Data Protection Policy

Data Protection Policy

Astero Pay Kenya · FusionFi Wallet

Applies to Astero Pay Limited and the FusionFi Wallet

Issued by Board of Directors, Astero Pay Limited

Version Working draft

Effective date 01 May 2026

Review cadence Annual or on material change

Status Privileged & Confidential — Working draft

1.1. Astero Pay Limited (hereinafter referred to as “Astero Pay” or “we or our”) is committed to safeguarding personal information. This Privacy Policy relates to our use and collection of personal information relating to clients of our platforms, including directors, beneficial owners, principals, employees or consultants of our clients and/or vendors (hereinafter referred to as “User” or “you” or “your”).

1.2. Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy shall have the same meaning given to them in the User Agreement or Terms and Conditions posted on our Website or otherwise made available through the Platform.

1.3. This Privacy Policy has been prepared in accordance with the Data Protection Act, No. 24 of 2019 of Kenya, the Data Protection General Regulations, 2021, the Data Protection Registration Regulations, 2021, the Data Protection Complaints Handling Procedure and Enforcement Regulations, 2021, and any other applicable Kenyan data protection laws, regulations, guidelines, or lawful requirements issued by the Office of the Data Protection Commissioner of Kenya, hereinafter referred to as the “ODPC.” Where Astero Pay is subject to additional legal, regulatory, licensing, anti-money laundering, counter-terrorist financing, sanctions, tax, financial services, virtual asset, or other compliance obligations in Kenya or any other jurisdiction in which we operate, we may process personal data as necessary to comply with those obligations.

1.4. When you visit, access, register for, or use our website, web pages, features, mobile applications, application programming interfaces, products, services, or any other platform or technology provided by us, collectively referred to as the “Platform,” we may collect and process personal data about you. For purposes of this Privacy Policy, “personal data” means any information relating to an identified or identifiable natural person. This includes any information that identifies you directly or indirectly, whether on its own or when combined with other information. In this Privacy Policy, personal data may also be referred to as “Personal Information.”

1.5. By opening an account with Astero Pay, hereinafter referred to as an “Account,” accessing the Platform, or using our products or services, you acknowledge that you have read and understood this Privacy Policy. Where consent is required as a lawful basis for processing your Personal Information, such consent will be obtained by the relevant data controller or by Astero Pay on behalf of the relevant data controller, as applicable. You may withdraw your consent at any time, subject to applicable law and any legal or regulatory obligations that may require continued processing.

1.6. This Privacy Policy applies to our Platform and to Personal Information processed by Astero Pay in connection with the provision of our products and services. If you do not agree with this Privacy Policy, you should not access or use the Platform.

1.7. With respect to Personal Information processed under this Privacy Policy, Astero Pay acts as a data processor where it processes Personal Information on behalf of, and in accordance with the lawful instructions of, the relevant data controller. The relevant data controller determines the purposes and means of processing Personal Information. Astero Pay processes Personal Information only as necessary to provide the Platform, perform services, comply with lawful instructions, and meet applicable legal or regulatory obligations.

1.8. We use commercially reasonable physical, electronic and procedural measures to protect your Personal Information. This Privacy Policy does not apply to any anonymized data which cannot be used to identify you.

1.9. We will not use your Personal Information for purposes other than those purposes we have disclosed to you in this Privacy Policy without your permission.

1.10. This Privacy Policy is intended to explain our privacy practices and covers the following areas:

• Principles on which your Personal Information is processed
• Legal bases on which your Personal Information is processed
• Personal Information we may process about you
• Purposes for which your Personal information is processed
• Automated decision making
• Transmission and storage of your Personal Information
• Security of your Personal Information
• Data retention
• Your rights to your Personal Information
• Updating your personal Information
• Information processing for marketing purposes and opting out of such processing
• Processing for AML and fraud prevention and detection purposes
• Cookies
• Eligibility
• Data Protection Officer
• How to get in touch with us

2.1. Your Personal Information is collected and processed in accordance with relevant principles, including: lawfulness, fairness and transparency; for specific and clear purpose; data minimisation; accuracy; storage limitation; integrity and confidentiality (security) and accountability; with all relevant laws and regulations considered; and however applicable.

