How We Use Your Personal Data and Our Lawful Basis

Date: April 2026

We process your personal data only for the purposes set out below and only where we have a valid lawful basis.

Why lawful basis matters

Your lawful basis determines which rights you can exercise. Where we rely on legitimate interests, you may object. Where we rely on consent, you can withdraw it. Where we rely on contract performance or legal obligation, we cannot stop that processing without affecting our ability to provide the Service.

Providing the Service

Creating and operating your LCY wallet account; processing remittances and currency exchanges; managing balances; processing payments; providing transaction records.

LAWFUL BASIS: Performance of a contract with you.Uganda: DPPA 2019 s.13(2)(b) | Tanzania: PDPA 2022 s.14(b) | Rwanda: DPL Art.12(b) | UK: UK GDPR Art.6(1)(b)

KYC, AML, and CFT compliance

Verifying your identity; ongoing transaction monitoring; sanctions and PEP screening; filing Suspicious Activity Reports (SARs) where required. We have no discretion over this processing i.e. it is required by law.

LAWFUL BASIS: Compliance with a legal obligation.Uganda: DPPA 2019 s.13(2)(c); FTRA 2013 | Tanzania: PDPA 2022 s.14(c); AML Act 2006 | Rwanda: DPL Art.12(c) | UK: UK GDPR Art.6(1)(c); MLR 2017

Fraud prevention and financial crime detection

Monitoring transactions for suspicious patterns; detecting and investigating unauthorised account access; risk-scoring transactions.

LAWFUL BASIS: Legitimate interests (protecting our customers and the integrity of the financial system). LIA available on request from dpo@nala.money

Service improvement and analytics

Analysing aggregated usage patterns to improve product performance. This does not involve automated individual decision-making with legal or similarly significant effects.

LAWFUL BASIS: Legitimate interests (improving the Service for all users). LIA available on request from dpo@nala.money

Transactional communications

Sending transaction confirmations, account alerts, security notifications, service updates, and other communications necessary to provide the Service.

LAWFUL BASIS: Performance of a contract with you. UK: UK GDPR Art.6(1)(b)

Marketing communications

Sending information about NALA products, features, offers, and promotions. You may opt out at any time via the link in any marketing email or through your in-app notification settings.

LAWFUL BASIS: Your consent. UK: UK GDPR Art.6(1)(a); PECR Reg.22. Consent may be withdrawn at any time.

Legal claims and regulatory proceedings

Retaining and disclosing personal data where necessary to establish, exercise, or defend legal claims; responding to regulatory investigations or audits.

LAWFUL BASIS: Legitimate interests (legal claims) and legal obligation. UK: UK GDPR Art.6(1)(c) and (f)

Legitimate Interests Assessments (LIA)

Where NALA relies on legitimate interests as its lawful basis, we have carried out a Legitimate Interests Assessment to confirm that our interests do not override your rights and freedoms. LIA summaries are available on request from dpo@nala.money

‍