Welcome to Umali. We are committed to protecting your personal data and being transparent about how we use it.

Umali operates as a marketplace platform we connect customers, vendors, and riders. We do not manufacture food, employ riders, or hold payment funds. Payments flow directly through our licensed payment gateways and are never held by Umali.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have. It applies to all users of the Umali mobile application and website customers, vendors, and riders in Rwanda, Nigeria, Kenya, and Ghana.
Please read this policy carefully. By using the Umali platform, you acknowledge that you have read and understood this Privacy Policy.

Contents

This policy is organised into four country-specific sections. Please read the section that applies to your country.

• Rwanda · Law No. 058/2021 · Rwanda Data Protection Office
• Nigeria · NDPA 2023 & GAID 2025 · Nigeria Data Protection Commission
• Kenya · Data Protection Act 2019 · Office of the Data Protection Commissioner
• Ghana · Data Protection Act 2012 (Act 843) · Data Protection Commission

This section applies to users of Umali located in Rwanda. All personal data collected from users in Rwanda is processed in accordance with Law No. 058/2021 on the Protection of Personal Data and Privacy. Umali is registered as a data controller with the Rwanda Data Protection Office.

Information We Collect

When you register on Umali, we collect your full name, mobile phone number, and optionally your email address. Depending on how you use the platform, we collect additional information as described below.

For customers, we collect your delivery addresses, order history, in-app chat messages with vendors, and feedback you submit after a delivery. We also collect information about your device — such as your device type, operating system, app version, and push notification identifier — to ensure the app functions correctly on your device. When you use our AI-powered food suggestions, we retain a record of your interactions with that feature to personalise your experience.

For vendors, we collect your business name, business location, menu details, operating hours, and bank or mobile money account information for the purpose of processing your earnings. We also retain records of your order activity and your interactions with the Umali vendor AI business assistant.

For riders, we collect your full name, mobile phone number, delivery history, and device information. We also access your precise GPS location during active deliveries to coordinate order assignment and display your estimated arrival time to customers.

We collect your precise GPS location when you use the app, with your explicit permission, to show nearby vendors, calculate delivery fees, and assign riders. You may withdraw location permission at any time through your device settings, though this will limit your ability to use certain features. Rider location data is not retained after a delivery is completed.

How We Use Your Information

We use the information we collect to create and manage your account, verify your identity through OTP authentication, process your orders, coordinate deliveries between customers, vendors, and riders, and send you push notifications about your orders and messages.

We use your location data to show you relevant vendors, calculate your delivery fee based on distance, and assign the nearest available rider to your order. We use your order history and browsing behaviour to personalise the food and vendor suggestions you see on your home screen through our AI recommendation system.

For vendors, we use your business and order data to operate the Umali AI business assistant, which provides you with business insights, sales summaries, and operational recommendations based on your own activity on the platform.

We also use data across the platform to detect and prevent fraud, investigate disputes, maintain the security of accounts, and comply with our legal obligations in each country where we operate.

Legal Basis for Processing

We process your personal data on the following legal bases: your consent, where it is required for the performance of a contract with you, where we have a legal obligation to do so under Rwandan law, or where we have a legitimate interest in doing so that does not override your rights and freedoms.

Artificial Intelligence and Automated Processing

Umali uses artificial intelligence in three ways. First, we use an automated recommendation system that analyses your order history, browsing behaviour, location, and time of day to personalise the food and vendor suggestions displayed on your home screen. This is an automated process — no individual reviews your recommendations. It does not affect your pricing, access to the service, or account standing. You may request that your data not be used for personalised recommendations by contacting us at support@umali.app.

Second, vendors have access to the Umali AI business assistant, which generates business insights and recommendations by analysing the vendor's own order data, sales trends, menu performance, and customer ratings. This assistant works exclusively with the vendor's own business data. Individual customer personal data is not surfaced to vendors through this feature.

