account | 90 days, then erased |

| Funamu AI conversation content | 90 days |

| Evidence of a messaging-policy case | 90 days after the case and any appeal close (Operations may set 30 to 730 days) |

| Identity photos of a rejected or unsent verification | 30 days |

| Identity photos after a Delivery Partner closes their account | 365 days (the 12-month reopening period), then deleted |

| Orders, payments, refunds, payouts, invoices and the ledger | At least 5 years after the transaction, as tax law requires, kept without your name after account deletion |

| Security logs | As long as needed to protect the service |

When a period ends, the data is deleted or de-identified (s.18).

9. Your rights

You can:

• see the information we hold about you (More > Profile & preferences > What I know about you), and ask for a copy (s.24);
• have wrong information corrected, and have information erased that we no longer need or may not keep (s.28);
• object to processing, or ask us to stop it, where it is not needed for your contract or the law (s.7(3), s.25);
• stop direct marketing at any time: use the unsubscribe link or the notification settings, or write to us. We confirm within 14 days (s.26);
• withdraw a consent. Withdrawing consent to financial information or to storage outside Uganda means we can no longer run payments or your account, so we will close it after settling anything owed;
• ask for a person to reconsider an automated decision (s.27).

To use these rights, use the app or write to info@funamu.com. We answer within the time the law sets. If you are not satisfied, you can complain to the Personal Data Protection Office of Uganda.

10. How we protect it

Encryption in transit and at rest, protected storage for passwords and PINs, private files shared only through short-lived links, a second sign-in step for Funamu workers, access limited by role and city, and logs of who looked at what. If personal data is accessed by someone who should not have it, we notify the Personal Data Protection Office immediately, and we tell you when the Office decides you should be told (s.23).

11. Children

Funamu is for people aged 18 or older. We do not knowingly collect information about children. If you believe a child has created an account, tell us and we will remove it.

12. Changes to this policy

We may update this policy. We show the new version in the app and on funamu.com with the date it takes effect, and ask for your consent again if a change needs it.

13. Contact

DOBOKAKA UG LTD, Kisenyi, Kakiri Town Council, Wakiso District, Uganda. P.O. Box 118605, Wakiso. Email: info@funamu.com. Telephone: 0794 517 813.