Privacy Policy

Effective date: 31 October 2026

English is the source and governing version of this Privacy Notice. Translations are provided for convenience; if a translation differs from the English version, the English version prevails to the fullest extent permitted by applicable law. Nothing in this rule restricts your mandatory statutory privacy rights.

1. Who we are, scope and how to contact us

AMYA AFRICA LTD, a company registered in England and Wales under company number 17469906, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom ("Amya", "we", "us" or "our"), operates the Amya cross-border business-to-business (B2B) marketplace.

Amya connects African commercial merchants (traders, importers and retailers buying for business resale or commercial use) directly with manufacturers, exporters and suppliers worldwide, particularly in Asia. Amya operates strictly as an intermediary platform providing discovery, requests for quotation (RFQs), quotations, machine-translated messaging and organization-verification signals. Amya is not a party to any buyer–supplier sale contract, does not sell, ship or hold title to goods, and does not process payments between buyers and suppliers.

This Privacy Notice applies across the Amya buyer website and workspace, supplier dashboard, sales-representative portal, and the Amya Android application (buyer and supplier modes). Although Amya serves business organizations exclusively and prohibits use by consumers or persons under 18 years of age, we process and protect the personal data of natural persons acting as business owners, employees, sole traders, sales representatives and business contacts.

Data controller roles:

• Amya as independent controller: Amya is the data controller for the platform processing activities described in this Privacy Notice, including account management, security, verification, moderation, billing and platform analytics.
• Participating organizations as independent controllers: When a buyer organization and a supplier organization exchange contact details, RFQs, quotations, messages or commercial documents through Amya, each recipient organization acts as an independent data controller for its own commercial handling, off-platform contracting and record-keeping of that data.

Contact and regulatory details:

• General support and privacy requests: support@amya.africa
• Dedicated privacy contact: privacy@amya.africa
• Billing enquiries: billing@amya.africa

2. Personal data we collect and its sources

Depending on the platform features you and your organization use, we process the following categories of personal data (including information identifying sole traders or individual business representatives):

| Category | Examples of personal data | | :--- | :--- | | Account and authentication | Full name, business email address, optional telephone number and profile avatar, preferred and spoken languages, time zone, password hash, third-party sign-in identifiers (Google or Apple, where selected), verification and recovery tokens, active session records and device identifiers. | | Organization and business activity | Representative identity and business contact details, organization memberships, user roles, team invitations, supplier profiles, trade certifications, catalogue listings, saved items and searches, RFQs, quotations and reported commercial outcomes. | | Messages, files and voice notes | Message text, conversation participants, read status, uploaded documents and attachments (including file metadata), uploaded voice notes, automated transcripts, machine translations and synthesized speech. Where live interpreted calls are offered and every call participant explicitly consents, interpreted text and translations are stored as call transcript segments. | | AI interactions | Assistant prompts, conversation context, AI-generated responses and proposed actions, live voice-assistant transcripts, task inputs and outputs, user feedback, model identifiers and feature usage records. | | Trust, safety and support | Organization-verification and identity-change records, user reviews and replies, content or conduct reports and supporting evidence, moderation decisions, statements of reasons, internal appeals and customer-support correspondence. | | Billing and sales representatives | Billing contact details, Stripe customer and payment references, transaction amounts and currencies, invoices, bank-transfer proofs and payment statuses; for sales representatives, referral records, commissions, withdrawal requests and encrypted payout account details. | | Technical and usage information | IP address and user-agent data (used for security and daily-hashed catalogue analytics), account and organization identifiers, mobile push-notification tokens, country and locale settings, search queries, catalogue interaction events, crash diagnostics and security audit logs. |

Sources of personal data:

• Directly from you: when you register, configure your profile, upload verification documents, publish listings, send messages or contact support.
• From your organization or counterparties: when an organization administrator invites you as a colleague by providing your email address, assigns your role, or when a trading partner names business contacts in an RFQ, quotation, message or report. Where we send a team invitation on an organization's behalf, our invitation email notifies the recipient of this Privacy Notice at first contact. Unaccepted invitations expire and are purged in accordance with Section 10.
• From third-party providers and public sources: authentication confirmations from Google or Apple (where chosen by you), payment status notifications from Stripe, publicly available trade or corporate registry records where business-registry checks are available, and publicly listed sole-trader business contact information.
• Automatically: through cookies, local device storage, server logs and diagnostic tools when you use our website or mobile app.

