Definitions

Date: April 2026

NALA / we / us / our

NALA Inc., incorporated in Delaware, USA acting as data controller for all LCY wallet services.

Partner

A licensed financial institution or payment service provider with whom NALA has entered a commercial arrangement. Details in the NALA Partner Schedule.

Service

Any NALA Local Currency wallet service i.e. mobile application, web platform, account management tools, transaction processing, and associated features.

Personal data

Any information relating to an identified or identifiable natural person, as defined in the applicable data protection law for your jurisdiction.

Special category data

Personal data revealing racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data used for unique identification, health data, or data concerning sex life or sexual orientation.

Biometric data

Data resulting from specific technical processing relating to physical, physiological, or behavioural characteristics allowing unique identification i.e. including facial recognition data and liveness detection data.

Data controller

The entity that determines the purposes and means of processing personal data. NALA Inc. is the data controller for the processing described in this notice.

Data processor

An entity that processes personal data on behalf of and only on the instructions of a data controller.

Joint controller

Where NALA and another entity (such as a Partner) each determine the purposes and means of processing personal data for a specific activity, both are joint controllers.

Consent

A freely given, specific, informed, and unambiguous indication of agreement, expressed through a clear affirmative action. Silence and pre-ticked boxes do not constitute consent.

Legitimate interests

A lawful basis permitting processing where NALA has a genuine, proportionate business need that does not override the data subject's interests. LIAs available on request.

Profiling

Automated processing of personal data to evaluate, analyse, or predict personal aspects relating to an individual.

KYC

Know Your Customer i.e. identity verification and due diligence processes required by anti-money laundering legislation.

AML/CFT

Anti-Money Laundering and Counter-Terrorism Financing i.e. regulatory requirements applicable to financial services businesses including NALA.

DPPA 2019

The Data Protection and Privacy Act 2019 of Uganda, as amended.

PDPA 2022

The Personal Data Protection Act 2022 of Tanzania, as amended.

DPL 2021

Law N° 058/2021 of 13/10/2021 on the Protection of Personal Data and Privacy in Rwanda, as amended.

UK GDPR

Regulation (EU) 2016/679 as retained in UK law by the European Union (Withdrawal) Act 2018, read with the Data Protection Act 2018.

PECR

The Privacy and Electronic Communications Regulations 2003 (UK) — governing cookies, electronic marketing, and electronic communications.

SCCs

Standard Contractual Clauses — contractual safeguards approved by the European Commission for international transfers of personal data.

IDTA

UK International Data Transfer Agreement — the UK mechanism approved by the ICO for international transfers from the United Kingdom.

DPA

Data Processing Agreement i.e. a written contract required by law where a data controller engages a data processor.

JCA

Joint Controller Arrangement i.e. a written agreement between joint controllers governing their respective responsibilities.

‍