Privacy Policy

Effective date: June 2026

KMG Vital Links Ltd ("KMG", "we", "us", "our") operates the Uza mobile application, the Tayari WhatsApp service and the VitalBot reseller platform. This policy explains how we collect, use, share and retain personal data.

1. Who We Are

KMG Vital Links Ltd is the controller for personal data processed through the Services unless a specific product flow states otherwise. For regulated payment services provided through Gemba Finance Limited, customer and transaction data may also be processed by Gemba for payment execution, safeguarding, compliance oversight and regulatory reporting.

2. Data We Collect

We may collect:

• Identity data: name, date of birth, nationality, ID or passport details, photos, selfie/liveness checks and business documents for KYB.
• Contact data: phone number, WhatsApp ID, email address and postal address.
• Account and security data: username, password hash, OTP records, device identifiers, IP address, login history and risk signals.
• Financial and transaction data: wallet balances, payment references, beneficiaries, products, amounts, currencies, payment method tokens, bank or mobile money details, refunds and chargebacks.
• Compliance data: KYC/KYB status, sanctions and PEP screening outcomes, risk ratings, source-of-funds information, source-of-wealth information where required, review notes and audit logs.
• Communications data: support messages, complaints, WhatsApp interactions, email records and call notes.
• Marketing data: preferences, consent records (including the words you agreed to and when), campaign engagement and opt-out history.
• Website data: the pages you view on our website, what you click, how far you scroll, how long a page is open, the site or campaign that sent you, your device type and browser, and your approximate location (country, region and city). If you sign up on our website, also the details you enter and the page you signed up from. See section 12.
• Vulnerability support data: only where you disclose circumstances that affect the support you need; we minimise access and record only what is necessary.

3. How We Use Data

We process personal data to:

• provide, maintain, secure and improve the Services;
• onboard customers, merchants, resellers, agents and developers;
• process transactions, payments, settlement, remittances and fulfilment;
• perform KYC, KYB, AML, sanctions, PEP, fraud and risk monitoring;
• comply with legal, regulatory, tax, audit and record-keeping obligations;
• investigate complaints, disputes, suspicious activity and security incidents;
• communicate operational, security, support and service updates;
• send marketing where permitted and honour opt-outs.

4. Lawful Bases

Our lawful bases include contract, legal obligation, legitimate interests, consent and, where applicable, substantial public interest for limited vulnerability or financial-crime processing. You can withdraw consent for optional marketing at any time.

5. Sharing

We share personal data only where necessary, including with:

• Gemba Finance Limited for regulated payment services, safeguarding, oversight and reporting;
• payment and product providers such as Stripe, PayFast, Paystack, Paynow, DT One, BlueLabel, Reloadly, Esolutions, EcoCash, InnBucks and similar providers;
• identity verification, AML, sanctions, PEP and fraud-prevention providers;
• telecoms, utility, delivery and fulfilment providers needed to complete a transaction;
• Meta and communications providers for WhatsApp, email and support messaging;
• hosting, security, analytics, monitoring and support infrastructure providers under appropriate contractual controls;
• professional advisers, auditors, insurers and compliance consultants;
• regulators, law enforcement, tax authorities, courts or ombudsman bodies where required or appropriate.

We do not sell personal data.

6. International Transfers

Some providers, counterparties and fulfilment partners operate outside the United Kingdom. Where personal data is transferred internationally, we use appropriate safeguards such as adequacy decisions, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, transfer risk assessments and technical controls such as encryption.

7. Retention

We retain data only for as long as needed for the purpose collected, including:

• KYC, AML, sanctions, complaints and transaction records: generally 5 years after the end of the relationship or relevant transaction, unless a longer legal hold applies.
• Tax, statutory accounting, payroll and corporate records: generally 6 years from the relevant year-end.
• Technical, device and security logs: generally up to 2 years, unless needed for investigation or security.
• Marketing data and website sign-ups: until you unsubscribe or reply STOP, then only a suppression record (your email address or number and the date) is kept so we do not contact you again.
• Website analytics records: up to 400 days, then deleted.

When retention ends, records are deleted, anonymised or securely archived where lawful.

8. Your Rights

Subject to applicable law and regulatory retention obligations, you may request access, correction, deletion, restriction, portability or objection to processing. You may object to direct marketing at any time.

Contact privacy@kmgvitallinks.co.uk to exercise your rights. You may also complain to the UK Information Commissioner's Office.

9. Security

We use technical and organisational controls including TLS encryption in transit, encryption at rest for sensitive data, hashed passwords, OTP-based authentication, role-based access control, audit logging, vulnerability management and security monitoring.

No system is fully secure. Report suspected vulnerabilities or account compromise to security@kmgvitallinks.co.uk.

10. Breaches

Where a personal data breach occurs, we assess, contain, investigate and record it. If a breach is likely to result in risk to individuals, we notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware. If a breach is likely to result in high risk to affected individuals, we notify those individuals where required.

11. Children

The Services are intended for adults aged 18 and over. We do not knowingly provide the Services to children.

12. Marketing and website analytics

Website analytics. When you visit our website we count visits with our own tools. We do not use advertising or tracking cookies for this. We record the pages you view, what you click, how far you scroll, how long a page is open, the website or campaign that sent you, your device type and browser, and your approximate location (country, region and city) taken from your connection. We do not store your IP address with these records. To count visitors without following anyone, we make a one-way code from your connection details that changes every day. It cannot be used to identify you or to recognise you on another day. If your browser sends a Do Not Track or Global Privacy Control signal, we do not record your visit. We keep these records for up to 400 days. Our lawful basis is our legitimate interest in understanding and improving our website.

Sign-ups for tips and updates. If you sign up on our website, we collect the details you enter (your name if you give it, your email address, your WhatsApp number and what you are interested in), the page and campaign you signed up from, and your approximate location. We use these only to send you practical tips and product updates, and only on the channel or channels you tick: email, WhatsApp, or both. Our lawful basis is your consent, and we keep a record of the words you agreed to and when. We do not sell your details or share them for other companies' marketing. WhatsApp messages are sent through Meta's WhatsApp Business platform.

Stopping. You can withdraw consent at any time. Use the unsubscribe link in every email, reply STOP to any WhatsApp message, or write to privacy@kmgvitallinks.co.uk. Stopping WhatsApp does not stop email unless you ask, and the reverse. If you are already a customer, we may tell you about similar services where the law allows, and you can opt out of that at any time too.

Cookies. We use strictly necessary cookies for sign-in, security and to run our services. Any other cookie or similar technology that is not strictly necessary is used only with your consent.

13. Changes

We may update this Privacy Policy from time to time. Material changes will be notified in-app, by email, WhatsApp or another reasonable channel.

14. Contact

KMG Vital Links Ltd.

Privacy: privacy@kmgvitallinks.co.uk Security: security@kmgvitallinks.co.uk Support: support@kmgvitallinks.co.uk