Third, when a customer places an order, the platform automatically sends a standard order notification message to the vendor through the in-app chat. This is a rule-based automated trigger — not generative AI — and the message content is standardised.

We also use automated systems to monitor platform activity for fraud, suspicious behaviour, and security threats. These systems run in real time, but no account action is taken solely on the basis of an automated decision without human review.

You have the right to object to profiling and automated decision-making, to request human review of any automated decision that has affected your account, and to request an explanation of how such a decision was made. To exercise any of these rights, please contact support@umali.app.

Payment Processing

Payments on Umali are processed through our licensed third-party payment gateways PawaPay in Rwanda and Kenya, and Paystack in Nigeria and Ghana. These gateways handle the collection of payments from customers and the disbursement of earnings to vendors. We do not store your full payment credentials. To process your payment, we share your transaction amount and payment identifier with the relevant gateway. You are encouraged to review the privacy policies of PawaPay pawapay.io and Paystack paystack.com for information on how they handle your data.

How We Share Your Information

We do not sell your personal data. We share your information only to the extent necessary to deliver the service.

We share your order details — including your name, delivery address, and order contents — with the vendor you have ordered from, so they can prepare your order. We share your delivery address and the vendor's pickup location with your assigned rider to fulfil the delivery. We share the minimum information required for payment processing with our payment gateway.

We may disclose your information to legal or regulatory authorities where required by law or a lawful order in Rwanda, Nigeria, Kenya, or Ghana. In the event of a merger or acquisition, your data may transfer to the successor entity, subject to the same privacy protections, and we will notify you in advance where possible.

Your Rights

As a user in Rwanda, you have the following rights regarding your personal data. To exercise any of these rights, please email support@umali.app. We will respond within 30 days and may verify your identity before processing your request.

• The right to be informed about how your personal data is collected and used
• The right to access the personal data we hold about you
• The right to correct inaccurate or incomplete data
• The right to request deletion of your personal data
• The right to object to or restrict the processing of your data
• The right to withdraw consent at any time, without affecting past processing
• The right to object to automated decision-making and profiling
• The right to lodge a complaint with the Rwanda Data Protection Office at dpo.gov.rw

How Long We Retain Your Information

We retain your account information for as long as your account is active, and for two years after your account is deleted. Order history is retained for five years for service, legal, and dispute resolution purposes. Payment transaction records are retained for seven years in line with financial record-keeping requirements. In-app chat messages are retained for twelve months and then deleted, unless required for an ongoing dispute. AI interaction data is retained for six months to improve accuracy and is then anonymised or deleted. Rider location data is not retained after a delivery is completed.

Security

We apply appropriate technical and organisational measures to protect your personal data. All data transmitted between your device and our servers is encrypted. Account access is protected by OTP-based authentication. Access to personal data is restricted to staff who require it for their role. We conduct regular security testing and monitoring to safeguard the platform.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the National Cyber Security Authority (NCSA) within 48 hours and will notify affected users without undue delay, in accordance with Law No. 058/2021.

Children

Umali is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us at support@umali.app and we will delete it promptly.

Changes to This Policy

We review this Privacy Policy at least annually. When we make material changes, we will notify you through the app in advance of the changes taking effect. The Effective Date shown at the top of this policy will reflect the most recent version. Your continued use of Umali after notification of changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at support@umali.app. We aim to respond within five business days.

This section applies to users of Umali located in Nigeria. All personal data is processed in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive (GAID), which took effect on 19 September 2025.

Information We Collect

When you register on Umali, we collect your full name, mobile phone number, and optionally your email address. Depending on how you use the platform, we collect additional information as described below.

For customers, we collect your delivery addresses, order history, in-app chat messages with vendors, and feedback you submit after a delivery. We also collect information about your device — such as your device type, operating system, app version, and push notification identifier — to ensure the app functions correctly on your device. When you use our AI-powered food suggestions, we retain a record of your interactions with that feature to personalise your experience.

