Lipaiddox Data Privacy Policy

Effective Date: August 14, 2026 · Version 2.0

INTRODUCTION

This Data Privacy Policy ("Policy") outlines how Haminass Group Limited ("we," "us," "our") processes personal data collected through Lipaiddox and related products. This Policy informs you, the user, of the data collection methods, types of data collected, and the purposes of such processing. Additional tools and privacy settings are accessible via the Lipaiddox app settings for data control and management.

Our Commitment: At Lipaiddox, we believe that creators and consumers in Africa and emerging markets deserve a platform that respects their privacy while providing powerful monetization tools. We are committed to transparency, security, and putting you in control of your data.

This Policy applies to:

All Lipaiddox users (creators and consumers)
Visitors to the Lipaiddox website
Users of Lipaiddox mobile applications (Android, iOS) and desktop applications
Anyone interacting with Lipaiddox features and services

5. DATA COLLECTION SUMMARY (TRANSPARENCY TABLE)

For transparency, we provide the following summary of the data we collect, organized by source and purpose:

Data Category	Specific Data	Source	Purpose	Legal Basis
Identity	Name, username, email, phone	User	Account creation, communication	Contract
Profile	Bio, photo, preferences	User	Personalization, discovery	Contract/Consent
Content	Posts, photos, videos, messages	User	Service provision	Contract
Sensitive	Religious/political views (optional)	User	Profile completion	Consent
Transactions	Payment details, purchase history	User/Processors	Processing payments	Contract/Legal
Usage	Page views, interactions, time spent	Automatic	Service improvement	Legitimate Interest
Device	OS, model, identifiers	Automatic	Cross-platform experience	Legitimate Interest
Location	IP address, GPS (optional)	Automatic/User	Localization, security	Legitimate Interest/Consent
Cookies	Cookie IDs, tracking data	Automatic	Analytics, advertising	Consent
Social	Follows, likes, shares	Automatic	Recommendations	Legitimate Interest
Live Stream	Stream data, credit usage	Automatic	Live service provision	Contract

7. INTERNATIONAL DATA TRANSFERS

As a global platform, we transfer, store, and process your personal data across borders. This is necessary to provide our Service and ensure seamless experiences across different regions.

1. Where We Transfer Data Your data may be transferred to and processed in:

Tanzania (where our headquarters and other office are located)
Cloud infrastructure providers in various regions
Payment processors and other service providers

2. Legal Basis for Transfers When we transfer data internationally, we rely on:

Adequacy Decisions: Where the receiving country has been deemed adequate by the relevant authority
Standard Contractual Clauses (SCCs): EU-approved contractual terms that ensure appropriate safeguards
Derogations: Where necessary for the performance of a contract, with your consent, or for legal claims

3. Your Rights You have the right to request a copy of the safeguards we use for international transfers by contacting us at privacy@lipaiddox.com.

8. DATA SECURITY MEASURES

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

1. Encryption

All data transmitted between your device and our servers is encrypted using TLS 1.3
Data at rest is encrypted using AES-256 encryption
Payment information is encrypted and tokenized

2. Access Controls

Role-based access control (RBAC) limits employee access to personal data
Multi-factor authentication (MFA) required for administrative access
Regular access reviews and revocation procedures

3. Monitoring and Auditing

Continuous security monitoring and intrusion detection
Regular security audits and vulnerability assessments
Append-only audit logs for all data access

4. Data Minimization and Pseudonymization

We collect only the data necessary for the purposes described
Personal data is pseudonymized where possible for analytics

5. Employee Training

All employees receive regular data protection and security training
Confidentiality obligations are contractually binding

6. Incident Response

We maintain an incident response plan for data breaches
Regular testing of our response procedures

7. Third-Party Security

All third-party processors are required to maintain equivalent security measures
Regular security assessments of third-party vendors

9. DATA RETENTION SCHEDULE

We retain your personal data for only as long as necessary for the purposes described in this Policy. The following retention periods apply:

Data Category	Retention Period	Reason
Account Information	Until account deletion + 30 days	To provide Service and respond to requests
Content You Post	Until you delete or account deletion	To provide Service
Transaction Records	Up to 7 years	Legal and regulatory compliance
Payment Information	Up to 7 years	Financial regulations
Identity Verification	90 days after submission	Security and fraud prevention
Search Logs	6 months	Service improvement
Device Information	24 months	Personalization and analytics
Cookies	Varies (see Cookie Policy)	Functionality and analytics
Marketing Data	Until consent withdrawn	Marketing communications
Logs for Security	Up to 12 months	Security incident investigation

Data may be retained for longer periods where:

Required by law or regulation
Necessary for legal claims or proceedings
Reasonably suspected of Terms of Service violations
Subject to ongoing law enforcement investigations

10. YOUR DATA PROTECTION RIGHTS.

Under applicable data protection laws, including the GDPR, Kenya Data Protection Act 2019, Nigeria Data Protection Act 2023, and South Africa POPIA, you have the following rights:

1. Right to Access (Article 15 GDPR) You have the right to obtain confirmation from us as to whether or not we process your personal data, and, where that is the case, access to the personal data and certain related information.

