Woza Privacy Policy

Last updated: 23 October 2026

In the course of your use of the Woza app, we collect and store some of your personal data. This policy sets out how Payless Solutions Limited ("Payless", "we", "us") collects, uses, stores, shares and protects your personal information when you use Woza, in accordance with the Data Protection Act, 2019 of Kenya and its regulations. It applies to the Woza app on Android and iOS and to the services behind it ("Woza Services"), however you access them.

1. Scope of application and acceptance

When you sign up for, access or use Woza, you consent to be bound by this policy. If you do not agree, please do not use Woza. We may update this policy from time to time by posting a revised version, which takes effect when it is posted (see section 12).

2. Personal data collected

2.1 Personal data you provide to us

• Account details: your phone number, username, and a password or PIN. One-time codes are sent to your phone to confirm it and to confirm new devices.

• Profile: your name, bio, profile photo, banner, links, and your privacy settings.

• Content you create: posts, stories, short videos ("Blips"), comments, captions, hashtags, mentions and tags, places you type or choose, audio you attach, and drafts.

• Messages, calls and live streams: chat messages, voice notes, photos, videos, files and link previews you send or receive, and the audio and video you share in calls and live streams, together with details such as who took part, when and for how long.

• Wallet and payments: your coin balance, top-ups, gifts you send and receive, withdrawals, and your transaction history, together with the mobile-money number or payment account you use to pay or receive money. Card and mobile-money credentials are handled by the payment provider.

• Safety information: reports you make, accounts you block or mute, and your hidden-words list.

• Support: anything you send our customer care team.

2.2 Personal data we collect automatically

When you use Woza we collect information sent by your device, including your device identifier, push-notification token, device type, operating system, app version, language, IP address, mobile network information, crash reports and diagnostics, and how you use the app (for example viewing a story, liking a post, following someone or sending a gift). Analytics events do not include message text, phone numbers or money amounts.

2.3 Camera, microphone, photos and location

• Camera and microphone: Woza asks for these only when you take a photo or video, record a voice note, make a call or go live. We do not use camera or microphone data for any other purpose.

• Photos and videos from your phone: you choose them yourself with the system photo picker. We receive only the items you choose. We do not scan your photo library and we do not access your contacts.

• Location: we do not collect your device's GPS location. If you add a place to a post, it is the text you type or choose.

• You can switch camera, microphone and notification permissions off at any time in your phone's settings.

2.4 Personal data from other sources

We may receive information from payment partners (for example confirmation that a top-up or withdrawal succeeded) and from other users (for example when they mention or tag you).

3. Authentication, fraud detection and anti-money laundering

To protect you and Woza from fraud and misuse, we may collect and analyse information about you and how you use the app, such as device details and transaction activity. We use one-time codes to confirm sensitive actions such as withdrawals. Payless continues to improve its services in line with the anti-money-laundering and counter-terrorism-financing rules that apply to it.

4. Mobile privacy

This policy applies to all use of Woza on a mobile device. We may receive information about your mobile device, including a unique identifier for it. Any exposure that results from a customer's negligence or irregular use of Woza on their device, and any resulting liability, is not attributable to Payless.

5. How we use the personal information we collect

We use your personal data to give you a secure, smooth and personalised experience. We may use it to:

I. create and secure your account and verify your identity; II. let you post, chat, call, go live, send gifts, top up and withdraw; III. show your content to the people you choose, in line with your privacy settings; IV. process transactions and send notices about them; V. send notifications you have allowed, including service updates; VI. resolve disputes, collect fees and troubleshoot problems; VII. prevent fraud, abuse and illegal activity, handle reports, and enforce our user agreement; VIII. measure and improve Woza, including fixing crashes; and IX. comply with the law, including financial record-keeping.

6. Marketing

We may contact you about service updates and changes to Woza. We do not show third-party advertising in Woza. We do not sell or rent your personal information to third parties for their marketing purposes. If you do not wish to receive notifications, you can switch them off in your phone settings or in Settings > Notifications, or contact our data controller team at privacy@payless.africa.

7. How we protect and store personal information

In this policy "personal data" means information that can be associated with a specific person and used to identify them. It does not include information that has been made anonymous. We may process, store and retain your personal data on our servers and on the servers of third parties with whom we have contracts.

7.1 Data security

Payless has implemented security measures to safeguard your information, including:

• Encryption: your data is encrypted during transmission and storage.