Required registration, payment and verification fields are necessary to deliver the relevant account, billing or verification function; without them, the applicable feature cannot be provided. Please do not include unnecessary personal or sensitive data (including third parties' personal data) in free-text messages, AI prompts or catalogue uploads.

3. Organization verification and identity documents

Organization verification is an optional, free trust signal available to both buyer and supplier organizations. To verify that an organization is genuine and represented by an authorized individual, we review:

1. the organization's official business-registration document; and
2. the passport or national identity card of the authorized representative submitting the request.

Strict privacy safeguards for identity documents:

• No biometric identification: We do not require selfies, do not perform facial recognition or face matching, and do not extract or process biometric templates.
• Handling of incidental or printed sensitive fields: Passports and national identity cards (depending on the issuing country) include a facial photograph and may display fields or indicators revealing nationality, racial or ethnic origin, or religion. We process the document solely to verify the representative's name, document validity and organizational authority, and never to infer, profile or store special-category characteristics.
• Automated pre-check and human decision: Where automated document pre-checking is enabled, an enterprise AI service (Google Gemini on Vertex AI) reads the submitted documents to compare names and validity dates and assigns a provisional status ("checked automatically, review pending"). Authorized Amya staff make the final verification decision; only human staff may refuse verification, providing reasons and an opportunity to appeal.
• Prompt deletion of identity-document images: Identity-document images are stored privately under strict access controls and are permanently deleted promptly after Amya staff record the verification decision. Following deletion of the image, we retain only the representative's full name, document type, issuing country, expiry date and the last four characters of the document number as part of the verification audit record.

4. Purposes and lawful bases for processing

We process personal data under the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018 (DPA 2018) and, where applicable, the EU General Data Protection Regulation (EU GDPR) on the following lawful bases:

| Purpose | Lawful basis | | :--- | :--- | | Account creation, authentication, security and organizational access | Legitimate interests (Art. 6(1)(f)) in operating a secure B2B platform and verifying authorized organizational users; contractual necessity (Art. 6(1)(b)) where the user is an individual sole trader contracting directly with Amya. | | Marketplace discovery, sourcing, messaging and core AI tools | Legitimate interests (Art. 6(1)(f)) in enabling B2B trade communications and requested platform features between participating organizations; contractual necessity (Art. 6(1)(b)) for sole traders. | | Transactional service notices and optional notifications | Legitimate interests (Art. 6(1)(f)) or contractual necessity (Art. 6(1)(b)) for essential account, security, moderation and billing notices. Optional platform notifications are governed by your account notification preferences and one-click unsubscribe links. Promotional marketing (where sent) relies on consent (Art. 6(1)(a)) or applicable B2B corporate-subscriber rules under PECR/ePrivacy, with an unconditional right to opt out at any time. | | Supplier plans, billing, representative commissions and payouts | Legitimate interests (Art. 6(1)(f)) in administering corporate subscriptions, customer support and partner payouts; contractual necessity (Art. 6(1)(b)) for individual sales representatives; legal obligation (Art. 6(1)(c)) for statutory accounting, invoicing and tax compliance. | | Fraud prevention, moderation, organization verification and appeals | Legitimate interests (Art. 6(1)(f)) in protecting marketplace integrity, preventing fraud and resolving disputes; legal obligation (Art. 6(1)(c)) for statutory platform safety, notice-and-action and statement-of-reasons duties. Where an identity document contains special-category data, we rely on explicit consent (Art. 9(2)(a)) collected at voluntary submission and/or substantial public interest in preventing fraud and unlawful acts under UK DPA 2018 Schedule 1, Part 2, paragraph 10. | | Retention of live interpreted-call transcripts (if and when enabled) | Explicit consent (Art. 6(1)(a)) of every call participant to retain the interpreted text and translations for commercial dispute handling. You may withdraw consent by deleting the conversation or contacting us, without affecting the lawfulness of prior processing. | | Catalogue analytics, search improvement and platform diagnostics | Legitimate interests (Art. 6(1)(f)) in maintaining service reliability, fixing crashes and improving B2B catalogue search relevance (subject to data minimization and your right to object), and consent where required by applicable device-storage rules. | | Legal compliance, regulatory requests and legal claims | Legal obligation (Art. 6(1)(c)) to comply with applicable UK/EU laws and lawful authority orders; legitimate interests (Art. 6(1)(f) / Art. 9(2)(f)) in establishing, exercising or defending legal claims. |

