streamza

Privacy Policy

Version 2 · in force from 11 September 2026

PART B — PRIVACY POLICY This Privacy Policy explains how Streamwave Limited (“Company”, “we”, “us”, or “our”), trading as Streamza, collects, uses, stores, shares, and protects personal data when you use the Streamza mobile application (consumers) and the Streamza.ai website and business portal (businesses), together with related services (the “Services”). It describes your rights under Uganda’s Data Protection and Privacy Act, Cap 97, and the Data Protection and Privacy Regulations, 2021. As the Services expand, additional rights under local data-protection laws may apply. Where those laws give you stronger rights, we will honour those rights for users in that territory. By using the Streamza App or Streamza.ai you acknowledge that you have read this Policy. Under Cap 97, consent is the primary legal basis for collection and processing, with limited statutory exceptions. We do not rely on “legitimate interests” as a standalone Ugandan basis. The Google Play Data Safety form applies to the consumer App. Those disclosures must match this Policy insofar as they describe App data practices. Streamza.ai data practices are described here and must match any cookie or website notice on Streamza.ai. Apple App Store privacy disclosures for the iOS App, if offered, must likewise match this Policy. We do not sell personal data. We do not share personal data with third-party generative-AI providers unless you give explicit consent and we have disclosed that sharing.

  1. Data controller Streamwave Limited Registered address: Frobel Road, Namuli zone, Bukoto 1, Nakawa Divison, Kampala Registration number: 80034148694819 Privacy email: streamwavelimited@gmail.com Business privacy / Streamza.ai: streamwavelimited@gmail.com Data Protection Officer / responsible person: [Name, title, email] PDPO registration number (once issued): [Insert] PDPO portal: https://pdpo.go.ug We are the data controller for personal data processed in connection with the Services. Authorised users on a Streamza.ai organisation account are data subjects in their own right. The Business User may also have independent controller obligations for how it handles its staff data; this Policy covers our processing as provider of Streamza.ai. We are not the Business User’s employer and are not responsible for the Business User’s own HR or monitoring policies.
  1. Information we collect We apply data minimisation. We collect only what is adequate, relevant, and not excessive for the stated purpose (Cap 97, section 3). 2.1 Information you provide • Consumer App account: name, email, phone number, username, hashed credentials, profile information. • Streamza.ai account: organisation name, registration or tax identifiers you choose to supply, administrator name and role, business email, phone, billing contact, seat / user invitations, and profile information of authorised users. • Communications and support tickets. • User Content: playlist names, comments, and similar. • Age or parental-consent information for the consumer App when required. • Cooling-off / immediate-performance consent records for paid consumer transactions. 2.2 Payment information • Consumer App: processed primarily by app stores or payment provider9s0 we designate. We typically receive subscription status, store order identifiers, and limited billing metadata. • Streamza.ai: processed by the payment provider(s) we designate. We may receive billing name, business address, invoice details, transaction references, and subscription status. We do not seek to collect full payment-card numbers. Financial information is “special personal data” under Cap 97, section 9, and is not collected by us except as strictly necessary and permitted (for example limited billing metadata needed to provide the Service or meet tax law). 2.3 Information collected automatically • Usage and streaming data on the relevant channel: tracks played, playlists, searches, listening patterns, interactions, offline download and playback activity on the App, seat or concurrent-stream activity on Streamza.ai. • Device and technical data: device model, browser type (Streamza.ai), OS, app or site version, unique identifiers, IP address, crash or error logs, diagnostics, network type. • Approximate location derived from IP (country / region), used for territorial licensing, catalogue availability, fraud prevention, and legal compliance. • Precise location only if you grant permission (typically a consumer-App permission), and only for stated features. • Streamza.ai cookies and similar technologies as described in Section 11. 2.4 Information from third parties Payment processors and app stores; analytics and crash-reporting providers; authentication providers (if used); and, for Streamza.ai, information an administrator enters about authorised users. 2.5 What we do not generally collect We do not generally collect special personal data under Cap 97, section 9, beyond limited payment metadata. We do not seek religious, political, health, or sexual-life data. Streamza.ai is not directed at children.