• Access controls: access to your data is limited to authorised personnel only.

• Security audits: regular assessments to identify and address potential vulnerabilities.

• Employee training: our staff are trained to handle your data securely.

No system is perfectly secure, so please choose a strong password, keep your codes private, and tell us straight away if you think your account has been misused.

8. Sharing personal data with third parties

I. Payless does not share, sell or rent out the personal data we collect from you to third parties without your consent. Where data is shared, Payless handles it fairly, transparently and lawfully in accordance with the Data Protection Act, 2019. Payless may share your personal data with:

a) Other users. What you post, send or stream is visible to the people you choose (public, followers, close friends, or a specific chat). Your username, profile photo and public posts may be visible to anyone.

b) Service providers under contract who help with our operations: cloud hosting; Stream, which provides chat, video-call and live-stream infrastructure; Google Firebase, for push notifications, analytics and crash reporting; and OpenStreetMap, which receives the text you type into location search. Our contracts require these providers to use your information only to perform services for us and not for their own benefit.

c) Payment partners that move money for top-ups and withdrawals, for example M-Pesa, Airtel Money and Payless.

d) Companies we plan to merge with or be acquired by. Should such a combination occur, we will require the new combined entity to follow this Privacy Policy. If your personal information could be used contrary to this policy, you will receive prior notice.

e) Law enforcement, government officials or other third parties under a subpoena, court order or other legal process or requirement that applies to Payless or one of its affiliates; when we need to do so to comply with the law; or when we believe, in our discretion, that disclosure is necessary to prevent physical harm or financial loss, to report suspected illegal activity, or to investigate violations of our user agreement.

f) Other third parties with your consent or at your direction.

II. Please note that some of these third parties may be in other countries where the laws on processing personal information may be less stringent than in your country. Where we transfer data outside Kenya, we use contractual safeguards.

III. Other websites and apps are governed by their own privacy policies. Payless is not responsible for their content or information practices.

9. How you can access or change your personal information

9.1 Access and edit

You can review and edit your personal information at any time in the app: Profile > Edit profile, and Settings > Privacy. You can download a copy of your data from Settings > Account > Download your data. We email it to you.

9.2 Delete your account

You can delete your account from the app (Settings > Account > Delete my account). Your account is hidden immediately and permanently deleted after a 30-day grace period. We may keep some information for a limited period to meet legal requirements, collect any fees owed, resolve disputes, prevent fraud and enforce our user agreement. Full details are on our Woza account deletion page.

9.3 How long we keep your data

We keep your data while your account is active. Stories disappear from view after 24 hours unless you save them. When you delete your account, we remove your profile and content as described above. We keep financial records (payments, withdrawals and ledger entries) for as long as the law requires, and limited records needed to prevent fraud and abuse. Copies held in backups are overwritten in the normal backup cycle.

10. Your rights

You have the right to:

• Be informed: to be told that we are collecting personal data about you and how we process it.

• Access: to see the personal data we hold about you.

• Correct: to have inaccurate data corrected.

• Object and restrict: to object to certain processing activities and request restrictions.

• Delete: to request deletion of your data, noting that we may continue to retain information where the law requires.

• Withdraw consent: where processing is based on consent, to withdraw it. We may continue to process where the law permits.

• Data portability: to receive a copy of your data in a machine-readable format.

To use these rights, use the in-app options above or email privacy@payless.africa. We will respond within 30 days. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya.

11. Children

Woza is not for children under 13, or under any higher minimum age that applies where you live. We do not knowingly collect personal data from children below that age. If you believe a child has an account, contact us at privacy@payless.africa and we will remove it.

12. Changes to this policy

Payless may update this Privacy Policy from time to time. We will tell you about significant changes in the app and post the revised policy on our website.

13. Cookies and tracking technologies

The Woza app does not use browser cookies. It uses a device identifier and Google Firebase analytics, described above, to keep your account secure and to understand how the app is used. On our website, we may use cookies to improve your experience; you can manage them in your browser settings.

14. Contact us

Payless Solutions Limited P.O. Box 38532-00623, Parklands Lemac Building, 23rd Floor, Church Road, Westlands, Nairobi, Kenya Privacy and data protection: privacy@payless.africa Support: support@payless.africa www.payless.africa

Statement effective date: 23 October 2026