YALA'S Privacy Policy

a) Consent: You provide consent to our processing of your personal data when you create an account, access our website, download our mobile application, or engage with any of our services. Consent may be withdrawn at any time, subject to legal or contractual restrictions.

b) Legal Obligation: We may process your personal data to comply with legal and regulatory obligations under Canadian, Nigerian, UK, EU, US, or other applicable laws. For example, we are required to collect specific data for compliance with international Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) standards.

c) Legitimate Interest: We may process your personal data when it is necessary to pursue our legitimate business interests, provided such interests do not override your fundamental rights and freedoms. These interests may include:

• ensuring the security of our platforms and operations,
• preventing fraud and financial crime,
• enhancing and improving our services,
• supporting operational efficiency and innovation.

4.1. Right of Access:

You have the right to request a comprehensive report of all personal data we hold about you including:

• why and how your data is processed,
• the categories of data involved,
• any third-party recipients with whom your data has been shared.

4.2. Right to Rectification:

You may request that we correct or update any inaccurate, incomplete, or outdated personal information.

4.3. Right to Erasure ("Right to be Forgotten"):

You have the right to request the deletion of your personal data from our records, especially when it is no longer necessary for the purposes for which it was collected. However, please note that this right may be subject to legal or regulatory obligations, such as Know Your Customer (KYC) and Customer Due Diligence (CDD) regulations that require retaining certain information for a specified period.

4.4. Right to Data Portability:

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transfer it to another service provider where technically feasible.

4.5. Right to Restrict Processing:

You may request that we restrict the processing of your personal data to certain purposes or services, particularly where the accuracy of the data is contested, or the processing is unlawful.

4.6. Right to Object:

You have the right to object to the processing of your personal data, particularly where it involves direct marketing, profiling, or is based on our legitimate interests, if you believe it impacts your fundamental rights or freedoms.

4.7. Right to Withdraw Consent:

Where processing is based on your consent, you have the right to withdraw that consent at any time. Please note that your withdrawal of consent does not affect the lawfulness of any processing carried out prior to such withdrawal.

4.8. Right to Lodge a Complaint:

If you believe your data has been mishandled, you may file a complaint with us by contacting our Data Protection Officer. If you are not satisfied with our response, you may escalate your complaint to the Nigerian Data Protection Commission (NDPC) or other regulators to whom Yala is subject to.

4.9. How to Exercise Your Rights:

To exercise any of your rights under this Policy, please send a clear written request specifying the right you wish to invoke to our Data Protection Team at dataprotection@useyala.com.

5.1. Know Your Customer (KYC) / Customer Due Diligence (CDD) Data:

To comply with regulatory requirements and verify your identity, we may collect the following:

1. full name, date of birth, gender, marital status, nationality,
2. residential and mailing addresses,
3. contact information (email address and phone number),
4. Bank Verification Number (BVN) and National Identification Number (NIN), where applicable,
5. government-issued identification (passport, driver's license etc.),
6. biometric data (e.g., fingerprints, facial recognition, photographs),
7. employment or business information,
8. financial statements,
9. credit history,
10. business data which includes but not limited to business name, country of incorporation, company registration documents, ownership structures and information, and trade information.

5.2. Transactional and Financial Data:

This includes information relating but not limited to:

1. receivables and payables information,
2. bank account details,
3. payment instructions,
4. currency conversion preferences,
5. transaction records of payments processed through Yala.

5.3 Device and Application Usage Data:

To enhance platform performance and user experience, we may collect technical data from your devices, such as:

1. device type and model,
2. operating system and version,
3. unique device identifiers (e.g., IMEI, MAC address),
4. Internet Protocol (IP) address,
5. browser type and settings,
6. mobile network information,
7. app usage statistics, error logs and crash reports.

With your explicit consent, we may also access:

1. GPS location data,
2. camera access (e.g., for photo id verification or mobile check deposits),
3. contacts (e.g., for referrals or in-app money transfers),
4. calendar access (e.g., for setting reminders or appointments).

5.4. Third-Party Data Sources:

We may collect additional personal data from reliable third-party sources to meet regulatory obligations, assess risk, and improve service delivery. These sources include:

1. identity verification service providers,
2. credit bureaus and fraud prevention agencies,
3. banks, payment processors, and other financial institutions,
4. public records and regulatory databases,
5. marketing or analytics partners (only where legally permitted).

