Privacy Policy

1. Who we are and when this policy applies

Wimo (“Wimo”, “we”, “us” or “our”) provides payment technology and related services for clients, merchants and approved partners. This Privacy Policy applies when you visit our website, create or use a Wimo account, use a Wimo application, terminal, card, wallet, payment link, QR, cash service or API, contact us, or otherwise interact with a service that refers to this policy.

Depending on the service, Wimo may determine why and how personal information is used, or may process it on behalf of a merchant, institution or other partner. That organisation’s privacy notice may also apply.

2. Personal information we collect

Information you provide

• Identity and profile information, such as name, date of birth, nationality, identity or passport details, photograph and signature.
• Contact information, such as physical address, email address and telephone number.
• Business information, including registration, ownership, director, tax, operating address and supporting documents.
• Financial and payment information, including wallet, account, settlement, card-reference, beneficiary, transaction and source-of-funds information. Payment processors may handle certain full card credentials directly.
• Verification material, including identity documents, selfies, video or liveness captures and verification results.
• Communications, support requests, complaints, survey answers and feedback.

Information collected when you use Wimo

• Transaction details, such as amount, currency, merchant, recipient, channel, time, status and reference.
• Device, browser, IP address, login, diagnostic, security and usage information.
• Approximate or precise location when needed for a feature and permitted by your device, such as finding a nearby Cash Kiosk.
• Cookies and similar technologies used by our website or service providers.

Information from others

We may receive information from merchants, recipients, banks, card networks, mobile-money operators, payment processors, identity and fraud-prevention providers, public registers, authorities, business partners or people who transact with you.

3. How we use personal information

We use personal information to:

• create, administer, authenticate and secure accounts;
• provide, route, authorise, record, reconcile, settle, reverse and support transactions;
• verify identity or business information and perform KYC, KYB, sanctions, anti-money-laundering and fraud checks;
• operate cards, wallets, QR, payment links, terminals, cash services and related features;
• detect, investigate and prevent fraud, abuse, cyber incidents and prohibited activity;
• comply with law, lawful requests, record-keeping, reporting and regulatory duties;
• respond to enquiries, disputes and complaints;
• maintain, troubleshoot, analyse and improve the Services;
• send service, security and account communications; and
• send marketing where permitted, with an option to unsubscribe.

4. Legal grounds for processing

Depending on the information, service and country, we process personal information because it is necessary to perform a contract with you, comply with a legal obligation, pursue a legitimate interest that is not overridden by your rights, protect vital interests, perform a task allowed by law, or because you have consented.

Our legitimate interests may include providing and securing payment services, preventing fraud, improving products, protecting users and enforcing agreements. Where we rely on consent, you may withdraw it, although that does not affect earlier lawful processing. Some information is required to provide a service or comply with law; if it is not supplied, we may be unable to open an account or process a transaction.

5. Identity verification, facial images and automated tools

For identity verification, we may process an identity-document image, portrait, selfie, short video, liveness signals and a comparison or confidence result. These may constitute biometric or special personal information under applicable law.

Automated tools may assist with document quality, authenticity indicators, liveness, fraud signals or face comparison. A failed or inconclusive automated check may be referred to a trained reviewer or specialist provider where appropriate. We do not use an automated pre-check as the sole basis for an adverse decision where applicable law requires meaningful human review.

We restrict this information to identity, security, fraud-prevention and legal-compliance purposes, and retain it only for the period justified by those purposes and applicable record-keeping rules. You may contact us to ask about a verification decision or available review process.

6. When we share information

We may share personal information only as reasonably necessary with:

• the merchant, recipient, sender or other party involved in a transaction;
• banks, payment processors, card networks, mobile-money operators and settlement providers;
• identity, KYC, sanctions, fraud, security and liveness providers;
• hosting, cloud, communications, analytics, customer-support and professional service providers under appropriate duties;
• authorities, courts, regulators, law-enforcement or other persons where lawfully required or needed to protect rights and safety;
• a prospective buyer, investor or successor in connection with a financing, reorganisation, sale or transfer, subject to appropriate safeguards; and
• another party at your direction or with your consent.

We do not sell personal information for money. We require service providers to use information only for agreed purposes and to protect it appropriately.

7. International transfers

Wimo operates across countries and may use providers located outside the country where information was collected. When personal information is transferred internationally, we use measures required by applicable law, which may include an adequacy finding, contractual safeguards, consent where appropriate, or a transfer necessary to provide the requested service.

8. How long we keep information

We retain personal information only as long as reasonably necessary for the purposes described in this policy. The period depends on the account or transaction lifecycle, legal and financial record-keeping rules, fraud and anti-money-laundering obligations, disputes, security needs and provider requirements.

When information is no longer required, we delete, anonymise or securely isolate it, unless continued retention is required or permitted by law. Closing an account does not always permit immediate deletion of financial or compliance records.

9. How we protect information

We use administrative, technical and physical safeguards designed for the nature of the information, including access controls, authentication, encryption where appropriate, monitoring, logging, secure development and provider reviews. No system is completely secure, so you should protect your credentials and notify us promptly of suspected compromise.

If a security incident affects your personal information, we will investigate and provide notices to affected people or authorities where applicable law requires it.

10. Your privacy rights

Subject to applicable law and permitted limitations, you may ask us to:

• confirm whether we hold personal information about you and provide access to it;
• correct or update inaccurate or incomplete information;
• delete information that we are not legally required to retain;
• object to or restrict certain processing;
• provide eligible information in a portable form;
• withdraw consent where processing relies on consent;
• stop direct marketing; or
• review certain decisions significantly affecting you.

Send a request to contact@wimo.cd. We may verify your identity before acting and may ask for details needed to locate the information. You may also complain to the data-protection authority in your country. In South Africa, this is the Information Regulator.

11. Cookies and similar technologies

Our website and applications may use essential cookies or local storage to keep services secure, remember settings and maintain sessions. With any consent required by law, analytics or similar tools may help us understand performance and improve the experience. You can control many cookies through browser or device settings, but disabling essential storage may prevent parts of the Services from working.

12. Children

The Services are not directed to children under 18, and children may not open Wimo accounts. If you believe a child provided personal information without proper authorisation, contact us so we can investigate and take appropriate action.

13. Changes to this policy

We may update this policy when our Services, providers or legal obligations change. We will post the revised policy and update the date above. If a change is material, we will provide additional notice or request consent where required.