Suqi Solutions Limited (“SQI,” “we,” “us,” or “our”) is committed to protecting your privacy and personal data in accordance with the Kenya Data Protection Act, 2019 (DPA) and other applicable data protection laws across East Africa.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or interact with any of our digital services. This Policy applies to all users of:

• SQI’s mobile applications,
• Our websites, including www.sqi-ea.africa and partners.sqi-ea.africa, and
• Any other services or platforms branded as “SQI” that reference this Privacy Policy (collectively referred to as the “Services”).

We encourage you to read this Policy carefully to understand your rights and our obligations regarding your personal data. By registering, accessing, or using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information in line with it.

If you do not agree with the terms outlined in this Privacy Policy, please do not use the Services.

This Policy is incorporated into and governed by the SQI Terms of Use. Capitalized terms used in this Policy and not otherwise defined shall have the meaning assigned in the Terms of Use.

We collect both personal and non-personal information when you interact with SQI Services. This includes data you provide directly, information we receive from third-party platforms (such as loyalty programs or social media), and data we collect automatically when you use our apps, websites, or tools.

You may provide personal information when you:

• Register, subscribe, or create an account;
• Contact SQI for support or inquiries;
• Link your SQI account to a retail loyalty program;
• Use or interact with any part of our Services.

Depending on your activity, we may collect the following categories of information:

1. Registration & Contact Information

• Name, email address, password, and phone number
• Communication preferences and user account credentials
• Social media account identifiers (e.g., Facebook or Google), including profile data like name, email, friend list, and date of birth (if granted access)

2. Relationship & Profile Information

• Demographic details (e.g., birth date, gender, education, marital status, income bracket)
• Interests, shopping preferences, and lifestyle data
• Insights derived from social media interactions and in-app behavior

3. Search & Shopping List Data

• Keywords and search terms used within the app
• Items added to and checked off from your shopping list

4. Purchase History

• Product names, quantities, prices, store names, and purchase dates
• Payment method details (excluding full card or banking information)
• EBT/SNAP usage if applicable
• Order history from any browser extensions you use with SQI

5. Transactional & Behavioral Data

• Offers viewed, redeemed, or saved
• Preferred stores or categories
• In-app navigation patterns and clicks
• Engagement with emails and notifications

6. Loyalty & Retailer Account Information

• Account identifiers (e.g., usernames, loyalty card numbers)
• Purchase history associated with those programs
• Purchase channel (e.g., in-store vs. delivery)

Note: We do not collect full payment card details, banking credentials, or pharmacy information.

7. Geolocation Data

• Approximate or precise location data (city, zip code, time of access)
• Real-time GPS data when using mobile Services with location tracking enabled

You may disable geolocation tracking at any time via your device settings.

8. Mobile Device Information

• Device type, OS version, model, and unique identifiers (e.g., Android Ad ID or iOS IDFA)
• App interaction data, including clicks, screen views, and notification engagement

9. Cookies & Similar Technologies

We and our partners use cookies and related technologies (such as pixel tags, web beacons, and server logs) to collect information that improves our Services and marketing. These may include:

• IP address, browser type, system settings, device identifiers
• Referral and exit pages (before and after visiting our sites)
• Session behavior and usage analytics

We use:

• Session cookies (which expire when you close your browser/app)
• Persistent cookies (which remain until deleted)

In some cases, we associate this data with personally identifiable information. When we do, it is treated in accordance with this Privacy Policy.

If you’ve enabled a mobile app or browser extension, and your device settings permit location access, we may automatically collect and use location data as part of our Services.

SQI uses the information we collect to deliver our services effectively, improve user experience, maintain compliance with legal obligations, and provide you with personalized and secure interactions. Below are the key ways in which we may use your personal and non-personal data:

To Provide and Operate the Services

We use your information to enable you to access and use SQI’s features, such as registering an account, redeeming cashback offers, linking loyalty programs, and tracking purchase history. Your data allows us to verify your identity, fulfill your transactions, process rewards, and maintain the functionality of the platform. Without this information, many features of the SQI services would not work properly.

To Improve and Personalize Your Experience

Your preferences, activity history, and demographic data help us tailor the services we offer to better match your interests. We may suggest personalized offers, shopping list reminders, or content based on your behavior, shopping trends, or location. By analyzing how different users interact with the Services, we can enhance features, streamline navigation, and create a more relevant and enjoyable user experience.