5.5. Cookies and Performance Tracking Technologies:

We use cookies and similar technologies on our mobile app and website to:

1. enable essential platform functionality,
2. analyse user behaviour and performance metrics,
3. personalize your experience.

You may manage your cookie preferences through your device or browser settings. For more information, please refer to our Cookie Policy.

6.1. Service Delivery:

Your personal data enables us to provide and manage our core financial services, including but not limited to:

1. opening and maintaining accounts,
2. processing payments and fund transfers,
3. facilitating deposits, withdrawals, and other transactions,
4. enabling access to digital banking and mobile app features.

6.2. Regulatory Compliance:

We are legally obligated to comply with various laws and regulations. Your data is processed to:

1. perform KYC and CDD checks,
2. conduct AML and CFT screenings,
3. comply with tax, reporting, and audit requirements,
4. respond to lawful requests from regulators, law enforcement, or the judiciary.

6.3. Innovation and Service Improvement:

We may analyse personal data to improve and innovate our services. This includes:

1. conducting internal research and market analysis,
2. understanding customer behavior and usage trends,
3. enhancing features and user experience,
4. testing and refining new tools, features, or financial products.

6.4. Communication and Customer Support:

We use your data to communicate with you and provide assistance, including:

1. transaction alerts and service notifications and updates,
2. customer service and dispute resolution,
3. marketing messages, promotions, and service updates (subject to your preferences),
4. feedback requests and satisfaction surveys.

Please Note: You may opt out of receiving promotional communications at any time via your account settings or by using the unsubscribe link in our emails and messages.

6.5. Security and Fraud Prevention:

Your personal data is essential for ensuring the safety and integrity of our systems. It helps us:

1. monitor for and detect fraud in real-time,
2. verify user identity and transaction authenticity,
3. investigate suspicious or unauthorized activity,
4. prevent cyberattacks and secure our infrastructure.

7.1. Third-Party Service Providers:

We may share your personal data with third-party partners who assist us in delivering our services, fulfilling legal obligations, or supporting our operations. These may include:

1. payment processors,
2. identity verification providers,
3. credit bureaus and fraud prevention agencies,
4. data analytics firms,
5. IT and cloud hosting providers,
6. legal, regulatory, compliance, or audit professionals,
7. other subcontractors or persons acting as our agents.

By using our mobile application, website, or other electronic channel, you expressly authorise Us to share your personal data with such partners for the purposes outlined in this Policy. We implement reasonable contractual and technical safeguards to ensure that third parties handle your data in compliance with globally recognised data protection standards. However, Yala shall not be liable for unauthorized access, misuse, or security breaches caused by these third parties beyond our control.

7.2. Disclosures in Fraud Investigations and Legal Requests:

In cases of actual or suspected fraud or unlawful activity, we may disclose your personal data to law enforcement or regulatory authorities, including but not limited to:

1. the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC),
2. the Nigerian Police Force (NPF),
3. the Economic and Financial Crimes Commission (EFCC),
4. the Nigerian Financial Intelligence Unit (NFIU),
5. the Federal Bureau of Investigation (FBI),
6. other authorised government bodies and courts.

Disclosed information may include, but is not limited to: full name and contact details, Bank Verification Number (BVN), transaction records and account history, identification documents and other relevant personal data.

Important Notes:

1. Disclosures in fraud investigations and legal requests disclosures may be made without prior notice to you, where required by law or necessary to prevent harm or support an active investigation.
2. We will ensure that disclosures are made in good faith, in accordance with applicable laws, and only upon reasonable suspicion or evidence of misconduct.

By using the Yala App or other related services, you consent to the disclosure of your personal data for the purposes of fraud investigation and regulatory compliance.

7.3. Cross-Border Data Transfers:

We may collect, store, control, or transfer your personal data within our subsidiaries, and to trusted third parties, affiliates, or service providers located in jurisdictions outside of where Yala operates. In such cases, We will ensure that adequate safeguards are in place to protect your personal data by:

1. transferring personal data only to countries with adequate data protection laws, recognised by the countries in which We operate;
2. ensuring our contracts include standard contractual clauses;
3. ensuring data processing agreements are aligned with the Data Protection Regulations and global best practices.

You may request further information about the safeguards applied to international data transfers by contacting us at dataprotection@useyala.com.