5. Who receives personal data and our service providers

We share personal data only as necessary for the purposes above with:

• Marketplace counterparties and organization members: Authorized members of your organization and the buyer or supplier organizations with whom you interact (e.g., via RFQs, quotations, messages or shared files). Messages and files shared with a counterparty are accessible to that counterparty.
• Public visitors: Business profiles, product catalogues, public media assets and approved public reviews are visible to public visitors. Never include private personal contact details or identity documents in public catalogue listings.
• Vetted infrastructure and service providers (processors): Acting under binding data-processing terms and access controls:
• Google Cloud Platform (GCP): primary cloud hosting and database infrastructure (configured in the Netherlands, europe-west4).
• Cloudflare (including Cloudflare R2): network security, content delivery proxy and object storage for public and private media/exports.
• Stripe: hosted checkout, payment card and bank-transfer processing, customer billing records and payment notifications (payment card numbers are entered directly into Stripe Checkout and never stored by Amya).
• Google Gemini (on Vertex AI) and Google Cloud Text-to-Speech: enterprise AI translation, assistant interactions, speech synthesis, content moderation (text and images, as described in Section 7) and verification document pre-checks under cloud data-processing terms that prohibit training public models on private customer data.
• Resend: transactional and notification email delivery.
• Google Firebase: Android push-notification delivery and device-token management (where enabled).
• Sentry: backend and Android error/crash diagnostics (configured with data scrubbing and without performance tracing).
• Verification and registry providers: corporate registry APIs where available for the relevant jurisdiction.
• Authentication and payout partners: Google or Apple when you choose social sign-in; recipient banks, mobile-money operators, PayPal or Wise when executing commission payouts to sales representatives (payout details are encrypted at rest by Amya).
• Competent authorities and professional advisers: courts, regulators, law enforcement, auditors, insurers and legal advisers where required by law or reasonably necessary to protect legal rights.

6. International data transfers

Amya facilitates cross-border B2B trade across Africa, the United Kingdom, the European Economic Area (EEA) and Asia (particularly China). Personal data may therefore be transferred outside the UK and EEA in two distinct ways:

1. Transfers to Amya's service providers: Our primary database hosting is in the European Economic Area (the Netherlands, europe-west4); transfers from the UK to the EEA are covered by UK adequacy regulations. Certain cloud, CDN, email, diagnostic or AI subprocessors may process data internationally. Where a transfer outside the UK or EEA is not covered by a UK adequacy regulation or EU adequacy decision, we rely on approved legal safeguards, namely the EU Standard Contractual Clauses (SCCs) together with the UK International Data Transfer Agreement (IDTA) or UK Addendum, supported by transfer risk assessments and technical encryption measures.
2. Direct B2B marketplace disclosures to overseas trading partners: Most suppliers are located in China or elsewhere in Asia, and most buyers are located in African jurisdictions that do not hold UK or EU adequacy decisions. When you or your organization initiate or respond to an RFQ, quotation or message with an overseas trading partner (whose country is displayed on the platform), relevant business contact and communication data is disclosed to that chosen counterparty as necessary to perform or enter into the requested B2B commercial interaction (or under applicable GDPR Chapter V safeguards and Article 49 conditions where strictly applicable). Once received, the counterparty handles that business information as an independent controller.

You may contact us using the details in Section 1 to request further information on applicable transfer safeguards or copies of relevant standard clauses (subject to lawful redactions for commercial confidentiality).

7. Artificial intelligence, voice features and calls

• AI-generated outputs and labelling: Assistant responses, machine translations, synthesized "listen in my language" audio, and AI-assisted catalogue descriptions or images are generated by machine-learning models, not human advisers. AI outputs may contain errors; always verify commercial terms before relying on them. Assistant actions that modify marketplace data require user confirmation and permission checks.
• Distinct voice and audio flows:

1. Live interpreted marketplace calls (currently disabled): Live interpreted calls between buyers and suppliers are not currently enabled. If and when launched, Amya will never record or store call audio, and the AI interpreter's text and translations will be retained as call transcript segments only if every call participant explicitly consents (solely for commercial dispute handling, and deleted when the conversation or account is deleted).
2. Live voice assistant: When interacting verbally with the AI assistant, Amya does not store session audio recordings, but stores the resulting text transcripts within your assistant thread alongside usage duration metrics.
3. Uploaded chat voice notes: Audio voice notes that a user records and sends as a chat message are stored as message attachments together with their transcripts, translations and synthesized speech audio so participants can replay them.