  1. How we use personal data We use personal data to: • provide, operate, personalise, and improve the relevant channel, including recommendations, territorial catalogues, seat administration, and offline-download management on the App; • create and administer accounts and authenticate users; • process subscriptions and payments and determine feature entitlement; • communicate about the account, support, security, and service updates; • send marketing only where we have the consent required by applicable law, with a simple opt-out; • analyse performance, usage, and troubleshoot; • detect, prevent, and respond to fraud, security incidents, abuse, licence circumvention, geo-evasion, and misuse of the consumer App for business purposes; • enforce the Terms, protect rights holders, meet CMO or licence-reporting duties, and manage territorial and channel availability; • comply with legal obligations, including PDPO registration, tax, and law-enforcement requests that we reasonably verify; • process account-deletion and data-subject requests; • keep records of consent, including parental consent and immediate-performance consent. Profiling for recommendations does not produce legal or similarly significant effects about you. You may object to marketing profiling by opting out of marketing.
  1. Legal bases (Uganda and expansion) Uganda (Cap 97): • Consent: primary basis, including account creation, optional precise location, cookies that are not strictly necessary, marketing, and (where used) any sharing with a third-party AI provider. • Performance of a contract / requested service: where a statutory exception applies to processing necessary to provide the Service you requested (including a Streamza.ai plan). • Legal obligation: registration, tax, accounting, regulatory response, breach notification, licence and CMO reporting required by law. • Child data (section 8): prior parental or guardian consent for the consumer App, unless another statutory exception applies. We operate an age-ascertainment process as required by Regulation 11. We do not offer Streamza.ai to children. • Special personal data (section 9): not processed unless an express statutory exception applies (including explicit consent or a legal obligation). Card numbers are not collected by us. Withdrawal of consent does not affect processing already lawfully carried out. If you withdraw consent required to operate the account, we may close it. In expansion territories we will apply the additional bases those laws require (for example contract necessity or legitimate interests where those laws recognise them) and will issue a supplement if needed.
  1. Sharing We do not sell personal data. We share personal data only with: • Service providers / processors (hosting, analytics, crash reporting, email or push, support tools, payment and store partners) under written terms requiring appropriate security and use only on our instructions; • Rights holders and CMOs only as necessary for licence compliance, royalty reporting, or fraud/infringement investigation, and only in a form permitted by law (aggregated or minimised where practicable); • Authorities when required by law, court order, or to protect rights, safety, or security; • Successor entities in a merger, acquisition, or asset sale, subject to safeguards and notice where required; • Administrators of a Streamza.ai organisation — limited account and usage information about that organisation’s authorised users, so the Business User can manage seats; • Other parties with your explicit consent (including any third-party AI disclosure we may add later).
  1. International and cross-border transfers Personal data may be processed outside Uganda (for example by cloud, analytics, store, or payment providers, or as the Services expand). Typical regions may include East Africa, the European Economic Area, the United Kingdom, and the United States, depending on confirmed vendors. Under Cap 97, section 19, and Regulation 30 we will only transfer personal data outside Uganda where the destination has adequate protection at least equivalent to the Act, or with your consent, and we will file the undertakings the PDPO requires (commonly Form 3 at registration). Further onward transfer from a foreign processor to another country will not occur without the data subject’s consent where Regulation 30(2) so requires. Equivalent rules of other competent authorities will be observed as we expand.
  1. Retention We retain personal data only as long as necessary for the purposes described, or as required by law. Typical periods: Record: Consumer and Streamza.ai account data Typical period: While the account is active, then up to 24 months after closure unless a longer legal period applies Record: Streaming / usage logs Typical period: 12–36 months for service improvement, security, and licence compliance, then deletion or anonymisation Record: Streamza.ai seat and administrator logs Typical period: As needed for security, billing, and licence compliance Record: Support correspondence Typical period: Up to 24 months after closure of the ticket Record: Billing metadata Typical period: Statutory tax and accounting period Record: Consent and Terms-acceptance logs Typical period: For the life of the account and a reasonable period after, to evidence the contract Record: Records needed for legal claims Typical period: Until the relevant limitation period expires (generally up to six years under Cap 290 for contract and tort)

When no longer needed, data is securely deleted or irreversibly anonymised.