To Communicate With You

We use your contact details to send important service-related messages, such as account updates, reward confirmations, receipts, and security alerts. With your permission, we may also send promotional emails or in-app messages about new features, partner deals, or exclusive offers. These communications are essential to keep you informed and supported throughout your use of the platform.

To Ensure Security and Prevent Fraud

We process certain information to protect you and our systems from fraud, misuse, or unauthorized access. For example, we may use device information, IP addresses, or account activity to detect suspicious behavior. This helps us uphold the integrity of the platform and ensures that your information and rewards are handled securely.

To Conduct Research and Analytics

We analyze user data to understand trends, usage patterns, and campaign performance. This may include aggregating anonymized data to assess the effectiveness of certain offers or improve business decisions. By conducting internal research, we can refine our algorithms, develop new services, and better meet the needs of our users and partners.

To Comply with Legal and Regulatory Obligations

Your data may be used to ensure our operations comply with applicable laws, such as Kenya’s Data Protection Act (DPA 2019). This includes responding to lawful data access requests, maintaining transaction records, and adhering to tax, regulatory, and auditing requirements. In some cases, we may need to retain or disclose your information to law enforcement or regulators.

With Your Consent

Where required by law, we may ask for your explicit consent before processing certain types of information. This applies to areas such as marketing communications, accessing precise geolocation data, or processing sensitive personal information. You may withdraw your consent at any time through your account settings or by contacting us directly. Withdrawal of consent will not affect the lawfulness of processing based on prior consent.

We may share your personal information with trusted third parties in limited circumstances, and only as necessary to provide our Services, comply with legal obligations, or with your consent. We do not sell your personal data. Below are the categories of third parties with whom we may share your information:

1. Service Providers and Vendors

We engage carefully selected service providers who perform functions on our behalf. These may include cloud storage providers, analytics services, customer support tools, IT infrastructure providers, marketing platforms, and payment processors. These partners are bound by contractual obligations to process your data securely and only for the purposes for which we engage them.

2. Retail and Brand Partners

When you redeem offers or connect a loyalty program through SQI, we may share relevant information—such as purchase activity or offer engagement—with participating retailers or brand partners to fulfill promotions, validate rewards, or personalize future offers. Any data shared is limited to what is necessary to complete the intended service and is subject to confidentiality agreements.

3. Linked Third-Party Accounts

If you choose to link your SQI account with third-party services (e.g., retailer loyalty programs or social media platforms), we may share and receive information as part of that integration. This may include sharing identifiers (such as loyalty numbers or usernames) and transaction history. These services operate under their own privacy policies, and we recommend reviewing them before linking.

4. Legal and Regulatory Authorities

We may disclose your information when required by law, regulation, legal process, or government request. This includes situations where we must:

• Comply with a lawful request from public or regulatory authorities
• Enforce our Terms of Use or protect our rights
• Prevent fraud, abuse, or other harmful activity
• Respond to suspected unlawful conduct or legal claims

5. Business Transfers

If SQI is involved in a merger, acquisition, financing, sale of assets, or bankruptcy proceeding, your information may be transferred to a third party as part of that transaction. We will ensure that any successor entity is subject to the same data protection obligations as outlined in this Privacy Policy.

6. With Your Consent

In situations not covered by the categories above, we will ask for your explicit consent before sharing your information. For example, we may seek your permission to share your data with a third party for joint marketing or promotional activities. You can withdraw this consent at any time.

7. Analytics

We use third-party services (such as Google Analytics) to help us understand how visitors interact with our Services and to help improve our user experience. Google provides additional privacy options regarding cookie use described at www.google.com/policies/privacy/partners/.

8. Aggregated and De-Identified Data

SQI may also disclose information about you that does not identify you personally. For example, we may provide our merchants, business partners, or other third parties with reports that contain aggregated data, statistical data, and/or anonymized data.

9. Consent

We may also disclose your information with your consent.

Under the Kenya Data Protection Act, 2019 and other applicable privacy laws, we are required to process your personal data only when we have a lawful basis to do so. Depending on the context and the type of information, SQI processes your data under one or more of the following legal grounds:

1. Consent

We rely on your explicit consent when required, particularly for processing sensitive personal data, sending marketing communications, or accessing your device’s precise geolocation. Consent is obtained clearly and voluntarily at the point of collection, and you have the right to withdraw your consent at any time without affecting the lawfulness of prior processing. You can manage your consent settings within the app or by contacting us at privacy@sqi-ea.africa.

