Legal Policies Master Document

SECTION 1: PRIVACY POLICY & DATA GOVERNANCE

1.1 Statutory Compliance Framework

Orivo Pay operates in strict conformity with primary data protection legislation and cross-border digital privacy directives in the East African Community, specifically:

• Republic of Uganda: The Data Protection and Privacy Act 2019 (DPPA) and its attendant Regulations, administered by the Personal Data Protection Office (PDPO) of the National Information Technology Authority (NITA-U).
• Republic of Kenya: The Data Protection Act 2019 (DPA) and regulations overseen by the Office of the Data Protection Commissioner (ODPC).
• East African Community (EAC): The EAC Cross-Border Cyberlaws and Data Governance Framework for lawful cross-border transfer of encrypted telemetry and financial data.

1.2 Data Collection Protocols

To satisfy regional Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) statutory obligations, we collect:

• Government Identity Verification (KYC): National Identification Number (NIN / National ID card), Machine Readable Passport bio-data pages, driving permit details, and Uganda Revenue Authority (URA) / Kenya Revenue Authority (KRA) Tax Identification Numbers (TIN/PIN).
• Contact Identifiers: Registered MSISDN mobile phone numbers (SIM-verified), email address, and authentication credentials.
• Biometric Verification Data: High-resolution facial liveness geometry captures collected during onboarding to match against official state databases. (Note: Operating system biometric credentials, such as Apple Touch ID / Face ID or Android Biometrics, remain protected inside your local device Secure Enclave and are never transmitted to our servers.)
• Device Fingerprints & Telemetry: Hardware UUID/IMEI, operating system build, IP address, cellular carrier network, anti-tamper jailbreak indicators, and geofencing coordinates gathered at login to prevent fraud and enforce trade sanctions.

1.3 Third-Party Sharing & Regulatory Disclosures

Personal data is shared strictly on a confidential need-to-know basis with:

• Regulatory Bodies & Financial Intelligence Units: Mandatory compliance reporting to the Bank of Uganda (BoU), Central Bank of Kenya (CBK), Financial Intelligence Authority (FIA Uganda), Financial Reporting Centre (FRC Kenya), and accredited law enforcement upon lawful process.
• Identity Verification Partners: Direct verification pipelines with the National Identification and Registration Authority (NIRA Uganda) and the Integrated Population Registration System (IPRS Kenya).
• Sponsor Banks & Card Processors: Licensed banking partners and BIN sponsor institutions providing card issuing and settlement.
• Crypto Liquidity Providers: Regulated digital asset liquidity desks executing internal exchange order fills.

1.4 User Rights vs. Statutory AML Data Retention Mandate

To submit a privacy or data access request, contact our Data Protection Officer at: support@orivopay.com.

SECTION 2: TERMS AND CONDITIONS OF SERVICE

2.1 Scope of Service & Partner Model

Orivo Pay provides an integrated financial operating system allowing users to manage mobile wallets, initiate peer-to-peer transfers, issue payment cards, and settle utility bills. Services are delivered in collaboration with Central Bank-regulated financial institutions, Payment System Providers (PSPs), and licensed national payment switches.

2.2 Orivo ID & Zero-Fee Peer-to-Peer (P2P) Transfers

• $0.00 Fee Guarantee: All internal transfers between registered Orivo Pay users utilizing their unique Orivo ID or linked phone number are provided at $0.00 fee (100% Free).
• Anti-Fraud Velocity Limits: Zero-fee transfers apply strictly between verified personal accounts for legitimate consumer and merchant use. To prevent money laundering and structured fraud, transfers are subject to dynamic velocity triggers, daily limits, and real-time AML scoring.
• Finality of Execution: Because Orivo Pay transfers clear instantly, confirmed transfers authorized with your PIN or biometric token are irrevocable. Users must verify the recipient's Orivo ID prior to confirming transfer requests.

2.3 Account Eligibility & KYC Verification

• You must be at least eighteen (18) years of age and legally capable of entering into binding contracts.
• Accounts require successful completion of Tier-1 identity verification. Unverified accounts cannot initiate withdrawals or card issuances.
• Unilateral Suspension Rights: Orivo Pay reserves the express right to pause, freeze, or terminate accounts immediately without prior court order if we detect fraudulent activity, money laundering, cyber exploitation, chargeback fraud, or non-compliance with applicable law.