For vendors, we collect your business name, business location, menu details, operating hours, and bank or mobile money account information for the purpose of processing your earnings. We also retain records of your order activity and your interactions with the Umali vendor AI business assistant.

For riders, we collect your full name, mobile phone number, delivery history, and device information. We also access your precise GPS location during active deliveries to coordinate order assignment and display your estimated arrival time to customers.

We collect your precise GPS location when you use the app, with your explicit permission, to show nearby vendors, calculate delivery fees, and assign riders. You may withdraw location permission at any time through your device settings, though this will limit your ability to use certain features. Rider location data is not retained after a delivery is completed.

How We Use Your Information

We use the information we collect to create and manage your account, verify your identity through OTP authentication, process your orders, coordinate deliveries between customers, vendors, and riders, and send you push notifications about your orders and messages.

We use your location data to show you relevant vendors, calculate your delivery fee based on distance, and assign the nearest available rider to your order. We use your order history and browsing behaviour to personalise the food and vendor suggestions you see on your home screen through our AI recommendation system.

For vendors, we use your business and order data to operate the Umali AI business assistant, which provides you with business insights, sales summaries, and operational recommendations based on your own activity on the platform.

We also use data across the platform to detect and prevent fraud, investigate disputes, maintain the security of accounts, and comply with our legal obligations in each country where we operate.

Legal Basis for Processing

We process your personal data on the following legal bases: your freely given, specific, informed, and unambiguous consent; where processing is necessary for the performance of a contract with you; where we have a legal obligation under Nigerian law; or where we have a legitimate interest, assessed through a Legitimate Interest Assessment as required by the GAID 2025, that does not override your rights.

Data Protection Officer

In compliance with the NDPA 2023, Umali has designated a Data Protection Officer responsible for overseeing our data protection practices. You may contact our Data Protection Officer at support@umali.app.

Artificial Intelligence and Automated Processing

Umali uses artificial intelligence in three ways. First, we use an automated recommendation system that analyses your order history, browsing behaviour, location, and time of day to personalise the food and vendor suggestions displayed on your home screen. This is an automated process — no individual reviews your recommendations. It does not affect your pricing, access to the service, or account standing. You may request that your data not be used for personalised recommendations by contacting us at support@umali.app.

Second, vendors have access to the Umali AI business assistant, which generates business insights and recommendations by analysing the vendor's own order data, sales trends, menu performance, and customer ratings. This assistant works exclusively with the vendor's own business data. Individual customer personal data is not surfaced to vendors through this feature.

Third, when a customer places an order, the platform automatically sends a standard order notification message to the vendor through the in-app chat. This is a rule-based automated trigger — not generative AI — and the message content is standardised.

We also use automated systems to monitor platform activity for fraud, suspicious behaviour, and security threats. These systems run in real time, but no account action is taken solely on the basis of an automated decision without human review.

You have the right to object to profiling and automated decision-making, to request human review of any automated decision that has affected your account, and to request an explanation of how such a decision was made. To exercise any of these rights, please contact support@umali.app.

Payment Processing

Payments on Umali are processed through our licensed third-party payment gateways PawaPay in Rwanda and Kenya, and Paystack in Nigeria and Ghana. These gateways handle the collection of payments from customers and the disbursement of earnings to vendors. We do not store your full payment credentials. To process your payment, we share your transaction amount and payment identifier with the relevant gateway. You are encouraged to review the privacy policies of PawaPay pawapay.io and Paystack paystack.com for information on how they handle your data.

How We Share Your Information

We do not sell your personal data. We share your information only to the extent necessary to deliver the service.

We share your order details — including your name, delivery address, and order contents — with the vendor you have ordered from, so they can prepare your order. We share your delivery address and the vendor's pickup location with your assigned rider to fulfil the delivery. We share the minimum information required for payment processing with our payment gateway.

