SimPlus Privacy Policy

1. Introduction

SimPlus is committed to processing users' personal data responsibly, transparently and securely, in accordance with the applicable laws and regulations of the Republic of Mozambique.

This Privacy Policy applies to the use of the SimPlus platform, including the mobile application, web application and other channels made available by SimPlus.

By using SimPlus services, the user acknowledges that they have read and understood this Privacy Policy and the ways in which their personal data may be processed.

2. Who We Are

SimPlus is a technology-enabled payment platform that allows users, among other features, to make and receive payments, transfers, account top-ups and service payments through different payment methods and financial or payment institutions integrated with the platform.

For the purposes of this Privacy Policy, the entity responsible for processing personal data is:

• Entity: SIMPLUS, S.A
• Brand: SimPlus
• Registered Address: B.Sommerchild, Rua Frente de Libertação de Moçambique, Nº 324, Maputo
• Email: suporte@simplus.co.mz
• Telephone: +258823575547

3. Personal Data We Collect

Depending on how the user interacts with SimPlus services, we may collect different categories of personal data.

3.1. Identification Data

• Full name;
• Date of birth;
• Nationality;
• Identification document number and type;
• Identification document expiry date;
• Image of the identification document;
• User photograph, where required for identification or verification;
• Telephone number;
• Email address;
• Residential address or other information required for identification.

3.2. Financial and Transaction Data

• Accounts or wallets linked to the user;
• Information required to make payments and transfers;
• Transaction history;
• Transaction amounts and currencies;
• Beneficiaries and recipients;
• Payment references;
• Information relating to payment instruments;
• Information required for fraud prevention and detection.

3.3. Authentication and Security Data

• OTP codes;
• Login identifiers;
• Authentication-related information;
• Session information;
• Activity logs;
• Information required to detect suspicious activities.

3.4. Technical and Device Data

• IP address;
• Device type and model;
• Operating system;
• Application version;
• Technical device identifiers;
• Network information;
• Access logs;
• Date and time of operations;
• Information related to application errors and performance.

4. How We Use Personal Data

Personal data collected may be used for the following purposes:

• Creating and managing user accounts;
• Verifying user identity;
• Executing payments, transfers and other requested operations;
• Processing account top-ups and service payments;
• Sending transaction-related notifications;
• Authenticating users and protecting their accounts;
• Detecting, preventing and investigating fraud;
• Complying with legal and regulatory obligations;
• Conducting Know Your Customer (KYC) procedures;
• Preventing and combating money laundering and terrorist financing;
• Monitoring transactions for security and risk management purposes;
• Providing customer support and handling complaints;
• Improving the security, functionality and performance of the platform;
• Developing and improving our products and services;
• Producing statistics and reports;
• Complying with requests from competent authorities;
• Sending promotional communications where permitted and applicable.

5. Legal Basis for Processing

Depending on the purpose, personal data may be processed on the following legal grounds:

• Performance of a contract or provision of services requested by the user;
• Compliance with legal and regulatory obligations;
• User consent, where required;
• SimPlus' legitimate interests;
• Protection of the vital interests of the user or third parties, where applicable;
• Prevention, detection and investigation of fraud and other unlawful activities.

6. Sharing Data with Third Parties

SimPlus may share personal data with third parties only when necessary for the provision of services, compliance with legal or regulatory obligations, fraud prevention or other legitimate purposes.

6.1. Financial Institutions and Payment Service Providers

Where necessary to process a transaction requested by the user, information may be shared with banks, electronic money institutions, payment service providers, payment system operators or other entities involved in executing the transaction.

6.2. Technology Service Providers

SimPlus may use specialised service providers for technology infrastructure, hosting, security, communications, authentication, monitoring, fraud prevention and technical support.

6.3. Competent Authorities

SimPlus may provide information to competent authorities where required or permitted by applicable law, regulation or a legally valid order.

6.4. Fraud Prevention and Money Laundering

Data may be processed and shared, where legally required or permitted, for the purposes of preventing and combating fraud, money laundering, terrorist financing and other unlawful activities.

