1. Purpose

Zembo Motorcycle SMC Limited ("Zembo", "we", "us" or "our") is committed to protecting the privacy and personal data of its customers, riders, website and app visitors, employees, business partners and other stakeholders.

This Policy explains how we collect, use, store, disclose, transfer, retain and dispose of personal data, including data collected through our websites, mobile applications and online advertising. It is written to comply with:

• The Personal Data Protection and Privacy Act, 2019;

• The Personal Data Protection and Privacy Regulations, 2021;

• Other applicable laws of Uganda;

• The policies of the third-party advertising and analytics platforms we use; and

• International data protection best practices where applicable.

2. Scope

This Policy applies to all personal data processed by Zembo through:

• Mobile applications;

• Websites and digital platforms (including zem.bo and any landing pages);

• Online advertising and marketing campaigns;

• Battery swap stations;

• Customer service channels;

• IoT devices and telematics systems;

• Financial and payment systems;

• Employment and contractor relationships;

• Third-party service providers and partners.

It applies to all employees, contractors, agents, consultants and third parties acting on behalf of Zembo.

3. Definitions

Personal Data means information about a person from which that person can be identified, directly or indirectly, including online identifiers such as IP addresses, cookie identifiers, device identifiers and advertising identifiers.

Processing means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, transmission, deletion or destruction.

Data Subject means the individual to whom personal data relates.

Data Controller means Zembo Motorcycle SMC Limited.

Data Processor means a person or entity processing personal data on behalf of Zembo.

Consent means any freely given, specific, informed and unambiguous indication of a data subject's wishes.

Cookies and Similar Technologies means cookies, pixels, tags, software development kits (SDKs), local storage and similar tools that store or read information on your browser or device.

Personal Data Breach means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

4. Data Protection Principles

Zembo processes personal data in accordance with the following principles:

• Lawfulness, fairness and transparency;

• Purpose limitation;

• Data minimisation;

• Accuracy;

• Storage limitation;

• Integrity and confidentiality;

• Accountability.

5. Lawful Basis for Processing

Zembo processes personal data only where one or more of the following lawful grounds exist:

a) Consent: the data subject has provided valid consent (for example, to non-essential cookies and personalised advertising).

b) Contractual necessity: processing is necessary for the performance of a contract with the data subject.

c) Legal obligation: processing is required to comply with legal or regulatory requirements.

d) Legitimate business interests: processing is necessary for Zembo's legitimate business interests, provided such interests do not override the rights and freedoms of the data subject.

e) Protection of vital interests: processing is necessary to protect the life, health or safety of an individual.

6. Collection of Personal Data

Zembo collects only personal data necessary for legitimate business purposes, including:

• Customer onboarding and verification;

• Battery swap services;

• Motorcycle financing administration;

• Payments and collections;

• Fraud prevention;

• Customer support;

• Regulatory compliance;

• Product improvement and analytics;

• Marketing and advertising.

6.1 Data you provide to us

• Name;

• National Identification Number;

• Passport information;

• Telephone number;

• Email address;

• Physical address;

• Payment records;

• Customer communication records;

• Information you submit through forms, enquiries and sign-up pages.

6.2 Data generated through use of our services

• Swap history;

• GPS and location data;

• Motorcycle telemetry data.

6.3 Data collected automatically from our websites and apps

When you visit our websites or use our apps, we and our partners may automatically collect:

• IP address and approximate location;

• Device type, operating system, browser type and language;

• Device identifiers and mobile advertising identifiers (such as the advertising ID provided by your device's operating system);

• Pages or screens viewed, links clicked, time spent and referring website or advertisement;

• Information about actions taken, such as sign-ups, form submissions or app installs ("conversions");

• Cookie and similar technology identifiers.

7. Use of Personal Data

Personal data may be used for:

• Providing battery swap services;

• Managing customer accounts;

• Processing payments;

• Customer support;

• Credit assessment where applicable;

• Fraud prevention and investigations;

• Product development and analytics;

• Measuring and improving the performance of our website, apps and advertising;

• Showing you relevant advertising on third-party platforms and websites, and measuring the results (subject to Section 8);

• Sending service updates and, where permitted, marketing communications;

• Legal and regulatory compliance;

• Safety monitoring and asset protection.