2. Right to Rectification (Article 16 GDPR) You have the right to obtain from us the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed.

3. Right to Erasure ("Right to be Forgotten") (Article 17 GDPR) You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the specified grounds applies, including where the data is no longer necessary, you withdraw consent, or you object to processing.

4. Right to Restriction of Processing (Article 18 GDPR) You have the right to obtain from us the restriction of processing where you contest the accuracy of the data, the processing is unlawful but you oppose erasure, or we no longer need the data but you require it for legal claims.

5. Right to Data Portability (Article 20 GDPR) You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and have the right to transmit that data to another controller.

6. Right to Object (Article 21 GDPR) You have the right to object, on grounds relating to your particular situation, to processing of personal data based on legitimate interests or for direct marketing purposes.

7. Right to Withdraw Consent (Article 7(3) GDPR) Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

8. Right to Lodge a Complaint You have the right to lodge a complaint with a supervisory authority, including the Tanzania Data Protection Commissioner, the Kenya Office of the Data Protection Commissioner, the Nigeria Data Protection Commission, or the South Africa Information Regulator.

How to Exercise Your Rights You may exercise your rights by:

Visiting Settings → Privacy → Data Rights in the Lipaiddox app
Emailing us at privacy@lipaiddox.com
Writing to us at our physical address

We will respond to your request within 30 days as required by law. We may extend this period by up to 60 days for complex requests, in which case we will inform you of the extension within 30 days.

11. AUTOMATED DECISION-MAKING AND PROFILING

We use automated processing and profiling to provide personalized experiences on Lipaiddox. This includes:

1. Content Recommendation Algorithms We use automated systems to analyze your interactions, preferences, and behavior to recommend content, creators, and products that may interest you. These recommendations are based on factors such as:

Content you have viewed, liked, or shared
Creators you follow or subscribe to
Your engagement patterns and time spent on content
Your location and language preferences

2. Advertising Personalization We use automated systems to select and display advertisements that are relevant to your interests based on your activity on and off Lipaiddox.

3. Fraud Detection and Security We use automated systems to detect and prevent fraudulent activity, spam, and security threats. This includes analyzing patterns of behavior to identify suspicious accounts.

Your Rights Regarding Automated Decisions You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

If we make automated decisions that have legal or significant effects, you have the right to:

Obtain human intervention
Express your point of view
Contest the decision

You can opt out of personalized recommendations and advertising by adjusting your settings in Settings → Privacy → Personalization.

12. DATA PROTECTION IMPACT ASSESSMENTS

Where processing is likely to result in a high risk to your rights and freedoms, we conduct Data Protection Impact Assessments in accordance with applicable law.

1. When We Conduct DPIAs We conduct DPIAs for:

New processing activities that involve high-risk data
Significant changes to existing processing
Processing involving sensitive personal data
Processing using new technologies
Processing that involves systematic monitoring or profiling

2. DPIA Process Our DPIA process includes:

Description of the processing and its purposes
Assessment of necessity and proportionality
Identification and assessment of risks
Identification of measures to address risks

3. Consultation Where required, we consult with supervisory authorities before commencing high-risk processing.

13. DATA BREACH NOTIFICATION

We take data security seriously and have procedures in place to detect, report, and investigate personal data breaches.

1. Detection and Assessment Upon becoming aware of a breach, we will:

Immediately investigate the scope and impact
Assess the risk to affected individuals
Take steps to contain and remediate the breach

2. Notification to Regulatory Authorities Where required by law, we will notify the relevant supervisory authority:

GDPR: Within 72 hours of becoming aware of the breach
Kenya DPA: Without undue delay
Nigeria NDPA: Within 72 hours
South Africa POPIA: As soon as reasonably possible

3. Notification to Affected Individuals Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, providing:

Description of the nature of the breach
Contact details of our Data Protection Officer
Likely consequences of the breach
Measures taken or proposed to address the breach

4. Record Keeping We maintain a register of all personal data breaches, including the facts surrounding the breach, its effects, and the remedial action taken.

14. CHILDREN'S PRIVACY

1. Age Restrictions Lipaiddox is not intended for children under 16 years of age (or the minimum legal age in your country). We do not knowingly collect personal data from children.