2. Performance of a Contract

When you register for and use our Services, we process your information as necessary to fulfill our contractual obligations to you. This includes creating your account, enabling cashback redemptions, linking to loyalty programs, and facilitating other user-requested services. Without this data, we would not be able to provide the Services you have agreed to use.

3. Legal Obligation

In some cases, we are legally required to process or retain your data. This may include responding to court orders, complying with tax regulations, fulfilling consumer protection obligations, or meeting audit and reporting requirements. We may also be obligated to share information with regulatory authorities or law enforcement when lawfully requested.

4. Legitimate Interests

We may process your data based on our legitimate interests, provided those interests are not overridden by your rights and freedoms. These interests may include:

• Improving and personalizing our Services
• Preventing fraud and securing our systems
• Conducting analytics, research, and business reporting
• Communicating with users for non-marketing, service-related purposes

We always assess the potential impact on your privacy and apply appropriate safeguards when processing under this basis.

5. Vital Interests (Rare Cases)

In rare situations where it is necessary to protect your life or physical safety—or that of another person—we may process your personal information without consent. This basis is only used in emergency situations, such as responding to a serious security incident.

Each time we process your personal data, we ensure there is a valid legal reason, and we apply strong privacy and security practices to protect your rights. For questions or more information about the legal bases we rely on, please contact privacy@sqi-ea.africa.

At SQI, we believe that a more personalized experience enhances the value you get from our Services. However, we understand that you may wish to control how much information you share and how we communicate with you. Below are the ways you can manage your preferences regarding the data we collect, how it’s used, and the communications you receive from us.

Email Preferences

You can manage your email communication preferences at any time by logging into your SQI account via our mobile app or website. Go to the Settings section and navigate to Notifications to customize your choices. You can also unsubscribe from promotional emails by clicking the “Unsubscribe” link found at the bottom of any email we send. You may choose to opt in or out of specific types of communications.

Cookies and Online Tracking

You can control how your browser handles cookies and similar technologies through your browser’s privacy and security settings. Disabling cookies may affect the functionality of some features in our Services. If you want to opt out of third-party targeted advertising, visit:

• Network Advertising Initiative (NAI)
• Digital Advertising Alliance (DAA)

For mobile-specific tracking, you can adjust your mobile browser or device settings to limit cookie storage or advertising ID usage.

Location-Based Features

Certain features within the SQI app may use your device’s location to personalize your experience (e.g., “Nearby Offer Alerts”). If you grant permission, SQI may collect location data using GPS, Wi-Fi, IP address, or cell tower triangulation. You can disable this at any time by:

• Turning off “Nearby Offer Alerts” within the app settings
• Changing your mobile device’s location permissions via its settings

Note: Disabling location access may limit your ability to use some location-specific features of the Services.

Third-Party and Social Media Connections

If you connect your SQI account with a third-party platform (such as a retailer loyalty program or social media service), you may control what information is shared via that platform’s privacy settings. Please consult the relevant third-party service to adjust permissions or unlink your account from SQI.

Web Push Notifications

You may opt in or out of web-based push notifications through your browser’s settings. Look for the notification preferences icon—often found in the address bar or under your browser’s options or privacy tab.

For more information about your data rights, please refer to the “Your Rights,” “Cross-Border Data Transfers,” and “Children’s Privacy” sections of this Privacy Policy.

We use and upgrade certain physical, managerial, and technical safeguards that are designed to improve the integrity and security of your information. However, it is impossible to completely eliminate the chance of data breaches by hackers using illegal techniques..

Our Services are not intended for children under the age of 18, and we do not knowingly collect or process personal data from individuals in this age group without verifiable parental or guardian consent. If you are a parent or legal guardian and believe that your child under 18 has provided us with personal information without your consent, please contact us immediately at privacy@sqi-ea.africa. We will take prompt steps to investigate and, where appropriate, delete such information from our systems. In jurisdictions where the minimum data consent age is higher than 18 (e.g., under 16 as specified by local law), we will comply with the applicable legal requirements for obtaining consent before collecting personal data from minors. We encourage parents and guardians to actively monitor their children’s online activities and digital interactions to ensure their safety.