7. Data Transfers

Where personal data is processed or stored outside Mozambique, SimPlus will implement measures designed to ensure that such processing takes place in accordance with applicable legal and security requirements.

8. Data Security

SimPlus implements technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, unauthorised disclosure, destruction or fraudulent use.

Security measures may include:

• Encryption;
• Access controls;
• Authentication mechanisms;
• OTP and additional security mechanisms;
• Monitoring of suspicious activities;
• Audit logs;
• Privilege segregation;
• Backups;
• Periodic security testing and assessments.

Despite the measures implemented, no electronic system can be considered completely secure. Therefore, SimPlus cannot guarantee absolute security against all risks existing in the digital environment.

9. Data Retention

SimPlus will retain personal data for as long as necessary to fulfil the purposes for which it was collected.

Certain information may be retained for longer periods where necessary to:

• Comply with legal or regulatory obligations;
• Meet accounting, tax or financial requirements;
• Prevent and investigate fraud;
• Fulfil KYC/AML obligations;
• Resolve complaints or disputes;
• Establish, exercise or defend legal rights;
• Comply with requirements from competent authorities.

Once the applicable retention period expires, personal data will be deleted, anonymised or retained only where there is a lawful basis for doing so.

10. Data Subject Rights

Subject to applicable law, users may exercise rights relating to their personal data, including:

• The right to access their personal data;
• The right to request correction of inaccurate or incomplete data;
• The right to request deletion of data where legally permitted;
• The right to request restriction of certain processing activities;
• The right to object to certain processing activities;
• The right to withdraw consent, where applicable;
• The right to lodge a complaint with the competent authority.

Some requests may be subject to limitations arising from legal and regulatory obligations applicable to SimPlus.

11. Communications

SimPlus may send users communications relating to:

• Transactions;
• Security;
• Authentication;
• Account changes;
• Service maintenance;
• Changes to terms and policies;
• Important alerts.

These communications may be necessary for the provision of the services and may therefore continue even where the user has opted out of promotional communications.

12. Cookies and Similar Technologies

The SimPlus website and other digital channels may use cookies and similar technologies for the following purposes:

• Ensuring proper operation of the services;
• Maintaining user sessions;
• Enhancing security;
• Analysing performance;
• Improving user experience.

13. Third-Party Data

Users should not provide SimPlus with personal data relating to another person unless they have the necessary authorisation or lawful basis to do so.

Where a feature allows a user to request or initiate a payment involving another person, the user is responsible for ensuring that they have an appropriate lawful basis for providing that person's information.

14. User Responsibilities

Users are responsible for maintaining the confidentiality of their login credentials, OTP codes and other authentication mechanisms.

Users should immediately notify SimPlus of any suspected:

• Unauthorised access;
• Loss or theft of a device;
• Misuse of an account;
• Unrecognised transaction;
• Compromise of credentials.

SimPlus will never ask users to disclose their passwords, OTP codes or other confidential authentication information through unauthorised channels.

15. Children's Privacy

SimPlus services are not intended for individuals who do not have the legal capacity to use the financial services made available through the platform.

Where the use of specific services by minors is permitted by applicable law, the relevant protection and consent requirements will apply.

16. Changes to this Privacy Policy

SimPlus may periodically update this Privacy Policy to reflect changes in legal, regulatory, technological or operational requirements.

Where changes are material, users will be informed through appropriate communication channels.

The most recent version of this Privacy Policy will always be available through SimPlus' official channels.

17. Contact Us

For questions regarding privacy, data protection or the exercise of rights under this Privacy Policy, users may contact SimPlus through the following channels:

Telephone: +258021315420/3

Email: suporte@simplus.co.mz

18. Acceptance

By using SimPlus, the user acknowledges that they have read and understood this Privacy Policy.

This Privacy Policy should be read together with the SimPlus Terms and Conditions, as well as any other policies and documents applicable to the services provided through the platform.