Privacy Notice

Koya Labs Ltd ("Koya", "we", "us", "our") is a private limited company incorporated in Kenya under Registration No. PVT-MA15BD72. We operate the koyabank.com platform, which provides conversion between Kenyan Shillings and Bitcoin, together with related remittance services.

This Notice explains what personal data we collect, why we collect it, how we use and protect it, and the rights you hold over it under the Kenya Data Protection Act, 2019 (the "DPA") and the regulations made under it.

Koya Labs Ltd is the data controller for personal data processed through our website, our mobile interfaces, our WhatsApp and Telegram channels, and our customer support interactions. Being the controller means we decide what data is collected and why, and we are accountable for how it is handled.

Who this notice covers

This Notice applies to everyone whose personal data we process, whether or not you complete an account. That includes visitors to our website, people who begin identity verification and do not finish it, people who transact with us as guests, registered customers, and people who contact our support channels without holding an account.

We collect only what we need to operate a regulated conversion service safely and lawfully. The table below sets out each category, concrete examples of what falls inside it, and the purpose it serves. Where data comes from a third party rather than directly from you, that is stated.

We use the personal data described above for the following purposes.

1. To create and administer your account, including verifying your identity before you can transact.
2. To process currency conversions and remittances, and to settle them to the destination you specify.
3. To comply with anti money laundering, counter terrorist financing and tax law, including record keeping and any reporting we are required to make.
4. To prevent, detect and investigate fraud, and to monitor transactions for indicators of financial crime.
5. To provide customer support and to resolve disputes and complaints.
6. To send you service notifications about your account and your transactions, such as confirmation that a conversion has settled or that your verification result is ready.
7. To secure the platform, including detecting unauthorised access and protecting against abuse.
8. To understand how the platform is used so that we can improve it, using aggregated and, where possible, anonymised information.
9. To send you marketing communications, only where you have given consent, and only until you withdraw it.

We do not use your personal data for purposes that are incompatible with the ones listed here. If that ever changes, we will tell you before the new use begins.

Under the Kenya Data Protection Act, 2019, every use of personal data must rest on a lawful basis. We rely on four.

We share personal data only where it is necessary, and only with the following categories of recipient.

• Our identity verification provider, Sumsub, for KYC and liveness checks.
• Payment service providers, including Safaricom M-Pesa through the Daraja platform and backup providers, in order to process your transactions.
• Our digital asset custody provider, for the safekeeping and settlement of Bitcoin transactions.
• Cloud infrastructure providers, for the operation of the platform. Our infrastructure is hosted on Amazon Web Services in the Frankfurt region.
• Professional advisers, including lawyers and auditors, where their work requires it.
• Regulators and law enforcement where we are legally required to disclose, including the Financial Reporting Centre, the Central Bank of Kenya, the Capital Markets Authority and the Kenya Revenue Authority.

Every processor acting on our behalf is bound by a written contract that limits them to our instructions and requires appropriate security measures.

Our infrastructure is hosted in the European Union, in Frankfurt, Germany. Some of our processors also operate outside Kenya.

Where personal data is transferred outside Kenya, we make sure appropriate safeguards are in place, consistent with the Kenya Data Protection (General) Regulations, 2021. In practice that means contractual data protection clauses with each processor, obliging them to protect the data to the standard the DPA requires and limiting what they may do with it.

We apply technical and organisational measures appropriate to the sensitivity of the data we hold.

• Data is encrypted in transit using TLS, and encrypted at rest.
• Encryption keys for sensitive data are managed through a dedicated key management service, separate from the systems that use them.
• Access is controlled by role. Staff are granted the minimum access their work requires, and access to sensitive customer data is logged.
• Systems that handle customer funds are separated from systems that serve the public website.
• We keep audit records of administrative actions taken against customer accounts.

We describe our measures in general terms on purpose. Publishing the specific architecture of a financial platform would help an attacker more than it would help you. If you are a regulator or an auditor and need detail, contact us using the details in section 14.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and, where the law requires, you directly.

We keep personal data only as long as we need it, or as long as the law requires us to. Anti money laundering law sets a floor we cannot go below, which is why some records outlive the closure of your account.

The Kenya Data Protection Act, 2019 gives you the following rights over your personal data. You can exercise any of them using the contact details in section 14, and we will respond within the time the law allows.

We use cookies and similar technologies for three things: essential site function, analytics, and, where you have consented, personalisation.

Essential cookies cannot be switched off, because without them the site cannot keep you signed in or protect your session. Analytics and personalisation are optional, and the consent banner is where you choose. You can change that choice at any time.

Our separate Cookie Policy sets out each cookie, what it does and how long it lasts.

Koya does not knowingly collect personal data from anyone under 18, and our services are not offered to minors. Identity verification is designed to detect this at onboarding.

If we identify an account as belonging to a minor, we will close it. If you believe a minor has provided us with personal data, contact us using the details in section 14 and we will act.

Parts of our risk scoring and sanctions screening are automated. Automation is what makes it possible to screen every transaction rather than a sample.

Automation is not, however, what decides the outcome. Every sanctions or politically exposed person name match, and every transaction flagged as elevated risk, is reviewed by a member of our compliance team before any account restriction or transaction rejection takes effect.

We review this Notice periodically and update it when our processing changes or when the law does. The current version and its date are shown at the top of this page, and the notice is always published at koyabank.com.

Where a change is material, we will communicate it to you directly, by email or in the app, rather than relying on you to notice a new date here. Continuing to use the service after a change takes effect means the updated Notice applies to you.

For any question about this Notice, or to exercise any of the rights in section 9, contact our Data Protection Officer. If you are not satisfied with our response, you have the right to complain to the Office of the Data Protection Commissioner, and you can do so directly.

The table below lists the categories of processor we rely on to operate the service, what each does, and where it operates. We name a provider only where that fact is already public.

This addendum explains the separate basis on which we process the identity, address and source of funds data we collect for customer due diligence.

That data is processed under Kenya's Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) and the Virtual Asset Service Providers Act, 2025. Processing it is a legal obligation, not a matter of consent, which means you cannot withdraw it while the obligation lasts and we cannot delete the records early.

Providing this data is mandatory

You cannot use Koya's services without providing it. That is a requirement of the law we operate under, not a commercial preference.

Where the data is not provided, or where screening produces a positive sanctions or politically exposed person match that survives review, the consequences may include any of the following.

• Restriction of your account, in whole or in part.
• Rejection of a specific transaction.
• Refusal of service, or termination of the relationship.

A positive screening match is never acted on automatically. It is reviewed by our compliance team first, as described in section 12.