Compliance Department · March 2026
In force: 06 March 2026 · Next review: 06 March 2027
This Data Protection and Privacy Policy (the “Policy”) establishes the principles, rules, responsibilities and control mechanisms intended to ensure that Conectando – Sociedade Prestadora de Serviços de Pagamentos, Lda (hereinafter “Conectando” or the “Institution”) processes personal data lawfully, fairly, transparently and securely, in strict compliance with the applicable legal and regulatory framework.
As a Payment Services Provider integrated into the Angolan Payments System and supervised by the National Bank of Angola, Conectando recognises that protecting personal data and safeguarding privacy are essential pillars of customer trust, institutional integrity and business sustainability.
Among others, this Policy observes the following instruments:
This Policy applies to:
For the purposes of this Policy and Law 11/22, the Personal Data Protection Act, the terms used here have the meaning assigned to them in that Law, unless expressly defined otherwise in this document.
The Board of Directors is responsible for:
The CACI is responsible for:
The Data Protection Officer is responsible for:
Personal data provided in the context of the relationship with Conectando is processed in strict compliance with the applicable legal provisions, namely:
Personal data is processed transparently, respecting privacy and the fundamental rights, freedoms and guarantees provided for in the Constitution of the Republic of Angola and the Personal Data Protection Act.
Personal data is processed lawfully and fairly, in accordance with the principle of good faith.
The personal data processed is relevant, appropriate and not excessive in relation to the purposes that justified its collection and processing.
Personal data is collected and processed for specific, explicit and legitimate purposes and is not subsequently processed in a manner incompatible with those purposes.
Conectando ensures the accuracy of the personal data processed and adopts appropriate measures to allow its correction or deletion whenever it no longer reflects the data subject’s current situation.
Personal data is retained only for the period necessary to pursue the purposes that determined its collection or processing, in accordance with the Personal Data Protection Act.
Without prejudice to the above, where there is a specific legal retention obligation, including under Law No. 5/20 of 27 January on the Prevention and Combating of Money Laundering, Terrorist Financing and the Proliferation of Weapons of Mass Destruction, Conectando will retain legally required data and documents for at least 10 years, counted from the date of the transaction or the end of the business relationship.
After the applicable legal period has expired, data will be securely deleted or anonymised, unless another legitimate legal basis justifies retaining it for an additional period.
To provide its payment services, and depending on the category of data subject (customers, users, agents, employees or partners), Conectando may collect and process the following categories of personal data:
Conectando’s Core system may collect personal data through image capture for user registration. As part of identity verification, we collect, use and store biometric data as follows:
Conectando’s system collects and stores device-identification data through the UDID (Unique Device Identifier) exclusively to enable two-factor authentication (OTP – One Time Password) for validating the user’s identity when logging in on another device.
Conectando processes personal data only when based on one of the following lawful bases:
Personal data processed by Conectando will not be used for purposes different from or incompatible with those that motivated its initial collection, except where:
The period for which Conectando retains personal data varies according to the underlying processing purpose and lawful basis. Conectando observes the principle of storage limitation and keeps data only for the period strictly necessary, in accordance with legal obligations and operational needs.
Once the defined retention period ends, personal data is securely deleted in accordance with internal retention policies.
Retention for longer than the defined period for historical, statistical, criminal-investigation or national-security purposes may be authorised by the Data Protection Agency upon a reasoned application submitted by Conectando.
Under applicable law, the data subject has the following rights, which may be exercised by submitting a request to Conectando:
A request to exercise rights must be made in writing to Conectando’s Data Protection Officer through the following channels:
Email: p.rodrigues@paypayafrica.com
Registered letter: Rua Joaquim Fernandes Boavida, Prédio Palácio Real, 5.º andar C, Ingombota, Luanda, Angola.
The communication must include a photocopy of an identity document so that the data subject’s identity can be confirmed.
Except where obtaining proof would require disproportionate effort or is effectively impossible, Conectando undertakes to provide proof that the right was exercised upon the data subject’s request.
These rights may not be feasible where national security or criminal-investigation prevention applies, where the data subject cannot be identified, or where other laws take precedence.
Conectando may transmit data subjects’ personal data to processors acting on its behalf and under its direction for specific processing purposes or parts of those purposes.
Conectando only shares data with processors with whom it has a formal contractual relationship imposing a duty of confidentiality regarding the information, in accordance with this Policy. Such entities must also provide sufficient technical and organisational guarantees to protect the data as required by applicable law.
In addition to sharing with processors, Conectando may, where duly justified, be required to disclose personal data to public entities, national or foreign, in compliance with legal obligations or an order from a competent authority.
For operations integrated into the KWiK Arrangement, and in compliance with regulatory provisions issued by the National Bank of Angola, certain user data may be communicated to EMIS – Empresa Interbancária de Serviços, S.A., the entity responsible for the technical and operational management of that arrangement.
Depending on the operation, communicated data may include user identifiers, mobile telephone number, email address, tax identification number, IBAN and other elements strictly necessary to execute the operation.
The communication is based on a legal and regulatory obligation applicable to the payment system and does not depend on the data subject’s consent.
EMIS will act as Controller for data processed within the KWiK Arrangement, and its processing will be governed by its own privacy policy.
For partnerships established to provide international transfer and foreign-exchange services on the PayPay Africa platform, and in compliance with legal and regulatory provisions issued by the National Bank of Angola, certain user data may be communicated to international payment-scheme partners, transfer and remittance service providers, and entities authorised by the National Bank of Angola to provide services complementary to Conectando’s services, including entities responsible for the technical, operational or regulatory management of the relevant partnered services.
Depending on the operation, communicated data may include user identifiers, mobile telephone number, email address, tax identification number, IBAN and other elements strictly necessary to execute the operation, including beneficiary identification, compliance checks, fraud prevention and the prevention of money laundering and terrorist financing.
The communication is based on legal and regulatory obligations applicable to payment and foreign-exchange operations, as well as the performance of established partnerships, and does not depend on the data subject’s consent.
Those partners will act as Controllers for data processed in connection with their services, and their processing will be governed by their own privacy policies.
Conectando is committed to ensuring the security of the personal data it processes, ensuring its confidentiality, integrity and availability in line with good privacy and data-protection practices. The objective is to prevent the accidental or unlawful destruction, in whole or in part, accidental loss, alteration, disclosure or unauthorised access to data subjects’ information.
In this context, Conectando has established security rules and procedures applicable to personal-data processing, defining the required security levels, the resources to be protected, and the functions and responsibilities of each employee or third party who, in the course of their activity, has access to the data.
If a data subject has concerns about personal-data breaches or other privacy matters, they may contact Conectando through the contacts indicated in section 8 of this Policy. They also have the right to lodge a complaint with the Data Protection Agency (APD) or the supervisory authority in their country of residence.
Questions and omissions arising from the interpretation and application of this Policy are resolved by the Board of Directors.
This Policy is approved by Conectando’s Board of Directors and periodically reviewed by the Compliance Department, at the initiative of the Board of Directors or whenever internal or external changes may affect its content.