8. Cookies, Online Advertising and Analytics

8.1 Cookies and similar technologies

We use cookies and similar technologies for the following purposes:

• Strictly necessary: to operate the website or app, keep it secure and remember your settings.

• Analytics: to understand how visitors use our website and apps so we can improve them.

• Advertising and measurement: to show relevant ads, limit how often you see an ad, and measure whether our ads lead to sign-ups, enquiries or app installs.

Where required by law, we ask for your consent before placing non-essential cookies. You can change your cookie choices at any time through our cookie banner or settings, or through your browser settings.

8.2 Use of third-party advertising and analytics providers

We use third-party advertising and analytics services, which may include conversion tracking, audience measurement and remarketing tools. [Confirm and keep only the tools Zembo actually uses.]

These third-party providers use cookies, device identifiers and similar technologies to:

• Serve ads based on your past visits to our website or use of our app ("remarketing");

• Measure the effectiveness of our ads and record conversions;

• Report on how visitors interact with our website and apps.

Information collected through these technologies may be transmitted to and stored by these providers. Their use of that information is governed by their own privacy policies, which we encourage you to read.

8.3 How to control or opt out of personalised advertising

You can opt out of or limit personalised advertising and tracking by:

• Using the ad-personalisation controls on your device, your browser or the platforms where you see our ads;

• Using the opt-out tools offered by analytics and advertising providers, where available;

• Resetting or limiting your mobile advertising identifier in your device settings;

• Changing your cookie preferences through our cookie banner or your browser settings (note that blocking some cookies may affect how the website works);

• Contacting us at dataprivacy@zem.bo.

8.4 Sensitive information and advertising

Zembo does not use personal data about your financial status or hardship, health, race or ethnicity, religion, sexual orientation, political affiliation, trade-union membership, criminal history or other sensitive categories to target or personalise advertising. We do not use data from your National ID, passport, payment records or credit assessment for advertising purposes, and we do not upload such data to advertising platforms.

8.5 Customer lists and advertising audiences

Where we upload customer contact details (such as email addresses or phone numbers) to an advertising platform to reach or exclude existing customers, we do so only where we have a lawful basis, where those individuals have been told this may happen, and where required by law, with their consent. The data is hashed or otherwise protected before upload and is used only for the purposes described in this Policy. You may object to this use at any time by contacting dataprivacy@zem.bo.

8.6 Marketing communications

We send marketing messages (SMS, email, push notifications or calls) only where permitted by law. Every marketing message includes a simple way to unsubscribe, and you may withdraw your marketing consent at any time without affecting the services you receive from us.

9. Data Subject Rights

Data subjects have the right to:

• Access their personal data;

• Request correction of inaccurate data;

• Request deletion of personal data where permitted by law;

• Object to processing, including processing for direct marketing and personalised advertising;

• Withdraw consent at any time where processing is based on consent;

• Request restriction of processing;

• Request information regarding how their personal data is processed;

• Lodge complaints regarding the processing of their personal data.

Requests may be submitted through:

• Email: dataprivacy@zem.bo

• Phone: 0800 256468

We may need to verify your identity before acting on a request. Zembo responds within the timelines prescribed by law.

10. Data Sharing and Disclosure

Zembo may disclose personal data to:

• Authorised employees;

• Service providers;

• Advertising and analytics providers, limited to the online identifiers and event data described in Section 8;

• Payment processors;

• Insurance providers;

• Credit reference bureaus;

• Technology vendors;

• Auditors;

• Professional advisers;

• Regulators;

• Law enforcement agencies;

• Courts and tribunals.

Personal data is shared only where necessary and lawful.

Zembo does not sell your personal data.

11. Third-Party Processors

All third-party processors must:

• Undergo due diligence;

• Sign confidentiality agreements;

• Execute Data Processing Agreements (or accept equivalent data processing terms, as is the case with standard advertising and analytics platform terms);

• Implement appropriate security safeguards;

• Report data breaches without undue delay;

• Comply with applicable data protection laws.