• Automated moderation and pre-checks: Automated safety filters check text in product listings, organization profiles, RFQs, quotations and review replies, and images (catalogue, profile, studio and chat images), and may reject content that contains prohibited material or improperly exposes personal data; rejected content is not published, though the moderation log is retained. Private message text and voice notes are not checked automatically; they are reviewed by our staff only when reported. Automated verification pre-checks (where enabled) never result in an automated refusal; all refusals are decided by human staff with a right of appeal.

8. Content moderation, reports and safety records

Users and third parties may report suspected unlawful content or platform violations. Amya's trust and safety staff process report submissions, supporting evidence, account identifiers, moderation decisions, audit logs, formal statements of reasons and internal appeals. Internal staff notes are restricted to authorized personnel, while affected users receive clear statements of reasons and may submit internal appeals reviewed by different staff members in accordance with our Terms of Use.

9. Cookies, device storage and analytics

Our web platform uses strictly limited cookies and local browser storage to deliver requested functionality and security:

| Name and storage type | Purpose, duration and attributes | | :--- | :--- | | __Secure-amya_session (Cookie) | Authenticates your signed-in session; 30 days; HttpOnly, Secure, SameSite=Lax, Domain=amya.africa. | | amya_org (Cookie) | Remembers your active selected organization; 30 days; host-only on amya.africa. | | amya_locale (Cookie) | Remembers your chosen interface language; 1 year. | | sidebar_state (Cookie) | Saves your workspace sidebar layout preference; 7 days. | | theme (localStorage) | Saves your light/dark appearance preference; persistent until cleared. |

(Authorized Amya staff portals use separate, strictly necessary host-only `__Host-` authentication session cookies.)

• Cookieless catalogue analytics: We do not use third-party advertising cookies or cross-site trackers. Catalogue analytics runs server-side without setting an analytics cookie, generating a daily-rotating cryptographic hash from IP and user-agent headers alongside country, locale, search queries and (for signed-in users) an internal account reference.
• Android application storage and permissions: The Android app stores session tokens in encrypted device storage and uses local AsyncStorage for user preferences, offline caches and queued outgoing messages. Device permissions (camera, microphone, file picker and notifications) are requested only when you trigger the relevant feature and can be revoked at any time in your Android system settings.

10. Data retention

We retain personal data only for as long as necessary for the purposes set out in this Privacy Notice, in accordance with the following schedule:

| Data category | Retention period | | :--- | :--- | | Account profile, credentials, preferences and AI assistant threads | Retained while your account or thread remains active; erased or anonymized upon account or thread deletion (an anonymized internal database key remains solely to preserve referential integrity). | | Verification identity-document images | Deleted promptly after Amya staff record the verification decision. Only the representative's name, document type, issuing country, expiry date and last four characters of the document number are retained in the verification record. | | Business-registration documents, extracted verification metadata and certifications | Retained while the organization remains active on Amya and for 6 years following organization closure for fraud prevention, regulatory compliance and the defence of legal claims. | | Shared marketplace messages, RFQs, quotes, files, reviews and reports | Retained while the relevant organizations remain active so counterparties maintain their commercial transaction history. Following organization closure, designated closed-organization personal data is purged 6 years after closure (counterparty conversation copies, published reviews and statutory invoices remain subject to their respective rules). | | Consented live-call transcript segments (when calls are enabled) | Retained as part of the conversation only where every call participant consented, and deleted automatically when the conversation or account is deleted. No call audio is stored. | | Completed AI task inputs/outputs and AI feedback | Completed background AI task payloads are cleared 90 days after completion (usage metering totals remain). User AI feedback is purged 365 days after creation. | | Moderation statements of reasons and appeals | 1,095 days (3 years) from the decision or appeal timestamp. | | Security audit logs | 6 years from creation; recorded IP addresses within audit logs are cleared after 12 months. | | Invoices, payments, subscription periods and representative payout ledgers | 6 years after the end of the financial year (ending 30 September) in which the transaction occurred, in compliance with UK tax and corporate accounting laws. | | Catalogue analytics | Detailed event logs are purged 3 months after monthly aggregation into non-personal summary statistics; search-gap aggregates are purged after 365 days. Upon account deletion, search text in surviving recent event logs is cleared. | | Support enquiries and unaccepted team invitations | Public support messages are purged 365 days after creation (active privacy or deletion requests remain protected until resolved). Unaccepted team invitations are purged within 30 days of expiry. | | Data-export files, deleted media, notifications and expired sessions | Personal-data export ZIP files expire 7 days after generation. Deleted or abandoned media assets are swept after a 7-day grace period. Notifications are purged after 365 days (180 days if read). Expired session records are purged 30 days after expiry. | | Database backups | Logical database backups are pruned on a rolling 30-day cycle. |

