Privacy Policy

1. Introduction

Hoopay ("we," "us," or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our digital wallet and financial services platform operating in Somalia.

This Privacy Policy applies to all information collected through our website, mobile application, and related services (collectively, the "Services"). By using our Services, you consent to the data practices described in this Privacy Policy.

We comply with applicable Somali data protection laws and international privacy standards to ensure your personal information is handled with the highest level of security and confidentiality.

2. Information We Collect

2.1 Personal Information

We collect personal information that you provide directly to us, including:

• Identity Information: Full name, date of birth, nationality, gender
• Contact Information: Email address, phone number, mailing address
• Identification Documents: Passport, national ID, driver's license copies
• Biometric Data: Facial photographs for identity verification
• Financial Information: Bank account details, transaction history, wallet addresses
• Employment Information: Occupation, employer details, source of income

2.2 Technical Information

We automatically collect certain information when you use our Services:

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: App usage patterns, features accessed, time spent on platform
• Network Information: IP address, internet service provider, geolocation data
• Transaction Data: Transaction amounts, timestamps, wallet addresses, payment methods
• Communication Data: Customer support interactions, chat logs

2.3 KYC and Compliance Information

For regulatory compliance and fraud prevention, we collect:

• Government-issued identification documents
• Proof of address documents
• Source of funds documentation
• Sanctions and watchlist screening results
• Transaction monitoring data

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Service Provision

• Creating and managing your account
• Processing transactions and transfers
• Providing customer support
• Facilitating cryptocurrency exchanges
• Managing referral programs

3.2 Compliance and Security

• Verifying your identity (KYC procedures)
• Preventing fraud and money laundering
• Complying with legal and regulatory requirements
• Conducting risk assessments
• Monitoring transactions for suspicious activity

3.3 Communication and Marketing

• Sending transaction confirmations and notifications
• Providing service updates and security alerts
• Marketing our services (with your consent)
• Conducting customer surveys and feedback collection

4. How We Share Your Information

We may share your personal information in the following circumstances:

4.1 Service Providers

We share information with trusted third-party service providers who assist us in:

• Payment processing and banking services
• Identity verification and KYC services
• Cloud storage and hosting services
• Customer support and communication platforms
• Security and fraud prevention services

4.2 Legal and Regulatory Compliance

We may disclose your information when required by law or to:

• Comply with legal obligations and court orders
• Respond to lawful requests from government authorities
• Report suspicious transactions to financial intelligence units
• Cooperate with law enforcement investigations
• Protect our rights and prevent fraud

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of the transaction, subject to appropriate confidentiality protections.

5. Data Security

We implement comprehensive security measures to protect your personal information:

5.1 Technical Safeguards

• End-to-end encryption for data transmission
• Advanced encryption (AES-256) for data storage
• Multi-factor authentication systems
• Regular security audits and penetration testing
• Secure cloud infrastructure with redundancy

5.2 Administrative Safeguards

• Role-based access controls
• Regular employee security training
• Incident response procedures
• Data breach notification protocols
• Third-party security certifications

5.3 Physical Safeguards

• Secure data centers with restricted access
• Environmental controls and monitoring
• Secure disposal of physical documents
• Backup and disaster recovery procedures

6. Data Retention

We retain your personal information for as long as necessary to:

• Provide our services to you
• Comply with legal and regulatory requirements
• Resolve disputes and enforce agreements
• Prevent fraud and maintain security

Specific Retention Periods:

• Account Information: Retained for the duration of your account plus 7 years after closure
• Transaction Records: Retained for 7 years as required by financial regulations
• KYC Documents: Retained for 7 years after account closure
• Communication Records: Retained for 3 years
• Marketing Data: Retained until you withdraw consent or 2 years of inactivity

7. Your Privacy Rights

You have the following rights regarding your personal information:

7.1 Access Rights

• Request access to your personal information
• Obtain copies of data we hold about you
• Request information about how we process your data

7.2 Correction and Update Rights

• Correct inaccurate or incomplete information
• Update your contact and profile information
• Request data accuracy verification

7.3 Deletion Rights

• Request deletion of your personal information (subject to legal requirements)
• Close your account and delete associated data
• Withdraw consent for processing (where applicable)

7.4 Communication Preferences

• Opt-out of marketing communications
• Manage notification preferences
• Control data sharing for marketing purposes

8. International Data Transfers

Some of our service providers and partners may be located outside Somalia. When we transfer your personal information internationally, we ensure appropriate safeguards are in place:

• Contractual protections with data processors
• Compliance with international data protection standards
• Adequacy decisions and certification schemes
• Standard contractual clauses for data transfers

9. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

Parents and guardians who believe their child has provided personal information to us should contact us immediately using the contact details provided below.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

• Remember your preferences and settings
• Analyze website usage and performance
• Provide personalized content and advertisements
• Enhance security and prevent fraud
• Enable social media features

You can control cookies through your browser settings. However, disabling certain cookies may limit your ability to use some features of our Services.

11. Third-Party Services

Our Services may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to third-party sites or services. We encourage you to review the privacy policies of any third-party services you use.

Third-party services we integrate with include:

• Mobile money providers (EVC Plus, Sahal, Zaad, eDahab)
• Cryptocurrency networks and exchanges
• Banking and payment processors
• Identity verification services
• Analytics and performance monitoring tools

12. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will notify you of material changes through:

• Email notifications to registered users
• In-app notifications
• Website banner announcements
• Push notifications (for mobile app users)

Your continued use of our Services after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us:

14. Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee our data protection practices and serve as your primary contact for privacy-related matters.

Our DPO is responsible for:

• Monitoring compliance with data protection laws
• Conducting privacy impact assessments
• Serving as point of contact for data protection authorities
• Providing guidance on data protection matters
• Training staff on privacy requirements