Privacy Policy

1. Introduction

Roho Technologies Limited ("RohoPay", "we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our payment platform, APIs, dashboards, websites, and related services (collectively, the "Services").

We comply with the Uganda Data Protection and Privacy Act, 2019 (DPA) and, where applicable, the EU General Data Protection Regulation (GDPR). By using the Services, you consent to the practices described in this Policy.

2. Data Controller

Roho Technologies Limited
Registered in Uganda
Website: rohotechnologies.com
Email: privacy@rohopay.com
Data Protection Officer: dpo@rohopay.com

3. Information We Collect

3.1 Merchant Account Data

• Business name, registration number, tax ID (TIN), address
• Director/beneficial owner names, IDs, contact details
• Bank account details for settlement
• Website/app URLs, business description
• KYC documents (certificate of incorporation, IDs, utility bills)

3.2 Transaction Data

• Transaction amount, currency, timestamp, status
• Customer phone number, email, name (as provided by Provider)
• Payment method (mobile money network, card brand, bank)
• Provider reference, RohoPay reference, settlement status
• Device fingerprint, IP address, user agent (for fraud prevention)

3.3 Technical & Usage Data

• API request logs (endpoint, timestamp, response code, latency)
• Dashboard login history, IP, device info
• Cookies and similar technologies (see Cookie Policy)
• Error logs, performance metrics

3.4 Communication Data

• Support tickets, emails, chat transcripts
• Fraud reports, compliance inquiries
• Marketing preferences (opt-in/opt-out)

4. How We Use Your Information

• Provide Services: Process payments, manage settlements, operate dashboards, issue API keys, send notifications.
• KYC & Compliance: Verify identity, screen against sanctions lists (OFAC, EU, UN), monitor for AML/suspicious activity, file regulatory reports.
• Fraud Prevention: Risk scoring, anomaly detection, device fingerprinting, velocity checks, collaboration with Providers and law enforcement.
• Improve Services: Analytics, product development, performance optimization, debugging, A/B testing.
• Communications: Transactional emails (receipts, settlements, alerts), support responses, legal notices, marketing (with consent).
• Legal Obligations: Comply with court orders, regulatory requests, tax reporting, audit requirements.

5. Legal Bases (GDPR)

Contract Performance

Processing payments, settlements, dashboard access.

Legal Obligation

KYC, AML, tax, sanctions screening, regulatory reporting.

Legitimate Interest

Fraud prevention, security, analytics, service improvement.

Consent

Marketing communications, optional cookies, third-party analytics.

6. Data Sharing & Disclosure

We share data only as follows:

• Payment Providers (Flutterwave, Relworx, Iotec, etc.): To process transactions, settle funds, and comply with their KYC/AML requirements. Providers are independent controllers.
• Banks & Financial Institutions: For settlement to Merchant bank accounts.
• Regulators & Law Enforcement: When legally required (court orders, BoU, FIU, police).
• Professional Advisors: Auditors, lawyers, accountants (under confidentiality).
• Service Providers: Cloud hosting (AWS/GCP), email (SendGrid), monitoring (Sentry), analytics (PostHog) — all under DPAs.
• Business Transfers: In a merger, acquisition, or asset sale (with notice).
• With Merchant Consent: For integrations, partnerships, or referrals.

We do not sell personal data. We do not share Customer payment data with third parties for their marketing purposes.

7. International Transfers

Our infrastructure is hosted in the EU (Netherlands, Germany) and Uganda. Data may be processed in these jurisdictions. Transfers outside the EEA/Uganda rely on: (a) adequacy decisions, (b) Standard Contractual Clauses, (c) Binding Corporate Rules, or (d) your explicit consent.

8. Data Retention

• Merchant account data: Duration of relationship + 7 years (tax/legal)
• Transaction records: 7 years from transaction date (AML/tax)
• KYC documents: 7 years after relationship ends
• API/access logs: 13 months (security/fraud)
• Marketing data: Until opt-out or 2 years inactivity
• Support communications: 3 years

Anonymized/aggregated data may be retained indefinitely for analytics.

9. Your Rights

Under DPA/GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate/incomplete data
• Erasure — "right to be forgotten" (subject to legal retention)
• Restriction — limit processing in certain cases
• Portability — receive data in structured, machine-readable format
• Object — to processing based on legitimate interest or direct marketing
• Withdraw Consent — where processing is based on consent
• Complain — to the Personal Data Protection Office (Uganda) or EU supervisory authority

Exercise rights by emailing privacy@rohopay.com. We respond within 30 days (extendable by 60 days for complexity).

10. Security

We implement appropriate technical and organizational measures: encryption at rest (AES-256) and in transit (TLS 1.2+), role-based access control, regular penetration testing, SOC 2 aligned controls, incident response plan, and staff security training. However, no internet transmission is 100% secure.

11. Children's Privacy

The Services are not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe we have, contact privacy@rohopay.com and we will delete it.

12. Changes

We may update this Policy. Material changes will be posted on this page and emailed to Merchants 30 days before taking effect. Continued use constitutes acceptance.

13. Contact

Questions? Contact our Data Protection Officer at dpo@rohopay.com or privacy@rohopay.com.