We may disclose your information to legal or regulatory authorities where required by law or a lawful order in Rwanda, Nigeria, Kenya, or Ghana. In the event of a merger or acquisition, your data may transfer to the successor entity, subject to the same privacy protections, and we will notify you in advance where possible.

Your Rights

As a user in Nigeria, you have the following rights regarding your personal data. To exercise any of these rights, please email support@umali.app. We will respond within 30 days and may verify your identity before processing your request.

• The right to be informed about the collection and processing of your personal data
• The right to access your personal data and receive a copy
• The right to rectification of inaccurate or incomplete data
• The right to erasure of your personal data in certain circumstances
• The right to restrict or object to the processing of your data, including for direct marketing
• The right to data portability in a structured, machine-readable format
• The right to object to automated decision-making and profiling
• The right to withdraw consent at any time without affecting past processing
• The right to lodge a complaint with the Nigeria Data Protection Commission at ndpc.gov.ng

How Long We Retain Your Information

We retain your account information for as long as your account is active, and for two years after your account is deleted. Order history is retained for five years for service, legal, and dispute resolution purposes. Payment transaction records are retained for seven years in line with financial record-keeping requirements. In-app chat messages are retained for twelve months and then deleted, unless required for an ongoing dispute. AI interaction data is retained for six months to improve accuracy and is then anonymised or deleted. Rider location data is not retained after a delivery is completed.

Security

We apply appropriate technical and organisational measures to protect your personal data. All data transmitted between your device and our servers is encrypted. Account access is protected by OTP-based authentication. Access to personal data is restricted to staff who require it for their role. We conduct regular security testing and monitoring to safeguard the platform.

Annual Compliance

In compliance with the GAID 2025, Umali conducts annual privacy compliance audits and files audit returns with the Nigeria Data Protection Commission.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission and affected users without undue delay, in accordance with the NDPA 2023.

Children

Umali is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us at support@umali.app and we will delete it promptly.

Changes to This Policy

We review this Privacy Policy at least annually. When we make material changes, we will notify you through the app in advance of the changes taking effect. The Effective Date shown at the top of this policy will reflect the most recent version. Your continued use of Umali after notification of changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at support@umali.app. We aim to respond within five business days.

This section applies to users of Umali located in Kenya. All personal data is processed in accordance with Kenya's Data Protection Act No. 24 of 2019 and the Data Protection (General) Regulations 2021. Umali is registered as a data controller with the Office of the Data Protection Commissioner (ODPC) as required by law.

Information We Collect

When you register on Umali, we collect your full name, mobile phone number, and optionally your email address. Depending on how you use the platform, we collect additional information as described below.

For customers, we collect your delivery addresses, order history, in-app chat messages with vendors, and feedback you submit after a delivery. We also collect information about your device — such as your device type, operating system, app version, and push notification identifier — to ensure the app functions correctly on your device. When you use our AI-powered food suggestions, we retain a record of your interactions with that feature to personalise your experience.

For vendors, we collect your business name, business location, menu details, operating hours, and bank or mobile money account information for the purpose of processing your earnings. We also retain records of your order activity and your interactions with the Umali vendor AI business assistant.

For riders, we collect your full name, mobile phone number, delivery history, and device information. We also access your precise GPS location during active deliveries to coordinate order assignment and display your estimated arrival time to customers.

We collect your precise GPS location when you use the app, with your explicit permission, to show nearby vendors, calculate delivery fees, and assign riders. You may withdraw location permission at any time through your device settings, though this will limit your ability to use certain features. Rider location data is not retained after a delivery is completed.

How We Use Your Information

We use the information we collect to create and manage your account, verify your identity through OTP authentication, process your orders, coordinate deliveries between customers, vendors, and riders, and send you push notifications about your orders and messages.

We use your location data to show you relevant vendors, calculate your delivery fee based on distance, and assign the nearest available rider to your order. We use your order history and browsing behaviour to personalise the food and vendor suggestions you see on your home screen through our AI recommendation system.

