Privacy Policy

Effective Date: 13 April, 2026
Last Updated: 13 April, 2026

This Privacy Notice explains how [Kinu Africa Limited], a company incorporated under the laws of [Tanzania / insert jurisdiction] with registered office at [insert address] (“Kinu”, “we”, “us”, or “our”), collects, uses, stores, shares, transfers, and otherwise processes personal data in connection with the Kinu platform, including our website, checkout flows, dashboards, mobile interfaces, APIs, affiliate tools, vendor tools, customer support channels, and related services (collectively, the “Platform”).

This Privacy Notice applies to users of Kinu, including:

• customers who purchase products through Kinu;
• vendors who list or sell products through Kinu;
• affiliates who promote products through Kinu;
• visitors to our website and landing pages; and
• any other person whose personal data we collect in connection with the Platform.

This Privacy Notice should be read together with the Kinu Terms of Use, Vendor Terms, Affiliate Terms, Refunds and Chargebacks Policy, and any other policy or notice we make available from time to time.

1. Who We Are

Kinu is a digital commerce and affiliate platform that connects vendors, affiliates, and customers for the sale and promotion of digital products. Depending on the context, Kinu may process personal data as:

• a data controller, where we determine the purposes and means of processing personal data for our own platform operations; or
• a data processor or service provider, where we process personal data on documented instructions of a vendor or other user in connection with platform services.

Where a vendor, affiliate, or other user collects personal data independently outside Kinu, that party is responsible for its own privacy practices and legal compliance.

2. Important Notice About Children

Kinu is not intended for children and is generally designed for adults engaged in business or commercial activity. You must not use Kinu if you are not legally capable of entering a binding contract under applicable law.

We do not knowingly collect personal data from children except where strictly necessary, lawful, and appropriately protected. If we learn that personal data relating to a child has been collected unlawfully or without appropriate authorization, we may delete or restrict that data.

3. The Personal Data We Collect

We may collect the following categories of personal data, depending on how you interact with Kinu:

3.1 Information You Provide Directly

This may include:

• full name;
• username or display name;
• email address;
• phone number;
• billing address or business address;
• country and location details;
• support messages, complaints, survey responses, and other communications;
• identity verification information;
• business registration information;
• tax information;
• bank account, mobile money, wallet, or payout details;
• product listing information;
• marketing preferences; and
• any other information you choose to provide through the Platform.

3.2 Transaction and Account Information

This may include:

• products purchased or sold;
• order references;
• amounts paid or received;
• commission records;
• attribution records;
• refunds, reversals, and chargeback records;
• subscription status;
• support history; and
• account status, including compliance or verification status.

3.3 Technical and Usage Information

When you use the Platform, we may collect technical and usage data, including:

• IP address;
• browser type and version;
• device type and operating system;
• app or browser identifiers;
• session data;
• referring URLs;
• pages viewed;
• dates and times of access;
• clicks, conversions, and attribution events;
• cookie or similar technology identifiers; and
• other diagnostic, log, analytics, and security information.

3.4 Information from Third Parties

We may receive personal data from third parties, including:

• payment processors, banks, mobile money operators, and payout partners;
• identity verification providers;
• fraud detection and sanctions-screening providers;
• analytics and hosting providers;
• advertising and attribution partners;
• vendors and affiliates involved in a transaction; and
• social login or authentication providers, where you choose to use them.

3.5 Sensitive Personal Data

We do not intend to collect sensitive personal data unless it is strictly necessary, lawful, and appropriately protected. Where sensitive personal data is processed, we will do so only where permitted by law and, where required, with the necessary prior written consent or other lawful basis.

4. How We Collect Personal Data

We collect personal data in several ways, including:

• when you create an account;
• when you complete a purchase or listing;
• when you connect a payout method or payment method;
• when you communicate with us;
• when you browse or interact with the Platform;
• when you use affiliate links, referral tools, or vendor tools;
• when you participate in promotions, events, or research; and
• when third-party providers lawfully supply information relevant to fraud checks, verification, payments, analytics, or support.