3.1. We process your Personal Information on the following bases - because the information is necessary for the performance of a contract with you or to take steps at your request to enter into a contract; because you have given your consent if we expressly ask for consent to process your Personal Information for a specific purpose; and to comply with legal and regulatory obligations.

4.1. We may collect the following Personal Information from you when you register with us or use our Platform:

• Contact Information: name, address, email address
• Account information: username and password
• Financial Information: bank and bank account numbers
• Identity Verification Information: date of birth, tax ID number, images of government issued ID, passport, national ID or driving license
• Tax identification number
• Address proof: Utility bill details or similar information
• In addition, for institutional customers:
• Organizational Information: Certificate of incorporation, business registration, certificate of incumbency, business licenses
• Identification Information for beneficial owners, principals, directors and executive management (as applicable)

4.2. We may also automatically collect certain computer, device and browsing information when you access our Platform. This includes:

• Computer or mobile device information, including IP address, operating system, browser type
• Website usage information
• Location information

4.3. We also may collect personal information about you (including your beneficial owners, principals and executive management, as applicable) from public databases and ID verification partners, including:

• public employment profile
• criminal history
• credit history
• status on any politically exposed person and sanctions lists
• address
• other information to help validate your identity

4.4. We also collect Personal Information disclosed by you when you contact us or respond to our communications (e.g., email, telephone, other writing).

4.5. We also collect Personal Information in the form of Account Information from your usage of our Platform. This includes information that is generated by your account activity, including, but not limited to, purchases and redemptions, deposits, withdrawals and account balances.

4.6. When we require certain Personal Information from you, it is because we are required by applicable law to collect this information, or it is relevant for specified purposes. We may not be able to serve you as effectively or offer you all of our services if you elect not to provide certain types of information.

5.1. We may process your Personal Information, in the ways and for the purposes listed below. Such processing may include sharing with third parties in the manner and for the purposes set out below.

• To provide our Platform’s services effectively to our Users and conduct our business:- to administer our Platform’s services, including to carry out our obligations arising from any agreements entered into between our Users and us, which may include passing your data to our payment partners and third parties such as agents or contractors or to our advisors (e.g., legal, financial, business or other advisors). We may also use your Personal Information to develop our products and services, to evaluate new products and services and to improve our service quality, including by performing statistical analysis and reporting on transactions and site usage.
• To manage our risk:- We may use your Personal Information to managing the safety, security and integrity of you and our Platform, including (1) protect, investigate, and avoiding fraudulent, unauthorized or illegal activities, (2) monitor and identify combat spam, malware and/or other security risks, and (3) perform internal operation of our Service such as troubleshooting bugs and other operational problems.
• To receive services from our vendors and conduct our business:- to receive services, including to carry out our obligations arising from any agreements entered into between you and our vendors, which may include passing your data to third parties such as agents or contractors or to our advisors (e.g., legal, financial business or other advisors). This includes vendors that provide ID verification and sanctions tools, which we use to help verify your identity and comply with our legal obligations, such as anti-money laundering laws. ID verification partners use a combination of government records and publicly available information to verify identity. This also includes the financial institutions with which we partner to provide custody of your money and to process payments you have authorized. Our contracts require these vendors to only use your information in connection with the services they perform for us and prohibit them from selling your information to anyone else.
• To verify your identity:- for the purposes of providing facilities, products or services, including conducting screenings or due diligence checks as may be required under applicable law, regulation, directive or our Terms and Conditions.
• In relation to fraud prevention:- We and other organizations may also access and use certain information to prevent fraud as may be required by applicable law and regulation and best practice at any given time. If false or inaccurate information is provided or fraud is identified or suspected, details may be passed to law enforcement and fraud prevention agencies and may be recorded by us or by them. In addition, we may share information with the financial institutions with which we partner to process payments you have authorized. We may also share information with our partner or other financial institutions. For more information on the AML & anti-fraud measures adopted by us, please see section 13 of this Privacy Policy.
• In connection with legal or regulatory obligations:- Law enforcement, regulators and the court service. We may share your information with law enforcement, regulatory authorities, tax authorities, self-regulatory organizations (such as those that operate virtual currency derivative exchanges) and officials, or other third parties when we are compelled to do so by a subpoena, court order, or similar legal procedure, or when we believe in good faith that the disclosure of Personal Information is necessary to prevent physical harm or financial loss, to report suspected illegal activity or to investigate violations of our Terms and Conditions / User Agreement or any other applicable policies. We may also use your personal information to otherwise comply with all applicable laws, regulations, rules, directives and orders.
• In order to communicate with you:- We may use your Personal Information to communicate with you, including providing you with updates on changes to products, services and banking facilities (whether made available by us or through us) including any additions, expansions, suspensions and replacements of or to such products, services and banking facilities and their terms and conditions.
• In connection with disputes:- We may use your Personal Information to address or investigate any complaints, claims or disputes and to enforce obligations owed to us.
• For advertising: - Subject to applicable laws and regulations, we may use your Personal Information to inform our advertising and marketing strategy and to tailor our messaging to your needs. Where required by law, we will ask for your consent at the time we collect your data to conduct such marketing. An opt-out mechanism will be provided to you in each communication to enable you to exercise your right to opt out of any direct marketing. We never sell your information. You may withdraw this consent or opt-out at any time without affecting the lawfulness of processing based on your prior consent. Where we use third party advertising companies to serve ads when you visit or use the Platforms, these companies may use information about your visits to our Platform and other platforms that are contained in web cookies and other tracking technologies in order to provide advertisements about goods and services of interest to you, provided you have consented to the same.