For vendors, we use your business and order data to operate the Umali AI business assistant, which provides you with business insights, sales summaries, and operational recommendations based on your own activity on the platform.

We also use data across the platform to detect and prevent fraud, investigate disputes, maintain the security of accounts, and comply with our legal obligations in each country where we operate.

Legal Basis for Processing

We process your personal data on the following legal bases: your consent; where processing is necessary for the performance of a contract with you; where we have a legal obligation under Kenyan law; to protect vital interests; or where we have a legitimate interest that does not override your rights and freedoms.

Artificial Intelligence and Automated Processing

Umali uses artificial intelligence in three ways. First, we use an automated recommendation system that analyses your order history, browsing behaviour, location, and time of day to personalise the food and vendor suggestions displayed on your home screen. This is an automated process — no individual reviews your recommendations. It does not affect your pricing, access to the service, or account standing. You may request that your data not be used for personalised recommendations by contacting us at support@umali.app.

Second, vendors have access to the Umali AI business assistant, which generates business insights and recommendations by analysing the vendor's own order data, sales trends, menu performance, and customer ratings. This assistant works exclusively with the vendor's own business data. Individual customer personal data is not surfaced to vendors through this feature.

Third, when a customer places an order, the platform automatically sends a standard order notification message to the vendor through the in-app chat. This is a rule-based automated trigger — not generative AI — and the message content is standardised.

We also use automated systems to monitor platform activity for fraud, suspicious behaviour, and security threats. These systems run in real time, but no account action is taken solely on the basis of an automated decision without human review.

You have the right to object to profiling and automated decision-making, to request human review of any automated decision that has affected your account, and to request an explanation of how such a decision was made. To exercise any of these rights, please contact support@umali.app.

Payment Processing

Payments on Umali are processed through our licensed third-party payment gateways PawaPay in Rwanda and Kenya, and Paystack in Nigeria and Ghana. These gateways handle the collection of payments from customers and the disbursement of earnings to vendors. We do not store your full payment credentials. To process your payment, we share your transaction amount and payment identifier with the relevant gateway. You are encouraged to review the privacy policies of PawaPay pawapay.io and Paystack paystack.com for information on how they handle your data.

How We Share Your Information

We do not sell your personal data. We share your information only to the extent necessary to deliver the service.

We share your order details — including your name, delivery address, and order contents — with the vendor you have ordered from, so they can prepare your order. We share your delivery address and the vendor's pickup location with your assigned rider to fulfil the delivery. We share the minimum information required for payment processing with our payment gateway.

We may disclose your information to legal or regulatory authorities where required by law or a lawful order in Rwanda, Nigeria, Kenya, or Ghana. In the event of a merger or acquisition, your data may transfer to the successor entity, subject to the same privacy protections, and we will notify you in advance where possible.

Your Rights

As a user in Kenya, you have the following rights regarding your personal data. To exercise any of these rights, please email support@umali.app. We will respond within 30 days and may verify your identity before processing your request.

• The right to be informed of the purpose and manner of processing your personal data
• The right to access the personal data we hold about you
• The right to correction of false, misleading, or outdated data
• The right to deletion of personal data that is no longer necessary
• The right to object to or restrict the processing of your data
• The right to data portability in a structured, machine-readable format
• The right not to be subject to a decision based solely on automated processing that significantly affects you, and the right to request human review of any such decision
• The right to withdraw consent at any time
• The right to lodge a complaint with the Office of the Data Protection Commissioner at odpc.go.ke

How Long We Retain Your Information

We retain your account information for as long as your account is active, and for two years after your account is deleted. Order history is retained for five years for service, legal, and dispute resolution purposes. Payment transaction records are retained for seven years in line with financial record-keeping requirements. In-app chat messages are retained for twelve months and then deleted, unless required for an ongoing dispute. AI interaction data is retained for six months to improve accuracy and is then anonymised or deleted. Rider location data is not retained after a delivery is completed.

