Mobile Application Privacy Policy

1. Introduction

Mukuba Financial Services Limited ("Mukuba", "the Company", "us", "we", or "our"). This Mobile Application Privacy Policy ("Policy") governs your access to and use of the Mukuba mobile application ("the App" or "the Service"), available on iOS and Android devices, and explains how we collect, use, store, protect, and disclose information arising from your use of the App.

We take the protection of our customers' personal and financial information seriously, given the sensitive nature of financial services. By downloading, registering on, or using the App, you agree to the collection and use of information in accordance with this Policy. Unless otherwise defined here, terms used in this Policy have the same meaning as in our Terms and Conditions of Use, which together with this Policy form your agreement with Mukuba ("the Agreement").

This Policy applies in addition to, and does not replace, any account-opening, savings, or other product-specific agreement you have signed with Mukuba Pension Trust Defined Contribution.

2. Definitions

Service / App

means the Mukuba Financial Services mobile application and any related digital platforms operated by Mukuba.

Personal Data

means any information relating to an identified or identifiable living individual, including information that can identify a customer directly or indirectly.

Financial Data

means account numbers, balances, transaction history, income information, and any other data relating to a customer's financial position or activity.

Usage Data

means data collected automatically through use of the App, such as device identifiers, session logs, and app interaction data.

Cookies / Similar Technologies

means small files or identifiers stored on your device used to remember preferences and recognise your device.

Data Controller

means the entity that determines the purposes and means of processing Personal Data. For this Policy, Mukuba Financial Services is the Data Controller.

Data Processor / Service Provider

means any third party that processes data on Mukuba's behalf.

Data Subject / User

means the individual using the App, whose Personal Data is processed under this Policy.

KYC

means "Know Your Customer" - the identity verification and due-diligence checks required under applicable banking and anti-money-laundering laws.

3. Information Collection and Use

We collect several categories of information for the purposes of providing, securing, and improving the App, complying with Pensions and financial-sector regulations, and delivering our products and services to you.

4. How We Use Your Information

Mukuba Financial Services uses the information we collect for purposes including:

1. Verifying your identity and performing KYC and anti-money-laundering (AML) checks;
2. Opening, maintaining, and administering your account and financial products;
3. Detecting, investigating, and preventing fraud, money laundering, and other financial crime;
4. Providing customer support and responding to your enquiries;
5. Sending you account notifications, statements, and service-related communications;
6. Improving the App's functionality, security, and user experience;
7. Complying with our legal, regulatory, and reporting obligations, including those of the Bank of Zambia and other applicable authorities;
8. Sending you marketing communications about products and offers, where you have consented, and which you may opt out of at any time;
9. Any other purpose disclosed to you at the time of collection, or for which you give your consent.

5. Retention of Data

We retain Personal Data and Financial Data for as long as necessary to fulfil the purposes described in this Policy, including the ongoing duration of your relationship with Mukuba. Following account closure, we retain records for the period required by the Bank of Zambia, tax authorities, and other applicable financial services and anti-money-laundering legislation, which is generally not less than five (5) years from the date of the last transaction, unless a longer period is required by law or necessary to resolve disputes and enforce our agreements.

Usage Data is generally retained for a shorter period, except where required for security, fraud prevention, or regulatory purposes.

6. Transfer and Storage of Data

Your information is primarily stored and processed within Zambia. Where it is necessary to transfer data outside Zambia - for example, to a cloud hosting provider or a regional service provider - we will only do so where adequate safeguards are in place to protect your data, consistent with the Zambia Data Protection Act No. 3 of 2021 and other applicable law.

By using the App, you acknowledge and consent to the processing of your data as described in this Policy, including any such cross-border transfer, where applicable.

7. Disclosure of Data

We may disclose your Personal Data and Financial Data in the following circumstances:

8. Security of Data

As a Fund Administrator and Fund Manager, Mukuba applies industry-standard technical and organisational safeguards to protect your data, including encryption of data in transit and at rest, secure authentication (including biometric and multi-factor authentication where available), access controls, transaction monitoring, and regular security testing.

Notwithstanding these measures, no method of transmission over the internet or electronic storage is completely secure. While we work to protect your data using commercially acceptable means, we cannot guarantee its absolute security. You also play a role in protecting your account - see Section 12 (Your Responsibilities).

9. Service Providers, Analytics, and Third-Party Tools

We may engage third-party companies to facilitate the App, process data on our behalf, provide customer support tools, or analyse how the App is used, including analytics and crash-reporting tools that help us identify and fix technical issues. These providers are given access only to the data necessary to perform their functions and are contractually obligated not to use or disclose it for any other purpose.

10. Links to Third-Party Services

The App may contain links to third-party websites or services, such as payment partners or merchant platforms, that are not operated by Mukuba. We are not responsible for the content, privacy practices, or security of any third-party site or service. We encourage you to review the privacy policy of any third-party service you access through the App.

11. Children's Privacy

The App is intended for use by individuals who are at least 18 years old, or the age of majority in their jurisdiction, and who are legally capable of entering into a financial services agreement. We do not knowingly collect Personal Data from children. If we become aware that we have inadvertently collected data from a minor without appropriate parental or guardian consent, we will take steps to delete that data promptly.

12. Your Responsibilities

To help keep your account and data secure, you agree to:

• Keep your login credentials, PIN, and passwords confidential and never share them with anyone, including Mukuba staff;
• Enable available security features such as biometric login and device passcodes;
• Only download the App from official app stores (Google Play Store or Apple App Store);
• Promptly notify Mukuba of any unauthorised access to your account, lost or stolen device, or suspected fraud;
• Ensure your device software and the App are kept up to date.

13. Your Rights

Subject to applicable law, including the Zambia Data Protection Act No. 3 of 2021, you have the right to:

• Access the Personal Data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data, subject to our legal and regulatory retention obligations;
• Withdraw consent for optional processing, such as marketing communications, at any time;
• Object to or request restriction of certain processing activities;
• Lodge a complaint with the Office of the Data Protection Commissioner of Zambia, or the relevant supervisory authority.

Requests can be made using the contact details in Section 16 below. We may need to verify your identity before actioning a request.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by posting the updated Policy within the App and/or via email, and by updating the "Effective Date" at the top of this document. Continued use of the App after such changes constitutes your acceptance of the revised Policy.

15. Governing Law

This Policy is governed by and construed in accordance with the laws of the Republic of Zambia, including the Zambia Data Protection Act No. 3 of 2021, and applicable banking, financial services, and anti-money-laundering legislation.