Play / Apple deletion vs residual retention. When you request account deletion we delete the account and associated personal data. We may retain, and we hereby disclose that we may retain: billing records required by tax law; records needed to complete an existing CMO or rights-holder report covering a period before deletion; security or fraud logs for a limited period; and records we must keep to establish, exercise, or defend legal claims. Residual records are restricted and are not used to provide the Service to you.

  1. Security We implement appropriate technical and organisational measures: access controls, encryption in transit and, where appropriate, at rest, staff training, vendor due diligence, and risk assessment. Offline-cached App Content is protected by technological measures. Streamza.ai access should be protected by strong administrator passwords and, when offered, multi-factor authentication. No method is completely secure. You use the Services subject to that residual risk. This Section is not a warranty. We will notify the PDPO, and other authorities as required, of personal data breaches as required by applicable law, and will notify affected users where the law requires or where we consider it appropriate.
  1. Your rights Under Cap 97 you may have the right to access, correction, deletion or restriction (subject to exceptions), objection, withdrawal of consent, and complaint to the PDPO. In other countries you may have additional rights. We will respond in accordance with the law that applies to you. We may verify identity and may refuse requests that are unfounded, excessive, or that would prevent us from meeting a legal obligation. To exercise rights: [privacy@streamwave.ug] or [privacy@streamza.ai] for business users, or the in-product controls. Account and data deletion • Consumers: in-App path and contact Streamza through streamwavelimited@gmail.com • Business Users: Streamza.ai controls and contact Streamza through streamwavelimited@gmail.com The deletion page will describe what is deleted, what is retained and why, and typical processing time. An authorised user’s request may not delete the Business User’s billing records where we must keep them. An organisation deletion request may remove access for all seats. Regulator: Personal Data Protection Office, Uganda — https://pdpo.go.ug — or the competent authority in your country of residence.
  1. Children The Streamza consumer App is not directed to children under 13 (or the higher minimum age in your country or store). We do not knowingly collect personal data from children under that age without verifiable parental consent. For App users under 18 (the Children Act definition of a child in Uganda, or the age of majority elsewhere), parental or guardian consent is required for collection and processing of their personal data under Cap 97, section 8. We will operate an age-ascertainment system as required by Regulation 11. Streamza.ai is a business service and is not directed to children. We do not knowingly create Streamza.ai administrator accounts for anyone under 18. If we learn that we have collected data from a child without required consent, we will delete it. Parents or guardians may contact us to review or delete a child’s consumer-App data.
  1. Cookies, SDKs, and similar technologies Consumer App. We and our providers use mobile SDKs and similar technologies for functionality, analytics, preferences, security, and (only where consented) advertising or measurement. You can manage certain preferences in device settings. Paid functionality will not be conditioned on granting optional tracking permissions where store rules prohibit that. Streamza.ai. We and our providers use cookies, pixels, and similar technologies that are: • strictly necessary for login, security, and playback; and • optional analytics or preference cookies, used only with consent where required. You can manage non-essential cookies through the Streamza.ai cookie notice (to be implemented before publication) and through browser settings. Local cookie and electronic-marketing rules in expansion territories will be observed. Providers expected to be declared (confirm before publication): [hosting], [analytics / crash tool], [push / email], Google Play / Apple billing (App), [Streamza.ai payment provider], [any ad SDK]. Do not list a provider that is not actually used.
  1. Changes to this Policy We may update this Policy. Material changes will be posted on the consumer legal page and on Streamza.ai, the Last Updated date will change, and we will give in-product or email notice where appropriate. Continued use after the effective date constitutes acceptance, subject to any additional consent required by law. We may issue territory-specific or channel-specific supplements.
  1. Contact — Privacy Streamwave Limited (trading as Streamza) Consumer privacy: streamwavelimited@gmail.com Streamza.ai / business privacy: streamwavelimited@gmail.com Address: Frobel Road, Namuli zone, Bukoto 1, Nakawa Divison, Kampala DPO / responsible person: [Insert] PDPO registration: [Insert] Complaints: PDPO (pdpo.go.ug) or the competent authority in your country of residence.