Privacy Policy

1. Who we are

NOOA Pay is a bill payment app and website operated by NOOA Energies Ltd ("NOOA Energies", "we", "us" or "our"), based at Seal Estates, Uganda. NOOA Pay lets you pay for electricity, water, TV subscriptions, airtime, data and voice bundles, school fees, and government services such as URA, KCCA and NSSF, using MTN Mobile Money or Airtel Money.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have. It applies to the NOOA Pay mobile app, the website at nooapay.com, and any related support channels. We handle personal data in line with the Data Protection and Privacy Act, 2019 of Uganda and its regulations.

By creating an account or using NOOA Pay, you confirm that you have read this policy.

2. Information we collect

Information you give us:

• Account details: your name, phone number, email address and password (stored in protected form, never in plain text).
• Payment sources: the MTN or Airtel mobile money numbers you save to pay from.
• Bill details: the meter numbers, smartcard or decoder numbers, water account numbers, school payment codes, tax references and phone numbers you enter when paying a bill, including any templates you save for repeat payments.
• Agent application details: if you apply to become a NOOA Pay Agent, the information you submit in your application and any verification details we request.
• Messages to us: anything you send through the contact form, email, phone or WhatsApp, including the transaction references you share when you ask for help.
• Referral information: your personal referral code and the referral codes you enter.

Information created when you use the service:

• Transaction records: the biller, the account you paid, the bill amount, service fee, total, status, reference numbers, date and time, and any token or confirmation returned by the biller.
• Customer name returned by the biller when we validate your meter, account or smartcard, so you can confirm you are paying the right person or account.
• Agent activity: transactions processed, commissions, bonuses and earnings shown in your agent dashboard.

Information collected automatically:

• Device and technical information: device model, operating system version, app version, language, IP address, and a unique device or push notification identifier.
• Device integrity signals: results of checks that confirm the app is running on a trusted, unmodified device before a payment is allowed.
• Usage and diagnostic data: screens visited, errors and crash reports, which help us keep the app working and secure.

What we never collect: your mobile money PIN. You enter your PIN only on the prompt shown by MTN or Airtel on your phone. NOOA Pay does not see, receive or store it.

3. How we use your information

We use your personal data to:

• Create and manage your account and verify who you are.
• Validate your meter, account or smartcard with the biller, and process the payments you ask us to make.
• Deliver tokens, receipts, confirmations, push notifications and SMS or email messages about your transactions.
• Keep your transaction history, saved payment sources and saved templates.
• Provide customer support and investigate failed, delayed or disputed payments.
• Detect, prevent and investigate fraud, abuse, money laundering and other unlawful activity, and keep the service secure.
• Run the agent programme and the referral programme, including calculating and paying commissions and rewards.
• Meet our legal, tax, accounting and regulatory obligations.
• Improve the app and website, fix bugs and understand how features are used.
• Tell you about important changes to NOOA Pay, our terms or this policy. We will only send you marketing messages if you have agreed to receive them, and you can opt out at any time.

4. Our legal grounds for using your data

We rely on one or more of the following grounds, depending on what we are doing:

• Your consent, for example when you allow push notifications or agree to receive marketing.
• Performance of a contract, because we need your data to carry out the payments and services you request.
• Compliance with a legal obligation, for example financial record keeping and responding to lawful requests from authorities.
• Our legitimate interests, such as securing the service, preventing fraud and improving NOOA Pay, where these are not outweighed by your rights.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that took place before you withdrew it.