2. Verification If we become aware that a child under 16 has provided us with personal data, we will:

Delete the information from our records
Take steps to prevent further collection

3. Parental Rights If you are a parent or guardian and believe your child under 16 has provided personal data to us, please contact us at privacy@lipaiddox.com to request deletion.

4. COPPA Compliance For users in the United States, we comply with the Children's Online Privacy Protection Act (COPPA).

15. THIRD-PARTY DATA PROCESSORS AND SUB-PROCESSORS

We engage third-party processors to help us provide the Service. These processors act on our behalf and are contractually required to protect your data.

1. Categories of Processors

Category	Purpose	Examples
Cloud Infrastructure	Hosting and data storage	AWS, Google Cloud, Azure
Payment Processors	Transaction processing	M-Pesa, Stripe, PayPal, Flutterwave
Analytics Providers	Usage analysis and insights	Google Analytics, Mixpanel
Customer Support	Help desk and support services	Zendesk, Intercom
Email Services	Communication and notifications	SendGrid, Mailchimp
Identity Verification	KYC and fraud prevention	Onfido, Jumio
Live Streaming	WebRTC and streaming infrastructure	Firebase, Twilio

2. Processor Requirements We require all processors to:

Process data only on our documented instructions
Implement appropriate security measures
Ensure confidentiality of personal data
Assist with data subject rights requests
Notify us promptly of any security incidents

3. List of Sub-Processors A current list of our sub-processors is available at [Your Website URL]/subprocessors.

16. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to enhance your experience on Lipaiddox.

1. Types of Cookies We Use

Type	Purpose	Duration
Strictly Necessary	Essential for basic functionality	Session to persistent
Performance/Analytics	Understand how you use the Service	Persistent
Functionality	Remember your preferences	Persistent
Targeting/Advertising	Deliver relevant ads	Persistent

2. Your Choices You can:

Accept all cookies
Reject non-essential cookies
Delete cookies already stored
Set your browser to refuse cookies

Adjust your cookie preferences in Settings → Privacy → Cookie Preferences.

17. SPECIFIC PROVISIONS FOR AFRICAN MARKETS

1. Kenya (Data Protection Act, 2019) For users in Kenya, we comply with the Data Protection Act, 2019. This means:

We process data lawfully, fairly, and transparently
We collect data for explicit, specified, and legitimate purposes
You have the right to access, correct, and delete your data
We conduct Data Protection Impact Assessments where required
We register with the Office of the Data Protection Commissioner (ODPC) as required

2. Nigeria (Nigeria Data Protection Act, 2023) For users in Nigeria, we comply with the Nigeria Data Protection Act, 2023. This means:

We have a lawful basis for every processing activity
We conduct Data Protection Impact Assessments where required
We file annual Data Protection Audits

3. South Africa (Protection of Personal Information Act - POPIA) For users in South Africa, we comply with POPIA. This means:

We have appointed an Information Officer
We notify you of the purpose of collection
You have the right to access and correct your data

18. DATA PROTECTION OFFICER

We have appointed a Data Protection Officer to oversee our data protection compliance. You may contact our DPO at:

DPO Name: Hamid Ali Email: dpo@lipaiddox.com Address: Haminass Group Limited, Mwanakwekwe - Kificho Building, Ground Floor, Zanzibar, Tanzania.

Our DPO is responsible for monitoring our compliance with data protection laws, providing advice on data protection impact assessments, and acting as the point of contact for data subjects and supervisory authorities.

19. POLICY UPDATES

We will notify you of any Policy changes and provide an opportunity to review them before continuing to use Lipaiddox Products. Material changes will be communicated via:

Email notification (if you have provided your email address)
In-app notification
Posting on the Lipaiddox website

The updated Policy will include a new effective date.

20. CONTACT US

Privacy Inquiries: Email: privacy@lipaiddox.com
Data Protection Officer: Email: dpo@lipaiddox.com
Physical Address: Haminass Media and Entertainment Limited Mwanakwekwe - Kificho Building, Ground Floor Zanzibar, Tanzania

Complaints: If you have unresolved concerns, you may file a complaint with:

The Tanzania Data Protection Commissioner
Your local data protection authority

21. GLOSSARY OF TERMS

Term	Definition
Personal Data	Any information relating to an identified or identifiable natural person
Processing	Any operation performed on personal data
Data Controller	The entity that determines the purposes and means of processing
Data Processor	The entity that processes personal data on behalf of the controller
DPIA	Data Protection Impact Assessment
GDPR	General Data Protection Regulation (EU)
POPIA	Protection of Personal Information Act (South Africa)
NDPA	Nigeria Data Protection Act
DPA	Data Protection Act (Kenya)
SCCs	Standard Contractual Clauses