Privacy Policy

1. Who We Are and Who Controls Your Data

Ozapp is a cross-border commerce service that lets you shop from U.S. retailers and pay in your local currency or USD. The Ozapp entity that controls your personal data (the “data controller”) depends on where you are a customer: If you are a customer in Data controller Ghana Ozapp Limited, Accra, Ghana Nigeria Ozapp Nigeria Limited, Nigeria U.S. operations (purchasing, Ozapp LLC, New Jersey, USA warehousing, export) These entities operate together to deliver your orders and act as joint or independent controllers depending on the activity. References to “Ozapp,” “we,” “us,” and “our” mean your data controller above.

2. Scope of This Policy

This Policy covers personal data we process about visitors, registered users, and the recipients you nominate for delivery. It does not cover the privacy practices of third parties such as retailers, payment providers, or carriers, which are governed by their own policies. This Policy is designed to comply with the Ghana Data Protection Act, 2012 (Act 843) and the Nigeria Data Protection Act, 2023, and with other laws that apply to our operations.

3. The Personal Data We Collect

4. How We Collect Your Data

5. Why We Use Your Data and Our Legal Bases

We use your personal data for the purposes below. The lawful bases we rely on are drawn from the Ghana DPA, 2012 and the Nigeria DPA, 2023, which recognize consent, performance of a contract, compliance with a legal obligation, legitimate interests, and the protection of vital interests. Purpose Legal basis Create and manage your account; provide the Service Performance of our contract with you Purchase, ship, clear customs, and deliver your Orders Performance of our contract with you Process payments and currency conversion Performance of contract; legal obligation Legal obligation; our legitimate interest in Verify your identity and screen for fraud, sanctions and AML preventing fraud and abuse Performance of contract; legitimate Provide customer support and respond to claims interest Legitimate interest in running a safe, Improve, secure, and develop the Service effective service Performance of contract; legitimate Send service messages (order updates, security alerts) interest Your consent (which you can withdraw at Send marketing where you have opted in any time) Meet legal, regulatory, tax, and customs obligations Legal obligation

6. Identity Verification, Fraud, AML Screening and Transaction

Monitoring As a regulated cross-border service, we are required to know our customers. We use a third-party verification provider to confirm your identity, check sanctions and watchlists, and assess fraud risk. To do this we share the identity data in Section 3 with that provider, which processes it on our behalf. To protect the platform and meet our legal obligations, we monitor transactions and account activity, conduct ongoing sanctions screening, investigate suspicious behaviour, and may request additional verification at any time. Depending on your transaction activity, we may ask for additional documents and source-of-funds information. Where the law requires, we may report suspicious activity to the relevant authority and may be prohibited from telling you that we have done so. We retain compliance records for the periods required by applicable anti-money- laundering law (see Section 11).

7. Automated Decisions and Profiling

We use automated checks to detect fraud and verify identity — for example, scoring an Order or account against risk indicators such as account age, payment behaviour, and address signals. A high risk score may delay an Order or refer it for human review before we act on it. We do not use these tools to make solely automated decisions that produce legal effects about you without the opportunity for human review. Where you believe an automated check has affected you unfairly, you may contact us to request human review (see Section 13).

8. Who We Share Your Data With

We share personal data only as needed to run the Service and meet our obligations. We do not sell your personal data. Our current key processors include our payment partners (such as Paystack, Nium, Yellow Card, and Stripe) and our identity-verification provider; the categories of recipient are: Category of recipient Why we share Identity / KYC, AML and fraud screening Verify identity, screen sanctions and fraud Collect your payment and convert currency to fund Payment processors and FX / settlement partners purchases U.S. retailers Purchase the products you request on your behalf Freight, customs and last-mile carriers Export, clear, and deliver your Order Cloud, hosting and analytics providers Operate and secure the platform Professional advisors (legal, accounting, audit) Advice, compliance, and protecting our rights Government, customs, tax and law-enforcement Where required by law or to clear your shipment bodies A buyer or successor In a merger, acquisition, or reorganization Where a recipient processes data on our behalf, we put a written agreement in place requiring them to protect your data and use it only for the purposes we specify.

9. International Data Transfers

Delivering your Orders necessarily involves moving data across borders. In particular, data is transferred to the United States, where products are purchased, consolidated, and exported, and may be processed by partners in other countries. This means your data may be processed outside Ghana or Nigeria, in jurisdictions whose data-protection laws may differ from your own. When we transfer your data internationally, we take steps required by the Ghana DPA, 2012 and the Nigeria DPA, 2023 to protect it — for example, relying on your consent for the transfer, on the transfer being necessary to perform our contract with you (to buy and ship your Order), or on contractual safeguards with the receiving party.

10. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, measure performance, and (with your consent) support marketing. You can control non-essential cookies through your browser settings or our cookie controls where offered. Disabling some cookies may affect how the Service works. A separate Cookie Notice may provide more detail and is incorporated into this Policy by reference.

11. How Long We Keep Your Data

We keep personal data only as long as we need it for the purposes in this Policy, then delete or anonymize it. Indicative periods: Data type Retention period While your account is active, and for a reasonable period after Account data closure Order and transaction records As required by tax, accounting and consumer-protection law For the minimum period required by anti-money-laundering law KYC and AML records (commonly at least five years) after the relationship ends Support communications For as long as needed to resolve and evidence the matter Marketing consents Until you withdraw consent or opt out

12. How We Protect Your Data

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, authentication, monitoring, and staff confidentiality obligations. Full card data is handled by PCI-compliant payment partners rather than stored by us. No system is perfectly secure; you also help protect your data by keeping your credentials confidential. If a data breach occurs that is likely to affect your rights, we will notify you and the relevant regulator where the law requires.

13. Your Privacy Rights

14. Marketing and Your Choices

We send marketing only where you have opted in, or as otherwise permitted by law. Every marketing message includes a way to opt out, and you can change your preferences in your account at any time. Opting out of marketing does not stop essential service messages such as order updates, payment receipts, and security notices.

15. Children’s Privacy

The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If we learn that we have collected data from a person under 18, we will delete it. If you believe a child has provided us data, please contact us.

16. Third-Party Links and Services

The Service may link to or interact with third-party sites and services, including retailers and payment providers. We are not responsible for their privacy practices. Please review their privacy notices before providing them your data.

17. Business Transfers

If Ozapp is involved in a merger, acquisition, financing, corporate reorganization, or sale of assets, personal data may be transferred to a successor or buyer as part of that transaction. We will require the recipient to honour this Policy or give you notice of any material change, and the transfer will be subject to applicable data-protection law.

18. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, give reasonable notice through the Service. Your continued use after an update means you accept the updated Policy.

19. How to Contact Us and Complain

20. Your Acknowledgment

By creating an account, placing an Order, or using the Service, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent — for example, for marketing or for a specific data transfer — we will ask for it separately and you may withdraw it at any time. Our core processing to provide the Service and meet our legal obligations does not depend on your consent and continues for as long as the law and our agreement with you require. Shop Global. Pay Local. Delivered to Your Door.