Malipo Privacy Policy

This Privacy Policy is the public-facing privacy notice for Malipo by Tunzaa. It describes the principal categories of Personal Data processed in connection with Malipo, the purposes of processing, disclosures, international transfers, retention, security, automated risk controls and applicable Data Subject rights.

Welcome to Malipo by Tunzaa ("Malipo", "Tunzaa", "we", "us" or "our"). Malipo is Tunzaa’s payment infrastructure and payment-gateway service designed to enable eligible businesses and other authorised users to initiate, accept, authenticate, process, monitor, reconcile and settle payment transactions through supported payment methods and payment partners, subject to applicable onboarding requirements, approvals and laws.

This Privacy Policy explains how Tunzaa collects, uses, discloses, stores, protects and otherwise processes Personal Data in connection with Malipo. This Policy applies to merchants, businesses, authorised representatives, beneficial owners, employees, customers and other individuals whose Personal Data is processed through or in connection with Malipo.

Malipo should also be read together with applicable Tunzaa group privacy policies, product terms, regional terms, merchant agreements, Data Processing Addenda, payment-partner notices and other privacy notices presented at the point of collection.

Malipo operates within the Tunzaa group. Tunzaa Fintech Inc. is the United States parent company and owner of Tunzaa intellectual property, technology and group assets. Tunzaa Fintech Inc., 256 Chapman Road, STE 105-4, Newark – New Castle, 19702, Delaware, United States of America.

Tunzaa Digital Holdings Limited is the Tanzanian operating company responsible for local Tunzaa operations and regulated activities as applicable. Tunzaa Digital Holdings Limited, P.O. Box 13416 Posta Mpya, Delta House – Dunga Street/Morocco Road, Plot 399/Block 42, Kinondoni, Dar es Salaam – Tanzania. General contact: mambo@tunzaa.co.tz.

The entity legally providing a particular Malipo service, and whether a Tunzaa entity acts as a Data Controller or Data Processor for a particular processing activity, depends on the applicable product configuration, transaction, contractual arrangement and jurisdiction.

“Personal Data” means information relating to an identified or identifiable individual. Depending on your relationship with Malipo, Personal Data may include names, identification information, telephone numbers, email addresses, physical or business addresses, account information, payment-related information, transaction information, settlement information, device and technical information, location information, communications, fraud and security information, KYC/KYB information, beneficial-ownership information, authorised-representative information and information generated through risk, fraud, compliance or automated systems.

Because Malipo provides payment infrastructure, we may process information relating to transactions, including transaction amount, currency, transaction reference, merchant information, payer or customer information, payment status, payment method, settlement information, refund information, reversal information, chargeback information, transaction timestamps, payment-network information and reconciliation information.

Where card or other payment credentials are processed directly by a third-party payment provider, Tunzaa may receive tokens, transaction identifiers, status information or limited payment metadata rather than the underlying payment credentials. The information actually processed depends on the payment method and relevant payment architecture.

Depending on the payment method and transaction, we may receive or exchange information with banks, mobile-network operators, payment service providers, payment gateways, acquiring institutions, issuing institutions, card schemes, transaction processors, settlement partners and other authorised payment partners. Such information may be necessary to execute transactions, authenticate payments, confirm transaction status, prevent fraud, reconcile payments, settle funds, investigate disputes and comply with legal or regulatory requirements.

Malipo may conduct identity and business verification before permitting access to certain services. This may involve Know Your Customer (KYC) checks, Know Your Business (KYB) checks, beneficial-owner verification, identity verification, sanctions screening, fraud screening, business eligibility checks and ongoing due diligence.

We may request additional documentation where necessary to verify a merchant, representative, beneficial owner or transaction. Information collected for these purposes may be retained for the period required by applicable law, regulation, contractual requirements and internal retention practices.

Malipo may process Personal Data to detect, prevent and investigate payment fraud, money laundering, terrorist financing, sanctions violations, account takeover, identity fraud, suspicious transactions, payment abuse, unlawful activity and other financial or payment-related risks. Processing may include transaction monitoring, sanctions screening, fraud detection, risk assessment, account monitoring, investigations, regulatory reporting, dispute handling and enforcement of payment obligations.

Malipo may use automated systems and analytical tools for fraud scoring, transaction risk scoring, merchant risk assessment, transaction monitoring, account-risk controls, payment authentication and anomaly detection. Depending on the circumstances, automated systems may contribute to decisions to approve, decline or delay a transaction, subject a transaction to additional review, restrict an account, request additional information or apply other risk controls.

Where applicable law provides rights relating to automated decision-making, Tunzaa will provide the notices and mechanisms required by law, including appropriate avenues for review or objection where required.

