Erinayo Markets Privacy Policy

Effective Date: August 28, 2026 Last Updated: August 28, 2026

1. Introduction

Erinayo Markets ("Erinayo," "we," "us," or "our") operates the online multi-vendor marketplace available at erinayo. markets (the "Platform"), operated by Erinayo Limited, with its registered address at Obote Avenue, Lira City, Uganda.

This Privacy Policy explains how we collect, use, disclose, and protect the personal data of buyers, sellers, and visitors who use the Platform. It applies regardless of whether you access Erinayo Markets from Uganda or from abroad.

We are committed to complying with Uganda's Data Protection and Privacy Act, 2019 and its Regulations, and, where applicable to users located in those jurisdictions, with the EU/UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). Where these frameworks impose different or additional obligations, we apply the standard that gives you the greater protection.

By creating an account, browsing the Platform, or making a purchase, you acknowledge that you have read and understood this Policy.

2. Who This Policy Covers

This Policy applies to:

• Buyers - anyone who browses, registers, or purchases on the Platform.
• Sellers -individuals or businesses who register a shop on the Platform to list and sell products.
• Visitors - anyone who visits erinayo.markets without creating an account.

Seller businesses that collect their own customer data outside the Platform (e.g., via their own marketing lists) act as independent data controllers for that data, and this Policy does not govern their independent processing.

3. Information We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

• Device and usage data: IP address, browser type, device identifiers, operating system, pages viewed, referring URLs, and timestamps.
• Cookies and similar technologies: used for login sessions, cart contents, language/currency preferences, and analytics. See Section 8.
• Location data: approximate location inferred from your IP address, used to localize currency and delivery estimates.

3.3 Information from Third Parties

• Payment processors (Section 5) share transaction status, confirmation, and fraud-risk signals with us.
• Social login providers (e.g., Google), if you choose to register or log in that way, share your name and email address with us as authorized by you.
• Delivery and logistics partners share delivery status and confirmation data.

4. How We Use Your Information

We use personal data to:

1. Create and manage your buyer or seller account.
2. Process orders, payments, refunds, and returns.
3. Verify seller identity and business legitimacy (know-your-business checks).
4. Provide customer support and respond to inquiries.
5. Send transactional communications (order confirmations, shipping updates, security alerts).
6. Send marketing communications and newsletters, where you have opted in, and allow you to opt out at any time.
7. Detect, investigate, and prevent fraud, abuse, and violations of our Terms & Conditions.
8. Improve and personalize the Platform, including product recommendations and search relevance.
9. Comply with tax, accounting, and other legal obligations in Uganda and other applicable jurisdictions.
10. Enforce our Terms & Conditions and other policies, and resolve disputes between buyers and sellers.

5. Payment Processing

Erinayo Markets does not store full payment card numbers, card security codes, or mobile money PINs on our own servers. Payments are processed by the following categories of third-party payment processors, acting as independent data controllers or processors for the payment data they handle:

• EriPay -our affiliated regulated payment gateway, which processes a portion of transactions on the Platform.
• Mobile money aggregators (e.g., MTN Mobile Money, Airtel Money integrations) - for mobile-money-based checkout.
• Card payment processors for card-based checkout (e.g., Visa/Mastercard network gateways).

Each payment processor, including EriPay, has its own privacy policy and terms governing how it handles your payment data. We encourage you to review those policies before completing a transaction. We receive only confirmation of payment success or failure, transaction amount, and a masked reference to the payment method — not full account or card credentials - from these processors.

6. How We Share Information

We share personal data with:

• Sellers, limited to the information necessary to fulfill your order (name, delivery address, phone number, and order contents) when you purchase from their shop.
• Payment processors, as described in Section 5.
• Delivery and logistics partners, to fulfill and track shipments.
• Service providers, such as hosting, analytics, customer support, and email delivery vendors, who process data on our behalf and under our instructions.
• Regulators and authorities, where required by Ugandan law, court order, or to protect the rights, property, or safety of Erinayo, our users, or the public.
• A successor entity, in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

We do not sell personal data to third parties for their own independent marketing purposes. Where CCPA/CPRA "sale" or "sharing" definitions are broader than this (e.g., certain advertising cookies), Section 11 explains your opt-out rights.

7. International Data Transfers

Erinayo Markets is based in Uganda, and data may be processed on servers located in Uganda or other countries where our hosting and service providers operate, including countries outside Uganda, the EU/UK, or California.

Where we transfer personal data of individuals located in the EU/UK, we rely on appropriate safeguards recognized under GDPR, such as Standard Contractual Clauses, or another valid transfer mechanism. Where we transfer personal data originating in Uganda outside the country, we do so consistently with the cross-border transfer requirements of the Data Protection and Privacy Act, 2019.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Keep you logged in and remember your cart.
• Remember your language and currency preference.
• Analyze traffic and usage patterns to improve the Platform.
• Support advertising and retargeting, where enabled.

You can control cookies through your browser settings. Disabling essential cookies may prevent core features (such as login or checkout) from working. Where required by applicable law, we will request your consent before setting non-essential cookies.

9. Data Retention

We retain personal data for as long as necessary to:

• Maintain your account, for as long as it remains active.
• Fulfill the purposes described in this Policy.
• Comply with tax, accounting, consumer protection, and other legal obligations (which in Uganda and comparable jurisdictions commonly require retaining transaction records for several years).
• Resolve disputes and enforce our agreements.

When you request account deletion, we delete or anonymize personal data that we are not otherwise required to retain, as described on the Platform's account deletion page. Some order and financial records may be retained for the periods required by law even after account deletion.

10. Data Security

We apply administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encrypted transmission of payment data to our processors and access controls on internal systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Rights

11.1 All Users

Subject to applicable law, you may request to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data (see Section 9 for retention limits).
• Withdraw consent for marketing communications at any time.
• Object to certain processing, such as direct marketing.

To exercise these rights, contact us using the details in Section 14 or use the account tools available on the Platform (e.g., account deletion).

11.2 Additional Rights for EU/UK Users (GDPR)

If you are located in the EU or UK, you additionally have the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection supervisory authority. Where we rely on your consent to process data, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

11.3 Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you additionally have the right to know what personal information we collect, use, and disclose; to request deletion; to correct inaccurate information; to opt out of the "sale" or "sharing" of personal information (including certain advertising-related data sharing, if applicable); to limit use of sensitive personal information; and to not be discriminated against for exercising these rights. Erinayo Markets does not knowingly sell the personal information of California residents in exchange for money.

11.4 Ugandan Users (Data Protection and Privacy Act, 2019)

If you are located in Uganda, you have the rights of access, correction, and deletion described above, as well as the right to object to processing carried out on the basis of legitimate interest, and the right to lodge a complaint with Uganda's Personal Data Protection Office (PDPO/NITA-U).

12. Seller Obligations

Sellers who collect buyer information through the Platform (e.g., via order fulfillment or seller-buyer messaging) must only use that information to fulfill the relevant order and related customer service, must not use it for independent marketing without the buyer's separate consent, and must comply with applicable data protection law in how they store and use it.

13. Children's Privacy

Erinayo Markets is not directed to children under 18, and we do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate consent, we will delete it.

14. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact:

Erinayo Markets, Obote Avenue, Lira City, Uganda. Phone: +256 702 430 400 Email: info@erinayo.markets

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or legal requirements. We will post the updated Policy on this page with a revised "Last Updated" date, and where changes are material, we will provide additional notice (such as an email or a Platform banner) before t