Retention periods may be extended solely where subject to an active legal hold, regulatory investigation or ongoing dispute.

11. Account deletion and data export

• How to delete your personal account: You may initiate self-service account deletion at any time via the Android app's Account/Privacy settings or on the web at https://amya.africa/en/account/delete. For security, reauthentication is required (users signing in via passwordless Google or Apple authentication complete deletion via the web flow, or with assistance from support@amya.africa).
• Organizational prerequisites:
• If you are the sole active owner of an organization, you must first transfer ownership to another authorized user or close the organization (organization closure requires settling any pending or disputed billing balances).
• Accounts holding active internal staff permissions or sales-representative commission/payout ledgers require assisted closure via support@amya.africa so partner accounting can be finalized.
• If you cannot use self-service deletion due to any organizational constraint—or if you decline updated platform terms and wish to close your organization and exercise statutory erasure—contact support@amya.africa for assisted handling. These operational safeguards do not extinguish your statutory erasure rights under applicable law.
• Effect of deletion: Account deletion revokes active sessions, removes sign-in links, devices, preferences, data exports and AI assistant threads, deletes consented call-transcript segments tied to your account, and anonymizes your personal profile. Consistent with GDPR Article 17(3) exceptions, deletion does not erase messages or documents already shared with trading counterparties, published organizational reviews, organization-level catalogue records, legal-acceptance audit trails, or statutory tax, invoice and commission-payout records, which remain retained strictly for the limited periods in Section 10.
• Self-service data export: Signed-in users can generate a downloadable ZIP archive of core account personal data (available for 7 days after generation; excludes raw attachment binaries, third parties' personal data, security secrets and internal moderation notes). You may also request a full statutory subject-access copy or portable export by contacting us under Section 1.

12. Your privacy rights and complaints

Under UK GDPR, EU GDPR and applicable local data protection laws (subject to statutory conditions and exemptions), you have the right to:

• Access your personal data and receive a copy of it;
• Rectify inaccurate or incomplete personal data;
• Erase your personal data ("right to be forgotten");
• Restrict the processing of your personal data in specified circumstances;
• Data portability for personal data you provided to us under consent or contract;
• Object at any time to processing based on our legitimate interests (on grounds relating to your particular situation) and object unconditionally to direct marketing;
• Withdraw consent at any time where processing relies on consent, without affecting prior lawful processing; and
• Contest automated decisions, obtain human intervention and express your point of view where legally significant automated decision-making applies.

To exercise any right, contact privacy@amya.africa (or support@amya.africa) identifying your account and request. We may request proportionate verification of your identity (without demanding unnecessary identity documents) and respond within one month (extendable by up to two further months for complex requests as permitted by law), free of charge.

Right to lodge a complaint: You have the right to complain at any time—without contacting Amya first—to:

• the UK Information Commissioner's Office (ICO) at https://ico.org.uk/;
• where EU GDPR applies, the competent EU Data Protection Supervisory Authority in the Member State of your habitual residence, place of work or alleged infringement; or
• any other competent data protection authority under mandatory local law in your jurisdiction.

13. Security and changes to this Privacy Notice

We implement technical and organizational security measures designed to protect personal data, including TLS transport encryption, cryptographic password hashing, role-based access controls, private access-controlled storage for verification uploads, encrypted mobile session storage, encryption at rest for representative payout details, and mandatory user confirmation before AI assistant actions modify marketplace data. No internet transmission or storage system can be guaranteed completely immune from intrusion; keep your credentials confidential and treat public catalogue uploads as public information.

We may update this Privacy Notice to reflect legal, technical or operational changes. Material updates will be published with a new effective date and communicated in advance through an appropriate electronic channel (such as email or an in-app notice). An updated Privacy Notice does not authorize incompatible retroactive processing or replace your consent where consent is legally required.