SQI may transfer, store, or process your personal data in countries outside of your country of residence, including countries that may not have the same level of data protection laws as your jurisdiction.

Where we transfer your data outside Kenya or the East African Community, we ensure that appropriate safeguards are in place to protect your personal information. These safeguards may include:

• Data transfer agreements based on standard contractual clauses approved by the Office of the Data Protection Commissioner (ODPC) or other recognized authorities
• Transfers to countries or organizations deemed to have adequate data protection standards by applicable law
• Explicit consent from you, where permitted and required

We will take all reasonable steps to ensure that your personal data is handled securely and in accordance with this Privacy Policy and applicable data protection laws.

If you would like more information about the international data transfer mechanisms we use, please contact us at privacy@sqi-ea.africa.

SQI works with a range of business Partners—including brands, retailers, and manufacturers—who may authorize their employees, contractors, or agents (collectively, “Authorized Users”) to access and use SQI’s partner-facing tools, such as the SQI dashboard, reporting platform, or business portal.

We may collect and use information from Partners and their Authorized Users for the following purposes:

• To operate, manage, and improve our partner-facing services, including hosting infrastructure, performance optimization, and platform analytics.
• To facilitate communications, including the use of third-party providers to deliver email updates, alerts, service announcements, and notifications on SQI’s behalf.
• To understand how our Services are used, including collecting insights to improve functionality, reporting accuracy, and user experience. This may include the use of artificial intelligence and machine learning tools.
• To provide technical and customer support, including resolving platform issues, assisting with onboarding, or managing integrations with other systems.
• To share relevant updates and opportunities, such as new features, partner promotions, SQI news, compliance bulletins, and marketing or business development content via email or through the platform.
• To manage our internal business operations, such as system administration, fraud detection, policy enforcement, legal compliance, and recordkeeping.
• To fulfill any other purposes with your consent, or as otherwise permitted or required by applicable data protection laws.

Authorized Users may have specific rights regarding their personal data, depending on their country of residence and applicable privacy regulations, such as the Kenya Data Protection Act (DPA 2019). These rights may include access to personal data, correction, deletion, or objection to certain types of processing.

To exercise your data rights or submit a request, please contact us at privacy@sqi-ea.africa, clearly stating your affiliation as a Partner or Authorized User and specifying the nature of your request.

As a data subject under the Kenya Data Protection Act, 2019 and other applicable regional regulations, you have the following rights regarding your personal data:

1. Right to be Informed

You have the right to be informed about the collection and use of your personal data. We strive to provide clear, accessible, and timely notices when your data is collected, processed, or shared.

2. Right of Access

You may request confirmation of whether we hold any personal data about you, and if so, obtain access to that data along with relevant information such as:

• The purpose of processing,
• The categories of data collected,
• The recipients or categories of recipients to whom the data has been or may be disclosed.

3. Right to Correction (Rectification)

If any of your personal data held by SQI is inaccurate or incomplete, you have the right to request correction or updating.

4. Right to Erasure (Right to be Forgotten)

You may request that we delete or remove your personal data where:

• It is no longer necessary for the purposes for which it was collected,
• You withdraw consent (where processing was based on consent),
• You object to the processing and there are no overriding legitimate grounds.

5. Right to Object to Processing

You have the right to object to the processing of your personal data for specific purposes, including:

• Direct marketing,
• Profiling,
• Automated decision-making that has legal or significant effects on you.

6. Right to Data Portability

You may request to receive your personal data in a structured, commonly used, and machine-readable format, and have the right to transmit it to another data controller where feasible.

7. Right to Withdraw Consent

If our processing of your data is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

8. Right to Lodge a Complaint

If you believe we have violated your data protection rights, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, or the relevant supervisory authority in your country of residence.

---

Exercising Your Rights

To exercise any of these rights, please contact us at: privacy@sqi-ea.africa

We may request proof of identity before fulfilling your request, in order to safeguard your data.

We will post and alert you to any adjustments to the Privacy Policy on this page, and the revised version will be effective as described in our Terms of Use.

Please contact us with any questions or comments about this Privacy Policy, your personal data, our use and disclosure practices, or your consent choices via the following methods:

Email

privacy@sqi.com

Mailing Address

Suqi Solutions Limited
Valley View Towers, 4th Floor, Suite 4
City Park Drive, Parklands Road
Nairobi, Kenya
Attn: Legal Department