Privacy Policy

Effective Date: August 10, 2025

1. Overview

Jamii Finance Ltd. is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy ("Policy") explains how Jamii Finance Ltd. collects, uses, discloses, and safeguards your information when you interact with its services, including the website, mobile applications, decentralized finance protocol, and any related platforms, products, or services (collectively, the "Services"). By accessing or using the Services, you agree to the terms of this Policy.

Jamii Finance Ltd. operates as a global fintech company developing a decentralized finance ecosystem that integrates lending, staking, payments, virtual cards, and other functionalities. The Services are designed for users worldwide, and Jamii Finance Ltd. complies with applicable data protection laws, including the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other relevant regulations.

2. Information Collected

Information is collected that you provide directly, information collected automatically, and information from third parties. The types of information may include personal data (information that identifies or relates to an identifiable individual) and non-personal data.

2.1 Personal Information

• Account and Profile Information: When you create an account, participate in presales, or use the Services, identifiers such as names, email addresses, phone numbers, usernames, and wallet addresses may be collected.

• KYC/AML Information: For compliance purposes, identification documents, proofs of address, dates of birth, tax identification numbers, and other verification data may be collected through third-party providers.

• Financial and Transaction Information: Details about your transactions, such as amounts involved, wallet addresses, payment methods, loan details, staking positions, and card usage.

• Communication Information: Information you provide when contacting support, such as queries, feedback, or participation in surveys, forums, or governance activities.

2.2 Non-Personal Information

• Device and Usage Information: IP addresses, browser types, operating systems, device identifiers, approximate geolocation data, access times, pages viewed, and interaction data.

• Blockchain Data: Publicly available on-chain data related to your wallet interactions with the protocol, such as transaction hashes, token balances, and smart contract executions. Blockchain data is pseudonymous and immutable; it is not linked to personal information unless required for compliance.

• Analytics Data: Aggregated usage patterns, performance metrics, and error logs to improve the Services.

2.3 Information from Third Parties

Information may be received from partners, such as blockchain oracles, analytics providers, payment processors, card issuers, fiat on-ramp/off-ramp services, and KYC/AML service providers. Sensitive personal information is not collected unless strictly necessary for compliance and with your explicit consent.

3. How Information Is Collected

• Directly from You: When you register, submit forms, make transactions, or interact with the Services.

• Automatically: Through cookies, web beacons, pixels, and similar technologies. Session and persistent cookies are used for functionality, analytics, and personalization. You can manage cookie preferences via your browser settings or the cookie banner.

• From Blockchain Interactions: When you connect your wallet or execute transactions on the protocol.

• From Third Parties: As described above, with appropriate data processing agreements in place.

4. How Your Information Is Used

Information is used for legitimate business purposes, including:

• Providing and Improving Services: To process transactions, manage accounts, facilitate lending, staking, payments, card issuance, and governance.

• Compliance and Security: For identity verification, fraud prevention, risk assessment, and regulatory reporting.

• Personalization and Analytics: To tailor user experiences, analyze usage trends, and optimize performance.

• Marketing and Communications: To send updates, newsletters, promotions, or alerts about the Services (with opt-out options). Anonymized data may be used for market research.

• Legal Obligations: To comply with laws, respond to legal requests, enforce terms, or protect rights and property.

• Revenue Sharing and Ecosystem Support: To distribute rewards, process token buybacks, and support community initiatives.

Under GDPR, the legal bases include consent, contract performance, legitimate interests, and legal obligations.

5. Sharing Your Information

Personal information is not sold. It may be shared with:

• Service Providers: Third-party vendors for hosting, analytics, payment processing, verification, auditing, and security. These providers are bound by data protection agreements.

• Affiliates and Partners: Within the corporate group or with protocol partners for joint services.

• Regulators and Authorities: As required by law, such as for tax reporting or anti-money laundering.

• Business Transfers: In connection with mergers, acquisitions, or asset sales, with notice to you.

• Governance and Community: Anonymized or aggregated data for protocol proposals.

All recipients adhere to appropriate safeguards, such as Standard Contractual Clauses for international transfers.

6. Data Security

Robust security measures are implemented, including:

• Encryption for data at rest and in transit.

• Access controls, multi-factor authentication, and regular audits.

• Privacy-enhancing technologies for on-chain interactions.

• Bug bounty programs and third-party security audits.

• Insurance mechanisms to cover potential losses from incidents.

Despite these measures, no system is infallible. Absolute security cannot be guaranteed, but breaches will be notified as required by law.

7. Your Rights and Choices

Depending on your location, you may have rights such as:

• Access and Portability: Request a copy of your data.

• Correction and Deletion: Update or erase inaccurate or incomplete data (subject to legal retention requirements).

• Objection and Restriction: Opt out of processing for marketing or legitimate interests.

• Withdrawal of Consent: Where processing relies on consent.

• Do Not Sell/Share: Opt out of sales under applicable laws (though data is not sold).

• Automated Decision-Making: Review decisions based on automated processing.