5.2. For the purpose stated in paragraph 5.1(f) we may collect and process some of your personal data without your knowledge or consent; and only where this is required or permitted by law. We may be compelled to surrender your personal data to legal authorities without your express consent, if presented with a court order or similar legal or administrative order, or as required or permitted by the laws, rules and regulations of any nation, state or other applicable jurisdiction.

6.1. Our operation of the Platform relies on automated analysis of Personal Information provided by you, alongside that received from AML service provider and compliance service provider, name screening agencies and fraud prevention agencies, for more information on the anti-fraud measures adopted by us, please see section 13 of this Privacy Policy.

6.2. We may use criteria such as your identifying information (e.g., your name, tax id number or date of birth) to validate your identity against public records on an automated basis or without human/manual intervention.

6.3. You may also request that we provide information about our methodology and ask us to verify that the automated decision has been made correctly, including requesting us to include a human element in review of automated processing decisions. We may reject the request, as permitted by applicable law. However, generally in these circumstances we will verify (or request the relevant third party to verify) that the source data are functioning as anticipated without error or bias.

7.1. Security over the internet: No method of transmitting data over the internet, through a website, mobile application, API, or other electronic network can be guaranteed to be completely secure. However, we implement appropriate technical and organisational measures designed to protect your Personal Information against unauthorised access, unlawful processing, accidental loss, destruction, alteration, disclosure, or damage. Your Personal Information is stored, transferred, and processed in accordance with the Data Protection Act, No. 24 of 2019 of Kenya, the Data Protection General Regulations, 2021, and other applicable Kenyan data protection laws and regulations.

7.2. Anonymity: Where our services involve virtual assets, blockchain transactions, or public wallet addresses, you acknowledge that such transactions may not be fully anonymous. Public blockchains and distributed ledgers may allow third parties to view wallet addresses, balances, transaction histories, and related transactional information. We, our service providers, regulators, law enforcement agencies, blockchain analytics providers, or other third parties may be able to link a public wallet address or blockchain transaction to other information about you and may thereby identify you. Third parties may also use blockchain analytics, public records, or other data sources to derive additional information about you. Please note that third parties who independently collect or process blockchain-related data are responsible for their own privacy practices. We are not responsible for the privacy policies or independent processing activities of third parties that are not acting on our behalf or under our instructions.

7.3. Secure Storage: All Personal Information you provide to us is stored on secure servers operated by us or by our authorised service providers. Access to Personal Information is restricted to authorised personnel, contractors, service providers, or other permitted recipients who require access for legitimate business, operational, legal, regulatory, compliance, security, or service-related purposes. We require our vendors and service providers who process Personal Information on our behalf to implement appropriate security, confidentiality, and data protection measures, including through written contracts or data processing agreements where required by applicable law. Where we have given you, or where you have chosen, a password or other login credential that enables you to access certain parts of the Platform, you are responsible for keeping such credentials confidential and for complying with any security procedures we notify you of. You must not share your password, authentication codes, or account access credentials with any other person. You should notify us immediately if you suspect unauthorised access to or use of your Account.