Tunzaa may use Personal Data to create and administer accounts; onboard merchants; authenticate users; facilitate payment transactions; process payments; reconcile transactions; facilitate settlement; process refunds and reversals; provide transaction information and customer support; conduct KYC/KYB and beneficial-owner checks; conduct sanctions screening; comply with financial-crime and regulatory obligations; detect fraud and abuse; monitor transactions; secure accounts and payment infrastructure; investigate suspicious activity; improve products and systems; conduct analytics; develop permitted automated or AI-assisted functionality; establish, exercise or defend legal claims; investigate disputes; enforce contractual obligations; protect Tunzaa, users, merchants, partners and the public; and comply with applicable laws, regulations, court orders and lawful governmental requests.

Depending on the circumstances and applicable law, Tunzaa may process Personal Data on the basis of performance of a contract; steps taken at your request before entering into a contract; compliance with legal or regulatory obligations; legitimate interests that do not override applicable rights; consent where required; protection of rights, property or safety; or another lawful basis recognised by applicable law.

Where processing is based on consent, you may withdraw consent subject to applicable legal limitations. Withdrawal does not affect processing lawfully undertaken before withdrawal.

The role of Tunzaa in relation to Personal Data depends on the processing activity. Where Tunzaa determines the purposes and means of processing, it may act as an independent Data Controller. This may include processing for account administration, identity verification, security, fraud prevention, AML/CFT and compliance, transaction monitoring, service analytics, product improvement and regulatory compliance.

Where a merchant or other business user determines the purpose and means of processing customer Personal Data and instructs Tunzaa to process that information solely to provide Malipo services, Tunzaa may act as a Data Processor. In those circumstances, the merchant may be the Data Controller and Tunzaa the Data Processor, with processing governed by documented instructions and, where applicable, a Data Processing Addendum.

Where a merchant uses Malipo to process customer Personal Data, the merchant is responsible for ensuring that it has an appropriate lawful basis and provides any notices required by applicable law. Merchants must collect Personal Data lawfully, provide appropriate privacy notices, obtain required permissions or consent, limit collection to necessary information, maintain appropriate security, respect Data Subject rights, comply with applicable retention requirements and provide Tunzaa with lawful processing instructions where Tunzaa acts as processor.

Tunzaa may disclose Personal Data where necessary and lawful to payment partners; merchants and businesses; technology and infrastructure providers; cloud and cybersecurity providers; identity-verification and fraud-prevention providers; professional advisers; Tunzaa group companies; regulators; courts; law-enforcement and governmental authorities; and other parties where disclosure is necessary for the purposes described in this Policy or required or permitted by law. Payment partners may include banks, mobile-network operators, payment processors, payment schemes, acquirers, issuers and other authorised financial or payment institutions.

Malipo may depend on third-party services including banks, mobile-network operators, payment service providers, acquiring institutions, payment processors, cloud providers, identity-verification providers, fraud and security providers, communications providers and other technology providers. Where Tunzaa appoints a service provider to act as a processor on our behalf, we will take reasonable steps to ensure appropriate contractual, confidentiality and security safeguards apply.

Personal Data processed through Malipo may be accessed, hosted or processed outside Tanzania, including within the Tunzaa group, through international cloud infrastructure, through technology providers, through payment partners or through other service providers. Where Personal Data is transferred from Tanzania to another jurisdiction, Tunzaa will comply with applicable Tanzanian requirements governing transborder data transfers and will implement appropriate contractual, technical, organisational and regulatory safeguards where required.

Tunzaa retains Personal Data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law. Malipo may require longer retention because of financial and transaction records, regulatory obligations, tax obligations, AML/CFT requirements, fraud investigations, payment disputes, chargebacks, legal proceedings, contractual enforcement, security requirements or regulatory investigations.

When Personal Data is no longer required, Tunzaa will take reasonable steps to delete, anonymise or securely dispose of it. Backup copies may remain for a limited period before being securely overwritten or deleted.

Tunzaa maintains reasonable technical and organisational measures appropriate to the risks associated with processing Personal Data. Measures may include access controls, authentication, role-based permissions, monitoring, logging, confidentiality controls, security testing, vulnerability management, secure infrastructure, incident-response procedures, employee confidentiality obligations and vendor security controls.

No electronic system is completely secure. Users must also maintain appropriate security over passwords, API keys, access credentials, merchant accounts, devices and other authentication mechanisms.

Where Malipo provides API access, additional information may be processed in connection with API keys, authentication, developer accounts, API requests, IP addresses, logs, webhooks, sandbox and production activity, technical diagnostics, security monitoring and rate-limit or abuse controls. API users must protect their credentials and must not expose API keys or authentication information to unauthorised persons. Additional requirements may be contained in the Malipo Developer & API Terms.