5. Why We Process Personal Data

We may process personal data for the following purposes:

• to create and manage accounts;
• to enable purchases, sales, affiliate attribution, and payouts;
• to deliver platform features and user support;
• to verify identity, business status, ownership, and payout instructions;
• to detect, investigate, and prevent fraud, abuse, suspicious activity, chargebacks, and security incidents;
• to manage refunds, complaints, disputes, and enforcement actions;
• to comply with legal, regulatory, tax, court, audit, and compliance obligations;
• to communicate transactional, service, security, and administrative notices;
• to send marketing communications where lawful;
• to operate analytics, reporting, and product improvement;
• to protect the rights, safety, and integrity of Kinu, its users, and the public; and
• to establish, exercise, or defend legal claims.

We process personal data only for specific and legitimate purposes and only to the extent necessary for those purposes.

6. Legal Grounds for Processing

Where applicable law requires a lawful basis, we may process personal data on one or more of the following grounds:

• your consent;
• performance of a contract or steps taken at your request before entering a contract;
• compliance with legal or regulatory obligations;
• protection of vital interests;
• establishment, exercise, or defence of legal claims; and
• other lawful and legitimate purposes connected with operating and securing the Platform, provided that such processing is not unfair, excessive, or unlawful.

Where consent is the basis relied on, you may withdraw consent at any time, subject to lawful exceptions and the possibility that some services may no longer be available.

7. Cookies and Similar Technologies

We may use cookies, pixels, SDKs, tags, local storage, and similar technologies to:

• keep users signed in;
• remember preferences;
• secure the Platform;
• measure performance;
• understand traffic and user behavior;
• support attribution and affiliate tracking;
• improve user experience; and
• support lawful marketing and analytics activities.

Some cookies are necessary for the Platform to function. Others help us understand usage or deliver relevant communications.

You may be able to manage cookies through your browser or device settings. Disabling some technologies may affect the functioning of the Platform.

8. Marketing Communications

Where permitted by law, we may send marketing or promotional communications by email, SMS, WhatsApp, in-app message, or similar channels.

Where required, we will provide:

• our identity;
• contact details;
• the purpose of the communication; and
• a valid opt-out mechanism.

You may opt out of non-essential marketing communications at any time by using the unsubscribe or opt-out method provided in the message or by contacting us.

Even if you opt out of marketing communications, we may still send non-promotional messages relating to your account, purchases, payouts, compliance, or security.

9. How We Share Personal Data

We do not share personal data casually or for unlimited purposes. We may share personal data only where reasonably necessary and lawful, including with the following categories of recipients:

9.1 Vendors, Affiliates, and Customers

Where a transaction takes place through Kinu, we may share limited relevant personal data among the parties involved in the transaction, for example:

• customer data with the relevant vendor for fulfillment, support, and refund handling;
• attribution-related data with the relevant vendor and affiliate;
• vendor data with affiliates where necessary to support approved campaigns; and
• limited contact or transactional data where required to investigate disputes, fraud, refunds, or chargebacks.

9.2 Service Providers and Partners

We may share personal data with service providers that help us operate Kinu, including providers of:

• hosting and cloud infrastructure;
• payment processing and payout services;
• mobile money and banking integrations;
• identity verification;
• fraud detection and cybersecurity;
• analytics and communications;
• customer support tools;
• professional advisory services; and
• audit, compliance, and recovery services.

9.3 Regulators, Authorities, and Legal Process

We may disclose personal data where required or permitted by law, including to regulators, courts, law-enforcement authorities, tax authorities, and supervisory bodies.

9.4 Corporate Transactions

If Kinu undergoes a merger, acquisition, restructuring, financing, asset sale, or similar transaction, personal data may be disclosed as part of that transaction, subject to applicable legal safeguards.

9.5 With Your Direction or Consent

We may also share personal data where you direct us to do so or where you have clearly agreed.