5. Who we share your information with

We do not sell your personal data. We share it only as needed to run the service, and only with:

• Mobile money providers (MTN Mobile Money and Airtel Money), so that the payment prompt can be sent to your phone and the payment can be completed.
• Biller network and aggregators, including Interswitch, which routes payments to billers across the network.
• Billers and service providers you choose to pay, such as UEDCL, WENRECo, NWSC, DStv, GOtv, StarTimes, AzamTV, MTN, Airtel, Lycamobile, Roke Telkom, SchoolPay, SurePay, PegPay, URA, KCCA and NSSF, so that your payment is credited to the right account.
• Service providers who work for us under contract, such as cloud hosting, SMS, email, push notification, analytics and crash reporting providers. They may only use your data to provide services to us.
• Authorities and regulators, courts, and law enforcement where we are required by law or where it is necessary to protect our rights, our users or the public.
• A successor business, if NOOA Energies is involved in a merger, acquisition or sale of assets. We will tell you if this affects your data.

Your name and basic details may also be visible to a NOOA Pay Agent when they process a payment on your behalf.

6. Agents and referrals

If you use the services of a NOOA Pay Agent, the agent will see the details needed to complete your payment, such as the biller, account number and amount. Agents are required to use this information only to process your transaction.

If you share your referral code, we may tell you that a person joined using your code and that you earned a reward, without disclosing more than is needed. If you join using someone else's code, that person may be told that you joined.

7. Security

We use technical and organisational measures to protect your data, including encrypted connections, protected password storage, device integrity checks, validation of accounts with billers before payment, and access controls that limit who at NOOA Energies can see personal data.

No system is completely secure. Please protect your account by using a strong, unique password, keeping your phone locked, and never sharing your password or mobile money PIN with anyone, including people who claim to represent NOOA Pay. We will never ask you for your PIN.

If we become aware of a breach that affects your personal data and is likely to cause you harm, we will notify you and the relevant authority as required by law.

8. How long we keep your data

We keep your personal data for as long as your account is active and as long as we need it for the purposes in this policy. After you close your account, we keep certain records, such as transaction history, for the period required to meet financial, tax, accounting and regulatory record keeping obligations, to resolve disputes, and to prevent fraud. When we no longer need data, we delete it or anonymise it.

9. Your rights

Under the Data Protection and Privacy Act, 2019, you have the right to:

• Be informed about how your personal data is used.
• Access the personal data we hold about you.
• Ask us to correct data that is wrong or incomplete.
• Ask us to delete data we no longer have a lawful reason to keep.
• Object to or ask us to restrict certain uses of your data, including direct marketing.
• Withdraw your consent at any time where we rely on it.
• Complain to the Personal Data Protection Office (PDPO) at the National Information Technology Authority, Uganda (NITA-U) if you believe your data has been handled unlawfully.

To use any of these rights, or to ask us to delete your account, email support@nooapay.com from the email address on your account. We may need to confirm your identity first, and we will respond within a reasonable time. Some data must be kept by law, and we will tell you if that applies to your request.

10. App permissions and notifications

The app may ask for permission to send push notifications, which we use for payment status updates, tokens and receipts. You can turn these off in your phone settings at any time, although you may then miss time-sensitive updates about your payments.

11. Children

NOOA Pay is not intended for people under 18. We do not knowingly collect personal data from children. If you pay school fees, you may enter a student's payment code or name as the school requires. If you believe a child has created an account, contact us and we will delete it.

12. Transfers outside Uganda

Some of our service providers, such as cloud hosting, messaging and analytics providers, may process data on servers outside Uganda. Where this happens, we take steps to make sure your data receives a level of protection that meets the requirements of Ugandan law.

13. Links to other websites

Our website links to third-party sites, such as the Google Play Store and social media pages. We are not responsible for their privacy practices, and we encourage you to read their policies.

14. Changes to this policy

We may update this policy from time to time. When we make important changes, we will post the new version on this page with a new "Last updated" date, and notify you in the app or by email where appropriate. Continuing to use NOOA Pay after a change means you accept the updated policy.

15. Contact us

If you have questions about this policy or how your data is handled, contact us:

• Email: support@nooapay.com
• Phone: +256 200 909 475
• WhatsApp: +256 766 180 571
• Address: NOOA Energies Ltd, Seal Estates, Uganda
• Support hours: 24/7