7.4. Access and transfer: Your Personal Information may be accessed by our authorised staff, contractors, affiliates, vendors, professional advisers, compliance partners, payment partners, technology providers, or other service providers, whether located in Kenya or outside Kenya, where such access is necessary for the purposes described in this Privacy Policy or otherwise permitted by applicable law. Your Personal Information may be transferred to, stored in, accessed from, or otherwise processed in countries outside Kenya. These countries may have data protection laws that are different from, or may not provide the same level of protection as, the laws of Kenya. Where we transfer Personal Information outside Kenya, we will take steps to ensure that the transfer is carried out in accordance with applicable Kenyan data protection law and that appropriate safeguards are in place.

7.5. Transfer outside Kenya: We will transfer your Personal Information outside Kenya only where permitted under the Data Protection Act, No. 24 of 2019 of Kenya, the Data Protection General Regulations, 2021, and other applicable data protection laws. Such transfers may take place where one or more of the following applies:

• the recipient is located in a country, territory, or sector that provides an adequate level of protection for Personal Information;
• appropriate safeguards have been implemented, including contractual, technical, organisational, or security measures designed to protect your Personal Information;
• the transfer is necessary for the performance of a contract between you and Astero Pay, or for steps taken at your request before entering into a contract;
• the transfer is necessary for the conclusion or performance of a contract between Astero Pay and a third party in your interest;
• the transfer is necessary for compliance with a legal or regulatory obligation;
• the transfer is necessary for the establishment, exercise, or defence of legal claims;
• the transfer is necessary for reasons of public interest;
• the transfer is necessary to protect your vital interests or those of another person;
• you have given explicit consent to the transfer after being informed of the possible risks of such transfer; or
• the transfer is otherwise permitted by applicable law.

Where required, we will ensure that recipients outside Kenya are bound by appropriate contractual obligations, data processing agreements, confidentiality obligations, or equivalent safeguards to protect your Personal Information. Where Astero Pay acts as a data processor, international transfers of Personal Information will be carried out in accordance with the lawful instructions of the relevant data controller, applicable data processing agreements, and applicable Kenyan data protection law.

8.1. Please note that no transmission over the Internet or any method of electronic storage can be guaranteed to be absolutely 100% secure, however, our best endeavours will be made to secure data and the ability to access your personal data.

8.2. Without prejudice to our efforts on the protection of your data, nothing contained in this Policy constitutes a warranty of security of the facilities, and you agree to transmit data at your own risk.

8.3. We do not guarantee that your data may not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards.

8.4. Always check that any website on which you are asked for financial or payment information in relation to our Platform is in fact legitimately owned or operated by us. The risk of impersonating hackers exists and should be taken into account when using our Platform.

8.5. If you do receive any suspicious communication of any kind or request, do not provide your information and report it to us by contacting us via email at info@fusionfi.io . Please also immediately notify us at info@fusionfi.io if you become aware of any unauthorised access to or use of your Account.

8.6. Since we cannot guarantee against any loss, misuse, unauthorised acquisition, or alteration of your data, please take the necessary steps to protect your own personal data, including the adoption of sufficient safety measures such as your choosing of an appropriate password of sufficient length and complexity and to not reveal this password to any third parties.

8.7. Furthermore, we cannot ensure and do not warrant the security or confidentiality of data transmitted to us, or sent and received from us by Internet or wireless connection, including: email, phone, over-the-top (OTT) messaging services or SMS, since we have no way of protecting that information once it leaves and until it reaches us. If you have reason to believe that your data is no longer secure, please contact us at info@fusionfi.io .

8.8. Should your personal data be breached, and the security of your rights be at high risk, we shall promptly and immediately communicate to you the nature of the breach which has taken place, the likely consequences of such a breach and shall describe thoroughly the measures we have implemented to address the breach and to mitigate any and all adverse effects to you and your rights. In the unlikely event of a breach occurring, please reach out to us at info@fusionfi.io for further information and for further advise on how to mitigate the potential adverse effects of such a breach.