Malipo may use cookies, SDKs, device identifiers, pixels, local storage, analytics technologies and similar technologies for security, authentication, functionality, analytics, attribution, performance, personalisation and advertising where applicable. Where required, Tunzaa will provide appropriate notice and obtain applicable consent. Additional information may be provided through the Tunzaa Cookie and Tracking Technologies Policy.

We may process information contained in customer-support requests, merchant enquiries, complaints, transaction disputes, chargeback requests, fraud reports, investigations, communications with Tunzaa and regulatory complaints. We use this information to respond to users, investigate complaints, resolve disputes, prevent fraud, protect payment systems, comply with regulatory obligations and maintain appropriate records.

Subject to applicable law and lawful limitations, individuals may have rights to request access to their Personal Data; request correction of inaccurate or incomplete information; request deletion or erasure where legally available; request restriction of certain processing; object to certain processing; withdraw consent where consent is the applicable legal basis; exercise applicable rights concerning automated decision-making; object to direct marketing where applicable; and lodge a complaint concerning the processing of Personal Data.

Rights may be subject to lawful limitations. Tunzaa may be unable to immediately delete or provide unrestricted access to certain information where doing so would conflict with a legal obligation, interfere with fraud prevention, compromise security, prejudice an investigation, affect another person’s rights, interfere with legal proceedings, conflict with regulatory record-keeping obligations or otherwise be restricted by applicable law. Where we cannot comply fully with a request, we will provide an explanation to the extent permitted by law.

Requests concerning Personal Data should be directed to Tunzaa using the contact details below. Privacy and Data Protection Contact: mambo@tunzaa.co.tz. Tunzaa Digital Holdings Limited, P.O. Box 13416 Posta Mpya, Delta House – Dunga Street/Morocco Road, Plot 399/Block 42, Kinondoni, Dar es Salaam – Tanzania.

For security purposes, we may require reasonable verification of your identity before processing a request.

Unless expressly stated otherwise, Malipo is not intended for children under 18. Malipo is principally designed for businesses, merchants, payment users and persons with legal capacity to enter into applicable agreements. Tunzaa does not knowingly collect children’s Personal Data except where lawful and necessary for a specific service. Where applicable law requires parental or guardian involvement, appropriate safeguards will apply.

Tunzaa may restrict, suspend, delay or subject an account or transaction to additional review where necessary to protect the Malipo platform and users, investigate suspected fraud, comply with regulatory requirements, prevent financial crime or investigate security incidents. Risk controls may operate automatically or through human review.

Because Malipo is payment infrastructure, merchants may be required to provide information concerning their business, ownership, beneficial owners, authorised representatives, business activities, licences, registrations, transactions, settlement arrangements and compliance status. Tunzaa may use this information to determine eligibility for Malipo services and to satisfy applicable regulatory and compliance requirements.

If a Tunzaa entity or Malipo business is involved in a merger, acquisition, restructuring, financing, sale of assets, transfer of business or similar corporate transaction, Personal Data may be transferred or disclosed as part of that transaction where lawful and necessary. Any such transfer will remain subject to applicable data-protection requirements.

Tunzaa may update this Privacy Policy from time to time to reflect changes to Malipo, new payment functionality or partners, changes in technology, regulatory requirements, changes in applicable law, security developments or changes to our data-processing practices. Where changes are material, Tunzaa will take reasonable steps to notify affected users through appropriate channels. The Last Updated date at the beginning of this Policy indicates when it was most recently revised.

If you believe that your Personal Data has been processed unlawfully or that your data-protection rights have been infringed, you should first contact Tunzaa so that we have an opportunity to investigate and resolve the matter. Where applicable, you may also lodge a complaint with the Personal Data Protection Commission (PDPC) or another competent authority.

This Privacy Policy shall be governed by the laws applicable to the relevant Malipo service and jurisdiction. For Malipo services provided to users in Tanzania, applicable mandatory Tanzanian laws and regulatory requirements concerning Personal Data will apply. Nothing in this Policy is intended to exclude or restrict any mandatory right or protection that cannot lawfully be excluded or restricted.

For general enquiries concerning Malipo: Tunzaa Digital Holdings Limited, P.O. Box 13416 Posta Mpya, Delta House – Dunga Street/Morocco Road, Plot 399/Block 42, Kinondoni, Dar es Salaam – Tanzania. Email: mambo@tunzaa.co.tz.

Tunzaa Fintech Inc., 256 Chapman Road, STE 105-4, Newark – New Castle, 19702, Delaware, United States of America.