Definitions
Date: April 2026
NALA / we / us / our
NALA Inc., incorporated in Delaware, USA acting as data controller for all LCY wallet services.
Partner
A licensed financial institution or payment service provider with whom NALA has entered a commercial arrangement. Details in the NALA Partner Schedule.
Service
Any NALA Local Currency wallet service i.e. mobile application, web platform, account management tools, transaction processing, and associated features.
Personal data
Any information relating to an identified or identifiable natural person, as defined in the applicable data protection law for your jurisdiction.
Special category data
Personal data revealing racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data used for unique identification, health data, or data concerning sex life or sexual orientation.
Biometric data
Data resulting from specific technical processing relating to physical, physiological, or behavioural characteristics allowing unique identification i.e. including facial recognition data and liveness detection data.
Data controller
The entity that determines the purposes and means of processing personal data. NALA Inc. is the data controller for the processing described in this notice.
Data processor
An entity that processes personal data on behalf of and only on the instructions of a data controller.
Joint controller
Where NALA and another entity (such as a Partner) each determine the purposes and means of processing personal data for a specific activity, both are joint controllers.
Consent
A freely given, specific, informed, and unambiguous indication of agreement, expressed through a clear affirmative action. Silence and pre-ticked boxes do not constitute consent.
Legitimate interests
A lawful basis permitting processing where NALA has a genuine, proportionate business need that does not override the data subject's interests. LIAs available on request.
Profiling
Automated processing of personal data to evaluate, analyse, or predict personal aspects relating to an individual.
KYC
Know Your Customer i.e. identity verification and due diligence processes required by anti-money laundering legislation.
AML/CFT
Anti-Money Laundering and Counter-Terrorism Financing i.e. regulatory requirements applicable to financial services businesses including NALA.
DPPA 2019
The Data Protection and Privacy Act 2019 of Uganda, as amended.
PDPA 2022
The Personal Data Protection Act 2022 of Tanzania, as amended.
DPL 2021
Law N° 058/2021 of 13/10/2021 on the Protection of Personal Data and Privacy in Rwanda, as amended.
UK GDPR
Regulation (EU) 2016/679 as retained in UK law by the European Union (Withdrawal) Act 2018, read with the Data Protection Act 2018.
PECR
The Privacy and Electronic Communications Regulations 2003 (UK) — governing cookies, electronic marketing, and electronic communications.
SCCs
Standard Contractual Clauses — contractual safeguards approved by the European Commission for international transfers of personal data.
IDTA
UK International Data Transfer Agreement — the UK mechanism approved by the ICO for international transfers from the United Kingdom.
DPA
Data Processing Agreement i.e. a written contract required by law where a data controller engages a data processor.
JCA
Joint Controller Arrangement i.e. a written agreement between joint controllers governing their respective responsibilities.
‍