2.4 Intellectual Property & Acceptable Use Policy

All software, algorithms, trademarks, visual marks, and UI assets are the sole property of Orivo Pay Inc. Users are strictly prohibited from reverse-engineering the app, decompiling code, deploying automated scraping bots, circumventing geographical IP fences, or reselling services without explicit written authorization.

SECTION 3: VIRTUAL & PHYSICAL CARD TERMS OF SERVICE

3.1 Billing & Fee Structure

• Virtual Card Monthly Subscription: The cardholder explicitly consents to an automated recurring fee of $1.00 USD per month (or local currency equivalent) charged directly to their primary Orivo wallet on the monthly anniversary of card generation. If the wallet balance is insufficient, the virtual card will be instantly paused until the account is funded and the subscription is cleared.
• Physical Card Issuance Fee: A non-refundable $3.00 USD fee is debited upon submission of a physical card order to cover secure manufacturing, chip personalization, and courier dispatch.
• Card Interchange & Network Fees: Cross-border and international merchant transactions may incur standard card network interchange and currency conversion margins transparently displayed at checkout.

3.2 Card Issuance & Network Regulations

Orivo Pay cards are issued by Central Bank-licensed partner banks under official licenses from Visa Inc. and Mastercard International. Cardholders agree to adhere to all international card association rules, merchant category restrictions, and anti-fraud guidelines.

3.3 Cardholder Security & Immediate Freeze Mandate

SECTION 4: CRYPTO INVESTMENTS & UTILITY BILLS DISCLAIMER

4.1 Digital Asset & Cryptocurrency Risk Warning

4.2 Transparent Exchange Spreads & Network Fees

• Trading Margin Spread: Orivo Pay embeds a competitive margin of 1.0% – 2.0% directly within the quoted buy/sell order rates for digital asset conversions.
• Network & Gas Fees: External blockchain withdrawals incur variable gas/miner fees dictated by the destination network (e.g., Bitcoin, Ethereum, Tron, Solana), alongside a minor processing markup displayed prior to order confirmation.

4.3 Utility & Bill Payment Settlements

• Third-Party Aggregator Dependencies: Settlements for electricity (Yaka/KPLC), water, airtime top-ups, and Pay TV rely on public utility and telecommunications APIs.
• Service Provider Outages: Orivo Pay is not liable for utility provider downtime, server delays, or delayed token delivery caused by external utility outages.
• User Input Errors: Orivo Pay carries no financial liability for payments sent to incorrect meter numbers, wrong customer reference IDs, or mistyped phone numbers entered by the user. Once settled with the utility provider, transactions cannot be reversed.

SECTION 5: COOKIE & TRACKING TECHNOLOGIES POLICY

Orivo Pay utilizes strictly necessary cookies, performance telemetry, and functional storage mechanisms across our web platforms and native mobile applications. This policy outlines how cookies are utilized, their retention periods, and how you may govern your preferences at any time.

5.1 Categories of Stored Telemetry

• Strictly Necessary Cookies: Critical for cryptographic token validation, CSRF attack prevention, secure session persistence across subdomains, and load-balancer route preservation. Under EAC data protection statutes, these do not require prior consent as the service cannot function without them.
• Functional & Preference Cookies: Preserve client-side application states including language localization (English, Swahili, French, Arabic), color scheme preference (Dark OLED or Light Canvas), and currency filter defaults.
• Analytics & Network Telemetry: Anonymized diagnostic signals evaluating API response latencies, simulated exchange corridor execution rates, and crash diagnostics to reinforce infrastructure resilience.
• Marketing & Investor Experience: Confidential attribution tracking quantifying institutional inquiries and venture partner referrals. No personal payment data is ever shared with advertising brokers.

5.2 Managing Your Preferences

You may modify or revoke your cookie consent at any time directly through our interactive consent manager by clicking the Cookie Preferences link in the footer or the persistent privacy icon.

SECTION 6: LEGAL COUNSEL & REGISTERED OFFICES

For inquiries regarding regulatory compliance, law enforcement requests, privacy rights, or partner banking integrations, contact:

• Support & Customer Inquiries: support@orivopay.com
• Legal & Regulatory Affairs Desk: compliance@orivopay.com
• Telephone Escalations: +256 741 512 021
• Registered Physical Address:
  Orivo Pay Ltd, Kampala - Nairobi Financial Corridor, East Africa