Zembo remains accountable for personal data processed on its behalf.

12. Cross-Border Data Transfers

Some of our service providers may process data outside Uganda. Where personal data is transferred outside Uganda, Zembo ensures:

• Adequate levels of protection;

• Appropriate contractual safeguards;

• Compliance with applicable legal requirements;

• Protection of the rights of data subjects.

13. Data Security

Zembo implements appropriate technical and organisational safeguards including:

• Encryption;

• Secure authentication mechanisms;

• Access controls;

• Role-based permissions;

• Security monitoring;

• Vulnerability assessments;

• Incident response procedures;

• Employee awareness training.

Access to personal data is limited to authorised personnel only. Our website uses secure (HTTPS) connections.

14. Data Retention

Personal data is retained only for as long as necessary to:

• Fulfil contractual obligations;

• Meet legal and regulatory requirements;

• Resolve disputes;

• Enforce agreements.

Cookie and advertising data is retained for the periods set by the relevant cookie or platform settings (for example, [insert period, e.g. up to 13 months] for analytics data). Upon expiry of retention periods, personal data is securely destroyed, anonymised or archived as required by law.

15. Consent Management

Zembo will:

• Obtain consent where required, including for non-essential cookies and personalised advertising;

• Keep records of consent;

• Ensure consent is freely given and informed;

• Provide easy mechanisms for withdrawal of consent.

Withdrawal of consent does not affect processing already lawfully undertaken.

16. Automated Decision-Making and Profiling

Where automated decision-making, GPS monitoring, telematics analysis, advertising audience segmentation or profiling activities are used:

• Zembo ensures transparency;

• Processing is lawful and proportionate;

• Appropriate safeguards are implemented;

• Data subjects are informed where required by law.

17. Children's Data

Our services and advertising are not directed at children under 18. Zembo does not knowingly collect personal data relating to children without the consent of a parent, guardian or legally authorised representative where required by law, and does not knowingly target advertising to children or create advertising audiences from children's data. If you believe a child has provided us with personal data, please contact dataprivacy@zem.bo and we will delete it.

18. Data Breach Management

Any employee becoming aware of a personal data breach must immediately report it to the Data Protection Officer.

Zembo will:

• Investigate all breaches;

• Contain and mitigate impacts;

• Maintain breach records;

• Notify the Personal Data Protection Office and affected individuals where required by law.

19. Governance and Accountability

The Board and Executive Management provide oversight for data protection compliance.

Zembo designates a Data Protection Officer or Data Protection Focal Person responsible for:

• Monitoring compliance;

• Managing data subject requests;

• Coordinating breach response;

• Conducting privacy awareness programmes;

• Liaising with regulators.

Zembo maintains records of processing activities and periodically reviews compliance controls, including its use of advertising and analytics technologies.

20. Employee Responsibilities

All employees must:

• Protect personal data;

• Follow approved procedures;

• Complete mandatory privacy training;

• Report incidents promptly;

• Access personal data only where authorised;

• Not upload customer data to advertising platforms without approval from the Data Protection Officer.

Violation of this Policy may result in disciplinary action.

21. Complaints Handling

Data subjects may lodge complaints regarding the processing of personal data. Complaints are acknowledged within five (5) working days and investigated promptly.

Where a data subject remains dissatisfied, they may escalate the matter to the Personal Data Protection Office or any competent authority.

22. Changes to this Policy

This Policy is reviewed annually or whenever there are material changes in:

• Applicable laws;

• Business operations;

• Technology systems, including advertising and analytics tools;

• Regulatory or platform requirements.

We will post the updated Policy on our website with a new "Last updated" date. Where changes are material, we will notify you as required by law.

Contact Details

Data Protection Officer / Privacy Contact

Zembo Motorcycle SMC Limited
Plot 56, Muteesa II Road, Ntinda, Kampala

Email: dataprivacy@zem.bo
Phone: 0800 256468