Security

We apply appropriate technical and organisational measures to protect your personal data. All data transmitted between your device and our servers is encrypted. Account access is protected by OTP-based authentication. Access to personal data is restricted to staff who require it for their role. We conduct regular security testing and monitoring to safeguard the platform.

Data Breach Notification

In the event of a personal data breach, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach, and will notify affected users without undue delay, in accordance with the Data Protection (General) Regulations 2021.

Children

Umali is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us at support@umali.app and we will delete it promptly.

Changes to This Policy

We review this Privacy Policy at least annually. When we make material changes, we will notify you through the app in advance of the changes taking effect. The Effective Date shown at the top of this policy will reflect the most recent version. Your continued use of Umali after notification of changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at support@umali.app. We aim to respond within five business days.

This section applies to users of Umali located in Ghana. All personal data is processed in accordance with Ghana's Data Protection Act 2012 (Act 843) and Article 18(2) of the 1992 Constitution, which grants citizens a fundamental right to privacy. Umali is registered as a data controller with the Ghana Data Protection Commission, and registration is renewed every two years as required by law.

Information We Collect

When you register on Umali, we collect your full name, mobile phone number, and optionally your email address. Depending on how you use the platform, we collect additional information as described below.

For customers, we collect your delivery addresses, order history, in-app chat messages with vendors, and feedback you submit after a delivery. We also collect information about your device — such as your device type, operating system, app version, and push notification identifier — to ensure the app functions correctly on your device. When you use our AI-powered food suggestions, we retain a record of your interactions with that feature to personalise your experience.

For vendors, we collect your business name, business location, menu details, operating hours, and bank or mobile money account information for the purpose of processing your earnings. We also retain records of your order activity and your interactions with the Umali vendor AI business assistant.

For riders, we collect your full name, mobile phone number, delivery history, and device information. We also access your precise GPS location during active deliveries to coordinate order assignment and display your estimated arrival time to customers.

We collect your precise GPS location when you use the app, with your explicit permission, to show nearby vendors, calculate delivery fees, and assign riders. You may withdraw location permission at any time through your device settings, though this will limit your ability to use certain features. Rider location data is not retained after a delivery is completed.

How We Use Your Information

We use the information we collect to create and manage your account, verify your identity through OTP authentication, process your orders, coordinate deliveries between customers, vendors, and riders, and send you push notifications about your orders and messages.

We use your location data to show you relevant vendors, calculate your delivery fee based on distance, and assign the nearest available rider to your order. We use your order history and browsing behaviour to personalise the food and vendor suggestions you see on your home screen through our AI recommendation system.

For vendors, we use your business and order data to operate the Umali AI business assistant, which provides you with business insights, sales summaries, and operational recommendations based on your own activity on the platform.

We also use data across the platform to detect and prevent fraud, investigate disputes, maintain the security of accounts, and comply with our legal obligations in each country where we operate.

Consent

Under Ghana's Data Protection Act 2012, we obtain your explicit consent before collecting or processing your personal data. You may withdraw your consent at any time by contacting us at support@umali.app. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

Artificial Intelligence and Automated Processing

Umali uses artificial intelligence in three ways. First, we use an automated recommendation system that analyses your order history, browsing behaviour, location, and time of day to personalise the food and vendor suggestions displayed on your home screen. This is an automated process — no individual reviews your recommendations. It does not affect your pricing, access to the service, or account standing. You may request that your data not be used for personalised recommendations by contacting us at support@umali.app.

Second, vendors have access to the Umali AI business assistant, which generates business insights and recommendations by analysing the vendor's own order data, sales trends, menu performance, and customer ratings. This assistant works exclusively with the vendor's own business data. Individual customer personal data is not surfaced to vendors through this feature.

Third, when a customer places an order, the platform automatically sends a standard order notification message to the vendor through the in-app chat. This is a rule-based automated trigger — not generative AI — and the message content is standardised.