8.9. We also aim to conduct all applicable security risk assessments to ensure the availability of risk mitigation controls, to better safeguard the integrity of your data.

9.1. We will retain your Personal Information for as long as is necessary for the processing purpose(s) for which they were collected and any other permitted linked purpose (for example certain transaction details and correspondence may be retained until the time limit for claims in respect of the transaction has expired or in order to comply with regulatory requirements regarding the retention of such data). So, if information is used for two purposes, we will retain it until the purpose with the latest period expires; but we will stop using it for the purpose with a shorter period once that period expires.

9.2. We restrict access to your Personal Information to those persons who need to use it for the relevant purpose(s). Our retention periods are based on business needs, and your information that is no longer needed is either irreversibly anonymized (and the anonymized information may be retained) or securely destroyed. By way of example:

• use to perform a contract: in relation to your Personal Information used to perform any contractual obligation to you, we may retain that Personal Information whilst the contract remains in force plus a further period (depending on jurisdiction and other factors) to deal with any queries or claims thereafter;
• copies of evidence obtained in relation to AML checks: in relation to your Personal Information obtained in relation to AML checks, we may retain that Personal Information whilst our client relationship remains in force plus up to a further 8 years to deal with any queries or claims thereafter; and
• where claims are contemplated: in relation to any information where we reasonably believe it will be necessary to defend or prosecute or make a claim against you, us or a third party, we may retain that information for as long as that claim could be pursued.

10.1. Subject to the Data Protection Act, No. 24 of 2019 of Kenya, the Data Protection General Regulations, 2021, and other applicable Kenyan data protection laws, you have certain rights in relation to your Personal Information. These rights may be subject to lawful limitations, including where processing is necessary for compliance with legal or regulatory obligations, anti-money laundering obligations, sanctions screening, fraud prevention, tax, audit, legal claims, security purposes, or where the rights and freedoms of other persons may be affected. These rights may include:

• Right of Access to information: This means you have a right to receive at no charge, the following information upon submitting a request to us:
• The categories of personal data processed.
• The purposes of the processing of your personal data.
• The recipients or categories of recipients of your personal data both within and outside the Kenya.
• Controls and standards relating to the duration of storage and archiving of your personal data.
• Actions taken upon your requests for rectification, erasure or restriction of processing and objection to processing of your personal data.
• Safeguards in case of cross-border processing of your personal data.
• The existence of automated decision-making, including profiling.
• Actions to be taken in case of personal data breach.
• Procedure to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.
• Right to Rectification: This is your right have your personal data rectified if what is held by us is inaccurate/incomplete.
• Right to Erasure: This is your right, under certain circumstances to ask for your personal data to be deleted. This would apply if your personal data is no longer required for the purposes it was collected for, or your consent for the processing of that data has been expressly withdrawn, or where your personal data has been unlawfully processed. Once deleted all your personal data will be removed from our systems and will not be recoverable. This right is subject to the restrictions laid down in the applicable law, including if the request is in conflict with other legislation(s) to which we are subject.
• Right to Withdraw Consent: If you wish for Astero Pay to stop processing your personal data, it is your right to withdraw consent at any time, where we have asked you for consent to use your information for that particular purpose. To withdraw consent for processing of your personal data, please email us at info@fusionfi.io .
• Right to Restrict Processing: This is your right to ask for a restriction or stop in processing of your personal data, such as in the case where accuracy of personal data is contested by you, or you object to the processing of your personal data, or the processing is in contravention to applicable laws. This right is subject to the restrictions laid down in the applicable law, including for reasons such as where processing is necessary for judicial purposes, or is necessary for protection of public interest or third party rights, or where the processing is limited to the storage of data.
• Right to Data Portability: This is your right to ask for your personal data supplied directly to us, which we have processed pursuant to your consent, under a contract, or by automated means, to be provided to you in a structured, commonly used, and machine-readable or electronic format.
• Right to Object: This is your right to object to the further processing of your personal data which is inconsistent with the primary purpose for which it was collected, and includes processing for profiling, direct marketing and for statistical surveys.
• Rights in Relation to Automated Decision Making and Profiling: This is your right to object to automated decision-making that has legal implications or seriously affects you. This right is subject to restrictions under applicable laws.

