Privacy Policy

Your Data Security Matters

Learn how we protect your personal information and uphold your privacy rights while delivering secure digital payment services.

GEMPAY – PRIVACY POLICY

Last Updated 26th November 2025

Data Controller: Gempay Uganda Limited, Uganda

1. Introduction

This Privacy Policy explains how Gempay collects, uses, stores, and protects your personal data when you use our international money-remittance services.

2. Personal Data We Collect

A. Information you provide

  • Full name
  • Date of birth
  • National ID or passport
  • Selfie/biometric photo
  • Address
  • Phone number & email
  • Proof of address
  • Occupation and source of funds

B. Device & technical data

  • IP address
  • Device ID
  • Operating system
  • Mobile network
  • Location data
  • Device security signals (anti-fraud)

C. Automatically collected data

  • App usage
  • Clicks and navigation
  • Security logs
  • Session data

3. Why We Process Your Data

We process your data for

  • KYC & identity verification
  • Anti-money laundering (AML) and anti-fraud monitoring
  • Enabling transfers and payments
  • Compliance with regulators
  • Service Delivery; To operate the Gempay App, process transactions, and provide customer support.
  • Marketing: To send you updates or promotions, with your consent, using Marketing and Communications Data.
  • Improvement: To analyze Usage and Feedback Data to enhance app features.
  • Security and verification: To protect your account using Security and Device Data, and to verify user identities, especially for influencers claiming verified status.

Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. As well, we may use your data to ensure our commercial viability by protecting the business from fraud and other types of financial crimes, developing our products, growing our business and to inform our marketing strategy. We may also use your personal data in the legitimate interest of your employer if it is registered with us.

Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you decline to give any mandatory personal data, we may not be able to offer you services through the App and may have to restrict or close your account. We will tell you if this is the case.

Performance of a contract. Where we need to process your personal data to perform a contract with you or where you ask us to take steps before we enter into a contract with you, such as to process payments or deliver the Services through the App. Please note that if you decline to provide us with certain personal data necessary to perform a contract, we may not be able to offer you our services or deliver the content you have requested and may have to restrict or close your account.

4. Sharing Your Data

We may share your personal data with the following third parties

  • Internal third parties; other companies in the affiliated to the Gempay Group and other associated companies acting as processors who provide IT and system administration services and undertake leadership reporting.
  • External third parties; Your Appstore Provider and mobile network operator to allow you to install the App.
  • Service providers acting as processors based in the UK, Uganda and other jurisdictions who provide IT and system administration services, hosting services, user authentication and validation, marketing support for webinars and other events.
  • Our professional advisors acting as controllers based in Uganda and the UK including lawyers, auditors, insurers, consultants and who provide legal, accounting, insurance, and consultancy services.
  • Your service providers that you have appointed and we need to contact to fulfill your requests, such as your banking or payment card provider to process your payments for the Services or your web hosting company if we need to access your website to provide the Services.
  • Marketing and promotional partners and co-operatives acting as processors or joint controllers with whom we share data to enhance our offerings and identify potential influencers.
  • Third party partners where you have subscribed to receive marketing from or with them.
  • Specific third parties listed in the table [Purposes for which we will use your personal data] above.
  • Third parties, to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
  • HM Revenue and Customs, regulators, law enforcement, public authorities or other third parties based in the UK , Uganda or relevant jurisdiction where we are under a legal obligation to do so, where it is necessary to protect our interests, or where it is necessary for the legitimate interest of third parties who are investigating or preventing crime.
  • Banks and mobile money operators
  • Fraud-prevention agencies
  • Identity verification partners
  • Technology hosting providers
  • Regulators and law enforcement
  • International payment partners
  • Third-party processors acting on our behalf

Gempay never sells your personal data.

5. International Data Transfers

Because Gempay provides global remittance, your data may be transferred to other jurisdictions.

  • We ensure appropriate safeguards such as encryption, secure APIs and compliance with Ugandan data protection laws
  • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
  • Where we use certain service providers located outside Uganda, we use specific contracts approved which give personal data the same protection it has in Uganda.

Please contact data privacy manager using the contact details below if you want further information on the specific mechanism used by us when transferring your personal data out of Uganda.

6. Your Rights

You have the following rights under data protection laws in relation to your personal data.

Access.

Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to receive a copy of the personal data we hold about you and check we are processing it lawfully.

Correction.

Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)

Deletion.

Request us to delete or remove personal data where there is no good reason for us continuing to process it. You also can ask us to delete or remove your personal data where you have successfully exercised your right to object to processing, where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Please be aware that we may not always be able to comply with your request due to certain legal or regulatory reasons. Where this is the case, we will tell you at the time of your request.

Objection.

Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts your fundamental rights and freedoms, (b) we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Restriction.

Request that we restrict or suspend our processing of your personal data:

  • if you want us to establish the data's accuracy;
  • where our use of the data is unlawful, but you do not want us to erase it;
  • where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or
  • You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

Data portability.

Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. Note that this right only applies to automated data you initially consented for us to use or where we used the data to perform a contract with you.

Withdraw consent.

Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw your consent, we may not be able to provide certain products or Services to you. We will tell you if this is the case when you withdraw your consent.

Complain to the relevant data protection regulator.

If you are unhappy with how we process your personal data, we ask that you contact us first using the details below. However, where you are unhappy with our response or need further assistance, you can contact your local data protection regulator.

You can exercise any of these rights by contacting us at nobert@tekjuice.co.ug

Requests may be refused where prohibited by AML/KYC law.

7. Data Retention

For regulatory reasons, Gempay retains transaction and identity data for at least 6 years, even if your account is deleted.

8. Security

All information you provide to us is stored on our secure servers. Any payment transactions carried out by us or our chosen third-party provider of payment processing services will be encrypted using Secured Sockets Layer technology.

Once we have received your information, we will use strict procedures and security features to protect your personal data from loss, unauthorized use or alteration. We limit access to your personal data to only those who have a genuine business need to access it. We will process it only for the purpose it was collected and in accordance with this Privacy Policy. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality.

Certain Services include social networking, chat room or forum features. Ensure when using these features that you do not submit any personal data that you do not want to be seen, collected or used by other users.

We have put in place procedures to detect and respond to personal data breaches and notify you and any applicable regulator when we are legally required to do so.

We use

  • Data encryption
  • Secure cloud storage
  • Transaction monitoring
  • Device-risk analysis
  • Firewalls
  • 2 Factor authentication

9. Cookies

See the Gempay Cookie Policy for details.

10. Contact Details

We have appointed a data privacy manager. If you have any questions about this privacy notice or our data protection practices, please contact the data privacy manager in one of the following ways:

Name: Nobert Muhoozi

Email: nobert@tekjuice.co.ug

Phone: +256 701 503 988 / +256 783 145 717