We also use automated systems to monitor platform activity for fraud, suspicious behaviour, and security threats. These systems run in real time, but no account action is taken solely on the basis of an automated decision without human review.

You have the right to object to profiling and automated decision-making, to request human review of any automated decision that has affected your account, and to request an explanation of how such a decision was made. To exercise any of these rights, please contact support@umali.app.

Payment Processing

Payments on Umali are processed through our licensed third-party payment gateways PawaPay in Rwanda and Kenya, and Paystack in Nigeria and Ghana. These gateways handle the collection of payments from customers and the disbursement of earnings to vendors. We do not store your full payment credentials. To process your payment, we share your transaction amount and payment identifier with the relevant gateway. You are encouraged to review the privacy policies of PawaPay pawapay.io and Paystack paystack.com for information on how they handle your data.

How We Share Your Information

We do not sell your personal data. We share your information only to the extent necessary to deliver the service.

We share your order details — including your name, delivery address, and order contents — with the vendor you have ordered from, so they can prepare your order. We share your delivery address and the vendor's pickup location with your assigned rider to fulfil the delivery. We share the minimum information required for payment processing with our payment gateway.

We may disclose your information to legal or regulatory authorities where required by law or a lawful order in Rwanda, Nigeria, Kenya, or Ghana. In the event of a merger or acquisition, your data may transfer to the successor entity, subject to the same privacy protections, and we will notify you in advance where possible.

Your Rights

As a user in Ghana, you have the following rights regarding your personal data. To exercise any of these rights, please email support@umali.app. We will respond within 30 days and may verify your identity before processing your request.

• The right to be informed about the collection and use of your personal data
• The right to access the personal data we hold about you
• The right to correct inaccurate, misleading, or outdated data
• The right to request deletion of personal data that is no longer necessary
• The right to object to or restrict the processing of your data
• The right to object to automated decision-making and profiling
• The right to withdraw consent at any time without affecting past processing
• The right to lodge a complaint with the Data Protection Commission at dataprotection.org.gh

How Long We Retain Your Information

We retain your account information for as long as your account is active, and for two years after your account is deleted. Order history is retained for five years for service, legal, and dispute resolution purposes. Payment transaction records are retained for seven years in line with financial record-keeping requirements. In-app chat messages are retained for twelve months and then deleted, unless required for an ongoing dispute. AI interaction data is retained for six months to improve accuracy and is then anonymised or deleted. Rider location data is not retained after a delivery is completed.

Security

We apply appropriate technical and organisational measures to protect your personal data. All data transmitted between your device and our servers is encrypted. Account access is protected by OTP-based authentication. Access to personal data is restricted to staff who require it for their role. We conduct regular security testing and monitoring to safeguard the platform.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Data Protection Commission and affected users as required under Act 843.

Cross-Border Data Transfers

Ghana's Data Protection Act 2012 prohibits the sale or purchase of personal data. Where your data is transferred outside Ghana, we ensure the recipient provides adequate data protection standards consistent with Act 843, the ECOWAS Supplementary Act on Personal Data Protection, and the Malabo Convention.

Children

Umali is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us at support@umali.app and we will delete it promptly.

Changes to This Policy

We review this Privacy Policy at least annually. When we make material changes, we will notify you through the app in advance of the changes taking effect. The Effective Date shown at the top of this policy will reflect the most recent version. Your continued use of Umali after notification of changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at support@umali.app. We aim to respond within five business days.

This Privacy Policy applies to all users of the Umali platform in Rwanda, Nigeria, Kenya, and Ghana. It was prepared in compliance with Law No. 058/2021, the Nigeria Data Protection Act 2023 and GAID 2025, the Kenya Data Protection Act 2019, and the Ghana Data Protection Act 2012 (Act 843). For questions, contact support@umali.app.

Effective Date: 2026 · Last Reviewed: 2026 · Version 1.0