10.2. We aim to respond to all legitimate requests without undue delay and within 2 calendar months of receipt of any request from you. Occasionally it may take us longer than 2 calendar months, if your request is particularly complex, or if you have made duplicated or numerous requests. In this case, we will notify you of receipt of such request(s) and keep you updated as to the status of progress concerning such request(s).

10.3. If you have any of these rights under your domestic data protection laws and wish to exercise any of them, please contact us at info@fusionfi.io . We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This security measure is to ensure that your personal data is not disclosed to any person who has no right to receive it.

11.1. Whenever possible, you can update your Personal Information, subject to verification by us. If you wish for us to update your personal data, please contact us at info@fusionfi.io , or proceed to amend the same in your Account on the Platform. We will retain your personal data for as long as your Account has not been closed or as may be needed to provide you access to your Account and/ or services, and in compliance with the law.

12.1. We may use your Personal Information to determine what may be of interest to you. This is how we decide which products, services, and offers may be relevant and of interest to you. By using our Platform, registering an Account, contacting us, requesting information from us, you consent to receiving marketing communications from us. We may communicate with you by e-mail, fax or telephone. You have the right to ask us not to process your Personal Information for marketing purposes. We will inform you if we intend to use your information for such purposes or if we intend to disclose your information to any third party for such purposes.

12.2. Opting Out: You can exercise your right to prevent such processing by not checking certain boxes on our marketing consent form. You can also exercise the right at any time by contacting us at info@fusionfi.io

13.1. Before we provide our services to you, we undertake checks for the purposes of preventing fraud and money laundering and to verify your identity. These checks require us to process Personal Information about you.

13.2. The Personal Information you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering and to verify your identity.

13.3. In order to do so, we may provide information to, obtain information from, and verify information with AML name screening and compliance agencies. We will continue to exchange information with such parties while you have a relationship with us.

13.4. We or AML name screening and compliance agencies may also enable law enforcement agencies, as required by applicable law, to access and use your Personal Information to detect, investigate and prevent crime.

13.5. AML name screening and compliance agencies can hold your Personal Information for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to eight years.

13.6. As part of the processing of your Personal Information, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behavior to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making as set out in section 6 of this Privacy Policy.

13.7. As a consequence of processing, if we, AML name screening or compliance agencies, determine that you pose a fraud or money laundering risk, we may refuse to provide services through the Platform or we may stop providing existing services to you.

14.1. We use cookies on the websites. We may use the data collected through these technologies to better display our Platform, to save you time, to provide better technical support, for promotional purposes, and to measure and analyse Platform usage. The types of cookies we may use are set out below:

• Essential cookies: Necessary for the operation of the website. We may use essential cookies to authenticate users, prevent fraudulent use of user accounts, or offer Platform features.
• Functional cookies: Allow us to recognize and count the number of visitors and see how visitors move around the website when using it. This helps us improve the way the Platform works.
• Analytic cookies: Used to recognise you when you return to the Platform. This enables us to personalise our content for you and remember your preferences.
• Tracking cookies: Record your visit to the Platform, the pages you have visited, and the links you have followed. We will use this information to make the Platform and the content more relevant to your interests. We may also share this information with third parties for this purpose.

14.2. You may be able to refuse or disable cookies by adjusting your web browser settings. Some browsers have options that allow the visitor to control whether the browser will accept cookies, reject cookies, or notify the visitor each time a cookie is sent. If you choose to refuse, disable, or delete these technologies, some of the functionality of the Platform, services and/or features may no longer be available to you or function properly.

15.1. We do not allow access to this Platform to anyone who is underage at your jurisdiction of residence or in the Kenya. If in a circumstance we learn that we have received any information from an underage person, we shall inform the underaged individual that he/she cannot use the Website or the Service.

16.1. In the case of abuse or breach of security, we are not responsible for any breach of security or for any actions of any third parties which receive the information illegally.

16.2. We will not distribute customer information to be used in mailing lists, surveys, or any other purpose other than what is required to perform our services.

16.3. If you choose to restrict the collection or use of your confidential and personal data, please stop using the Platform immediately.