10. We Do Not Sell Personal Data as a Standalone Product

Kinu does not sell personal data as a standalone commodity or data brokerage product.

If we ever materially change how we use or disclose personal data for marketing or commercial partnership purposes, we will update this Privacy Notice and, where required, obtain any necessary consent or provide any necessary choice mechanism.

11. International and Cross-Border Transfers

Kinu may use service providers or systems located outside Tanzania or outside the country in which you are located. Where personal data is transferred outside the country, we will take steps to ensure the transfer is lawful and appropriately protected.

Where required by applicable law, we will use one or more of the following:

• your consent;
• contractual safeguards;
• security measures;
• lawful necessity for performance of a contract;
• a lawful permit, approval, or authorization; or
• another legally recognized transfer mechanism.

12. Data Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized or unlawful access, use, alteration, disclosure, destruction, or accidental loss.

These measures may include, where appropriate:

• access controls;
• authentication safeguards;
• encryption or hashing;
• secure storage;
• audit logs and monitoring;
• backups;
• segmentation of sensitive data where possible;
• incident-response procedures; and
• regular review of system vulnerabilities and controls.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

13. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Notice, including for:

• account administration;
• transaction history;
• affiliate attribution and payout records;
• support and complaint handling;
• fraud prevention and investigations;
• legal and regulatory compliance;
• tax, accounting, and audit obligations; and
• establishment, exercise, or defense of legal claims.

Retention periods may vary depending on the category of data and the legal or operational purpose for which it is held. When personal data is no longer required, we will delete, destroy, anonymize, or de-identify it in accordance with our retention and disposal procedures, unless we are required or permitted by law to keep it longer.

14. Your Rights

Subject to applicable law and lawful limitations, you may have the right to:

• be informed about the processing of your personal data;
• request access to your personal data;
• request correction or rectification of inaccurate, outdated, incomplete, or misleading data;
• request erasure, destruction, or deletion of personal data in appropriate circumstances;
• request restriction or suspension of processing in appropriate circumstances;
• object to the processing of your personal data for direct marketing;
• request review of certain automated decision-making outcomes;
• withdraw consent where consent is the basis for processing; and
• lodge a complaint with the relevant data protection authority or other competent authority.

We may ask you to verify your identity before acting on a request.

15. Automated Decision-Making and Profiling

Kinu may use automated tools, scoring, fraud signals, behavioral analytics, or rule-based systems to help detect fraud, manage risk, review unusual transactions, route support, or personalize parts of the Platform.

Where such processing has significant effects and where applicable law grants relevant rights, you may request review or additional human intervention, subject to lawful exceptions.

16. Third-Party Websites and Services

The Platform may contain links to third-party sites, apps, or services. We are not responsible for the privacy practices of third parties that operate independently of Kinu. You should review their privacy notices before providing personal data to them.

17. Independent Processing by Vendors and Affiliates

Vendors and affiliates may collect and process personal data independently outside Kinu, including on their own websites, funnels, community groups, support systems, or mailing tools.

Where they do so independently, they are responsible for their own compliance and privacy practices. Kinu is not responsible for a third party’s privacy notice or misuse of personal data outside Kinu’s own processing operations.

18. Complaints and Privacy Requests

To exercise your rights, update your data, withdraw consent where applicable, or raise a privacy concern, you may contact us at:

[Kinu Africa Limited]
[Physical Address]
[Privacy Email Address]
[Support Email Address]
[Data Protection Officer Contact, if applicable]

We may ask for enough information to identify you and understand your request.

If you are dissatisfied with our response, you may have the right to complain to the Personal Data Protection Commission or another competent authority.

19. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. Where changes are material, we may notify users through the Platform, by email, or by other reasonable electronic means.

The “Last Updated” date at the top of this Privacy Notice indicates when the latest version took effect.

20. Contact

If you have any questions about this Privacy Notice or our privacy practices, please contact:

[Kinu Africa Limited]
[Registered / Physical Address]
[Privacy Email Address]
[Support Email Address]
[Telephone]