To exercise rights, contact [e-mail]. Responses will be provided within applicable timeframes. Users exercising rights are not discriminated against.

You can also:

• Opt out of marketing via unsubscribe links.

• Manage cookies through the banner or browser.

• Disconnect your wallet to limit on-chain data collection.

8. International Data Transfers

Jamii Finance operates as a global DeFi and fintech ecosystem. This means that, in order to provide our services — including lending, staking, payments, virtual and physical cards, and cross-border transactions — your personal data may be transferred and processed outside of your country of residence.

We take appropriate safeguards to ensure that such transfers comply with applicable data protection laws (including GDPR in the EU, CCPA in the US, and equivalent frameworks in other jurisdictions). These safeguards include:

• Standard Contractual Clauses (SCCs): For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we implement SCCs approved by the European Commission.

• Encryption and Anonymization: All personal and transactional data is encrypted (AES-256) and pseudonymized before transfer. For sensitive operations, we utilize decentralized storage solutions such as IPFS with private key access.

• Modular Compliance Framework: Depending on your region, additional compliance modules may be applied (e.g., KYC requirements in high-limit transactions or AML monitoring for flagged activities).

• Zero-Knowledge Proofs (ZK-proofs): When applicable, we use ZK-proof technology to verify user eligibility (such as collateral thresholds or transaction limits) without disclosing unnecessary personal data.

• Access Control: Only authorized entities (e.g., regulated payment partners, liquidity providers, or institutional custodians) may process limited data strictly necessary to complete the requested transaction.

By using Jamii Finance services, you acknowledge that your data may be transferred across multiple jurisdictions (including but not limited to the EU, US, Africa, Latin America, and Asia) to enable global functionality of our ecosystem.

We will always ensure that these transfers occur under conditions that guarantee a level of data protection consistent with applicable laws, and we provide users with the right to request further details on safeguards used.

9. Cookies and Tracking Technologies

Jamii Finance uses cookies and similar tracking technologies to provide a secure, reliable, and personalized experience when accessing our applications and services. These technologies help us ensure platform functionality, improve performance, and support compliance with legal requirements.

We use the following categories of cookies and tracking tools:

• Essential Cookies: Required for core functions such as authentication, presale participation, wallet connection, and transaction execution. Without these cookies, our services may not function properly.

• Performance and Analytics Cookies: Used to collect anonymous data on how users interact with our platform. This helps us optimize performance, scalability, and user experience.

• Functional Cookies: Enable additional features such as language preferences, session continuity, or customization of dashboards.

• Marketing and Referral Tracking: Applied in limited cases (e.g., presale referral programs, airdrops, loyalty campaigns) to measure campaign effectiveness and reward community participation.

• Blockchain & On-Chain Analytics: Certain anonymized tracking is performed directly on-chain (e.g., wallet activity, staking participation, liquidity provision) for transparency and protocol security.

User Control

You can manage or disable cookies through your browser settings at any time. Please note that disabling essential cookies may limit your ability to fully use the Jamii Finance platform.

Third-Party Tools

We may integrate trusted third-party providers (e.g., analytics, KYC/AML partners, payment gateways). In such cases, data collected through cookies and trackers is anonymized or pseudonymized where possible and handled under strict contractual safeguards.

We do not sell personal data collected through cookies. All processing is conducted in compliance with applicable laws (GDPR, CCPA, and similar regulations).

10. Children’s Privacy

Jamii Finance does not knowingly collect or process personal data from individuals under the age of 18 (or the age of majority in their jurisdiction). Our services — including DeFi lending, staking, payments, and card solutions — are intended for adults with legal capacity to engage in financial transactions.

If we become aware that we have inadvertently collected personal information from a minor, we will take immediate steps to delete such data. Parents or guardians who believe their child has provided information to us should contact us at the address provided in Section 13.

11. Retention of Information

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

Retention periods may vary depending on the type of data:

• Transaction and Blockchain Data: Stored permanently on-chain for transparency and immutability, but pseudonymized where possible.

• KYC/AML Records: Retained for the period required under applicable laws (generally 5–10 years, depending on jurisdiction).

• Account Information & Preferences: Retained as long as you maintain an active Jamii Finance account, or until you request deletion.

• Analytics & Cookies: Retained for shorter periods (typically 6–24 months), after which data is anonymized or deleted.

When data is no longer needed, we securely delete or anonymize it in accordance with industry best practices.

12. Changes to This Policy

Jamii Finance may update this Privacy Policy from time to time to reflect changes in technology, regulation, or our business operations. Any material updates will be posted on our website and within our application, with the “Last Updated” date revised accordingly.

Where legally required, we will notify users in advance (e.g., via email or in-app notification) and, if applicable, request renewed consent.

We encourage you to review this Policy periodically to stay informed about how we protect your data.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, you can reach us at:

Jamii Finance — Privacy Office 📧 Email: [e-mail] 🌐 Website: jamii.finance ✉️ For legal correspondence: please use the “Contact Us” section of the JamFi application or official website.

We will respond to verified inquiries within the timeframe required by applicable law (typically 30 days under GDPR).