17.1. From time to time, we may revise, amend, or supplement this Privacy Policy to reflect changes in applicable law, regulatory requirements, guidance issued by the Office of the Data Protection Commissioner of Kenya, our Personal Information collection and processing practices, the features of our Platform, security requirements, technology, or our business operations. Where we make material changes to this Privacy Policy, we will take reasonable steps to notify you, which may include posting a notice on the relevant Platform, sending a notification through your Account, sending an email, or using any other appropriate communication channel.

17.2. The updated Privacy Policy will take effect from the date stated in the revised version or from the date on which it is made available, unless otherwise specified. We encourage you to review this Privacy Policy regularly so that you remain informed about how we process and protect your Personal Information.

17.3. Your continued access to or use of the Platform after the effective date of any updated Privacy Policy will be deemed an acknowledgement of the updated Privacy Policy, subject to applicable law. Where any change requires your consent under applicable data protection law, we will request such consent separately.

18.1. We have designated a Data Protection Officer or data protection contact, as applicable, to oversee matters relating to the protection of Personal Information and compliance with applicable data protection laws, including the Data Protection Act, No. 24 of 2019 of Kenya, the Data Protection General Regulations, 2021, and other applicable Kenyan data protection laws and regulations.

18.2. The Data Protection Officer or data protection contact is responsible for supporting our data protection compliance framework, including, where applicable:

• advising on data protection obligations;
• supporting the implementation and maintenance of appropriate policies, procedures, systems, and controls relating to Personal Information;
• assisting with data subject rights requests;
• supporting privacy risk assessments and data protection impact assessments, where required;
• advising on appropriate technical and organisational safeguards;
• supporting the management of personal data breaches;
• liaising with the Office of the Data Protection Commissioner of Kenya, where required; and
• promoting awareness of data protection requirements within the organisation.

18.3. Where Astero Pay acts as a data processor, the Data Protection Officer or data protection contact may also assist in supporting the relevant data controller in meeting its data protection obligations, in accordance with applicable law and any data processing agreement in place.

19.1. If you have any questions about this Privacy Policy, or if you have any complaints, requests, or concerns relating to how your Personal Information is collected, used, stored, disclosed, transferred, or otherwise processed, you may contact our Data Protection Officer or data protection contact at: compliance@mam-laka.com and info@fusionfi.io.

19.2. You may also contact us if you wish to exercise any of your rights under applicable Kenyan data protection law.

19.3. If you believe that your Personal Information has been processed in violation of applicable data protection law, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

20.1. Under the European Union’s General Data Protection Regulation (GDPR), we are providing this GDPR notice to EU residents.

20.2. We have already described in section 5 above as to how we use your Personal Information and how we disclose or share your information. You have the following rights with respect to your Personal Information:

• You have the right to information about your Personal Information processed by us as to (i) the processing purposes; (ii) the categories of Personal Information being processed; (iii) the recipients or categories of recipients who Personal Information have been disclosed to; (iv) the planned duration for which Personal Information is to be stored; (v) the deletion or restricting the processing of Personal Information or to object to such processing; (vi) the appeal to a supervisory authority; (vii) any automated decision making in processing your Personal Information; (viii) the origin of your Personal Information if such information is not collected from you; and (ix) the designation of Personal Information in case of transfer of information.
• You have the right to rectify any inaccurate Personal Information.
• You have the right to request immediate erasure of Personal Information if (i) the Personal Information is no longer necessary to be retained; (ii) you revoke your consent; (iii) you object to the processing of your Personal Information as there is no legitimate ground to process it; and (iv) your Personal Information was processed unlawfully.
• You have the right to restrict any processing of your Personal Information if (i) you object to the accuracy of Personal Information; (ii) the processing is unlawful but instead of erasure you choose to restrict the processing; (iii) we do not need your Personal Information but you may need it for other purposes (iv) you object to the processing pursuant to Article 21(1) of the GDPR.
• You have the right to receive your Personal Information that you provided to us in a structured and readable format.

20.3. If you wish to exercise your rights to your Personal Information, update, delete or restrict any processing of Personal Information or revoke your consent to processing the same, please contact us at info@fusionfi.io . If there is any infringement of GDPR in relation to your Personal Information, you may lodge a complaint with a supervisory authority at your residence jurisdiction of the European Union.