Mobile Application Privacy Policy

Version 0.1 · Effective Date: 13 August 2026

1. Introduction

Collexia Financial Payment Systems ("Collexia," "we," "our," or "us") is committed to protecting the privacy and security of personal data. This Mobile Application Privacy Policy explains how personal data may be collected, used, stored, shared, retained, and protected when you use a Collexia mobile application made available through Google Play or the Apple App Store (the "App").

This policy is derived from Collexia’s Data Protection and Privacy Policy and is intended to provide a clear, text-based privacy notice for users of the App. It should be read together with any additional notices or disclosures presented in the App when specific information is requested.

2. Scope

This policy applies to personal data processed through the App, including data provided directly by users, data generated through use of Collexia services, data received from authorized partners or service providers, and technical data generated when the App communicates with Collexia systems.

3. Types of Personal Data the App May Process

Depending on the Collexia service used, the user’s role, and the features enabled in the App, Collexia may process the following categories of personal data:

• Identification Data: Name, identification number, date of birth, gender, customer or account identifiers, and information used for identity verification.
• Contact Data: Email address, phone number, physical address, and other contact details supplied by the user or an authorized party.
• Transaction Data: Payment details, transaction history, payment instructions, payment status, references, and payment preferences.
• Financial Data: Bank account details, billing information, and other financial information required to provide payment services.
• Customer Support Data: Communications with customer support, queries, complaints, feedback, and information supplied when requesting assistance.
• Technical Data: IP address, device information, operating system information, application version, log data, security events, and similar technical information generated when the App connects to Collexia systems.

4. How Personal Data Is Collected

Personal data may be collected directly from you when you register, sign in, submit information, initiate or review transactions, contact support, or otherwise use App features. Collexia may also receive personal data from merchants, financial institutions, integration partners, regulatory or verification services, and other authorized third parties where this is necessary to provide or support Collexia services.

Technical information may be generated automatically when the App communicates with Collexia systems for authentication, security, operational logging, diagnostics, fraud prevention, and service delivery.

5. Purposes for Processing

Collexia may process personal data for the following purposes:

• To authenticate users and protect user accounts.
• To provide, operate, administer, and support payment and related services.
• To process, display, reconcile, or report payment transactions and related activity.
• To perform customer onboarding, identity verification, and account administration where applicable.
• To communicate with users, merchants, partners, and customers about service activity, support matters, and operational notifications.
• To detect, prevent, investigate, and respond to fraud, misuse, cyberattacks, unauthorized access, and other security incidents.
• To comply with legal, regulatory, audit, accounting, and reporting obligations.
• To maintain and improve the reliability, security, performance, and functionality of Collexia systems and services.

6. Legal Basis for Processing

Where applicable, Collexia processes personal data on one or more of the following legal bases: consent, contractual necessity, compliance with legal obligations, and legitimate business interests that are not overridden by the individual’s privacy rights. The legal basis used depends on the type of information and the purpose for which it is processed.

7. Data Sharing and Third-Party Service Providers

Collexia may share personal data with trusted third parties only where necessary for legitimate service, operational, security, legal, or regulatory purposes. These may include:

• Payment processors and financial institutions involved in completing payment transactions.
• Regulatory authorities, including the Bank of Namibia, where disclosure is required for compliance or reporting.
• External auditors and legal advisors for audit, legal, compliance, and regulatory purposes.
• Third-party data processors and technology service providers contracted to support Collexia operations, including cloud, infrastructure, security, communications, and customer support services.

Third-party providers are expected to process personal data only for authorized purposes and subject to appropriate confidentiality, privacy, and security obligations.

8. International and Cross-Border Data Transfers

Where personal data is transferred across borders, Collexia will take appropriate measures to protect the information and to ensure that the transfer is handled in accordance with applicable data protection and payment-service requirements.

9. Data Security

Collexia applies technical and organizational measures designed to protect personal data against unauthorized access, misuse, loss, alteration, disclosure, or destruction. Measures described in Collexia’s broader Data Protection and Privacy Policy include encryption, role-based access control, multi-factor authentication, data masking or anonymization where appropriate, internal and external audits, and employee training.

10. Data Retention

Collexia retains personal data only for as long as necessary for the purpose for which it was collected or as required for legal, regulatory, audit, accounting, security, or dispute-resolution purposes. The broader Collexia Data Protection and Privacy Policy provides the following retention guidelines:

• Payment Transaction Data: A minimum of 5 years for regulatory reporting requirements.
• Customer Identity and Onboarding Data: A minimum of 5 years from the date of the last activity.
• Customer Support and Communication Data: 2 years following resolution of the issue.

Where a longer retention period is required by applicable law, regulation, litigation hold, audit requirement, or another lawful obligation, Collexia may retain the relevant data for that longer period.

11. Your Privacy Rights and Choices

Subject to applicable law and the circumstances of the processing, you may have the right to request access to your personal data, request correction of inaccurate or incomplete information, request deletion, request restriction of processing, request data portability, object to certain processing, withdraw consent where processing is based on consent, and lodge a complaint with a relevant supervisory authority.

Requests may be submitted to the Data Protection Officer using the contact details in Section 15. Collexia may need to verify your identity before acting on a request and may retain information where continued retention is required by law or regulation.

12. Account and Data Deletion Requests

Where the App provides user accounts, users may request deletion of their account and associated personal data by contacting Collexia’s Data Protection Officer. A deletion request does not require Collexia to erase information that must be retained for legal, regulatory, security, audit, accounting, fraud-prevention, or dispute-resolution purposes. Where retention is required, the information will be restricted to the applicable lawful purpose and retained only for the required period.

13. App Permissions, Analytics, Advertising, and Tracking

The App should request access to device features or permissions only where they are necessary for an enabled App function, security control, or user-requested service. Any permission request presented by the operating system should describe the relevant purpose before access is granted.

Collexia’s App Store and Google Play privacy disclosures must accurately reflect the data collected by the App and by any third-party software development kits or service providers integrated into the App. If Collexia introduces analytics, advertising, tracking, or other data-processing functionality not covered by this policy, the relevant disclosures and this policy will be updated before or when that processing begins, as required.

14. Changes to This Policy

Collexia may update this Mobile Application Privacy Policy to reflect regulatory changes, changes to the App, changes to service providers, or improvements in privacy and security practices. The updated version will be made available through a publicly accessible privacy-policy webpage and, where appropriate, through the App.

15. Contact Information

For questions or concerns about this policy, to exercise privacy rights, or to request account or data deletion, please contact:

16. Governing Privacy Framework

This policy is based on Collexia’s broader Data Protection and Privacy Policy, which references ISO/IEC 27701, the General Data Protection Regulation (GDPR), and Bank of Namibia PSD-1, PSD-7, and PSD-12 requirements relevant to payment services, privacy, security, and operational risk management.