Contents
Version 1.0 · Effective 2026-06-15 · Last reviewed 2026-05-02
This Notice describes how Jiji Africa Holdings Ltd and its market subsidiaries (collectively, “Jiji”, “we”, “us”) collect, use, share, store, and protect Personal Data when you (“you”, “Creator”) use the Jiji Partners Creator Portal (the “Portal”). It complements — and where the Portal differs, overrides — the general Jiji marketplace privacy notice.
This Notice is the binding statement of our practices toward you. Where it conflicts with our internal Data Processing Agreement (DPA), the conflicting clause does not override creator-facing rights granted under the data-protection law of your market (see §13 Per-market addenda).
Jiji Africa Holdings Ltd is the Controller of your Personal Data, acting through the market subsidiary that signed up your account:
The market subsidiary is your primary point of contact for data-protection matters. The Group DPO is reachable at dpo@jiji.partners; per-market DPOs are listed in §13.
lh3-lh6.googleusercontent.com and never copied to our origin.We do not buy Personal Data from data brokers and we do not enrich your profile from external sources beyond the explicit integrations above.
| Purpose | Categories used | Legal basis |
|---|---|---|
| Operate the Portal account | Account identity | Performance of contract |
| KYC / sanctions screening | KYC documents, identifiers | Legal obligation (AML/CFT) + Performance of contract |
| Calculate and settle commissions | Orders, attribution events | Performance of contract |
| Disburse payouts | Payout-rail credentials, identifiers | Performance of contract |
| Tax reporting | Tax identifiers, payout history | Legal obligation |
| Detect fraud and abuse | Behavioural signals, device data | Legitimate interest (programme integrity) |
| Provide support | Support communications | Performance of contract |
| Send transactional emails | Email, account events | Performance of contract |
| Send marketing emails | Email, account, opt-in flag | Consent (you may opt-out at any time) |
| Comply with regulator requests | Any of the above | Legal obligation |
We do not use Personal Data for:
af-south-1 for KE/NG/GH/UG/TZ; Dublin eu-west-1 for ET; Mumbai ap-south-1 for BD), and Google Cloud where named in the DPA.The current Sub-processor registry is published at dpo@jiji.partners on request. Material additions get 30 days’ prior notice by email + in-app banner; you may close your account during this window if you object (§9 of the Terms).
We disclose Personal Data to regulators, courts, or law-enforcement agencies when legally compelled (court order, warrant, regulatory production order) or where disclosure is required to protect the vital interests of a person. We notify you of such requests where the legal compulsion does not forbid notice.
In the event of a sale, merger, financing, or restructuring of Jiji or any of its subsidiaries, Personal Data may transfer to the successor entity, subject to this Notice (or a successor notice with no less protection).
We store Personal Data in the regional zone listed in §4.1. Cross-border transfers within the Group (e.g., centralised analytics in af-south-1 for KE-resident creators) operate on the legal basis of the Controller-Sub-processor agreement and, where the destination is non-adequate, EU Standard Contractual Clauses (2021/914) plus a documented Transfer Impact Assessment.
We do not transfer Personal Data outside the listed regions without an approved transfer mechanism.
For Ethiopia specifically: cross-border foreign-currency settlement is subject to NBE directives, and your payouts may be domestic-ETB only until forex licensing changes.
We protect your data with measures described in Article 32 GDPR / per-market equivalent:
We do not promise that no security incident will ever happen. We do promise to notify you within 72 hours if a breach affecting your data triggers your market’s notification threshold (per ODPC, NDPC, equivalent regulators).
| Category | Retention |
|---|---|
| Account profile, when account is active | For the life of the account |
| Account profile, after account closure | 30 days for normal closure; up to 7 years where legally required |
| KYC documents and verification verdicts | 5–7 years from account closure (AML/KYC law) |
| Tax records (payouts, withholding) | 7 years (general tax-law minimum) or longer per local rule |
| Click-attribution events | 13 months rolling, then aggregated |
| Authentication events | 90 days |
| Support communications | 24 months from last message; longer if part of an open dispute |
| Marketing-email opt-in/opt-out flags | Until you opt out + 6 months (suppression-list retention) |
After the retention period, data is deleted or anonymised so that re-identification would require disproportionate effort (e.g., aggregated commission totals lose the per-creator key).
You may request earlier deletion under §8.3, but we will retain anything still legally required (KYC, tax) for the full statutory window.
Under your market’s data-protection law, you have at least the following rights, exercisable by writing to privacy@jiji.partners with subject “Data subject request — \[your action\]”:
8.1 Access. A copy of the Personal Data we hold about you, in a structured machine-readable format.
8.2 Rectification. Correction of inaccurate or incomplete data. Most fields are self-service in the Portal under Profile → Account; KYC fields require re-verification.
8.3 Erasure (“right to be forgotten”). Deletion, subject to retention obligations. We honour the request for everything not legally retained; the residual retained data is restricted from active processing.
8.4 Restriction. Pause processing of certain data while a dispute is open (e.g., contested KYC verdict).
8.5 Portability. Receive your data in a structured, machine-readable format and have it transmitted to another controller where technically feasible.
8.6 Objection. Object to processing based on legitimate interest (§3 — fraud detection). We balance against the programme-integrity interest; in most cases we cannot stop fraud detection while the account is active, but we will document the trade-off.
8.7 Withdraw consent. For any processing based on consent (§3 — marketing emails), you may withdraw at any time. This does not affect the legality of processing carried out before withdrawal.
8.8 Lodge a complaint. The right to complain to your market’s data-protection authority (§13).
We respond to verified rights requests within 30 days (or the shorter statutory window of your market). We may extend by up to 60 days for complex requests, with notice.
We do not charge for rights requests except where they are manifestly unfounded or excessive (in which case we tell you the basis before charging).
We use a small set of cookies and browser storage:
__Host-authjs.csrf-token, __Secure-authjs.session-token) — strictly necessary; remembering you are signed in. No legal basis required beyond §3 “operate the Portal”.jp-attr-*, where applicable) — track which creator referred a buyer, for the per-market attribution window. Considered strictly necessary for the affiliate model on the buyer side; on the Creator Portal side, these cookies are not set.We do not use third-party analytics, advertising, or tracking cookies on the Creator Portal as of v1.0. If we ever add them, we will update this Notice and ask for consent before activation.
We do automated decisioning in two narrow contexts:
Neither produces a final decision with legal or similarly significant effect on you without human review (the threshold under GDPR Art. 22 / DPA-KE §35 / NDPA §37). You may request the human-review record under §8.
The Portal is not intended for under-18s. We do not knowingly collect data from children. If you believe a child has signed up, write to privacy@jiji.partners and we will delete the account on verification.
Material changes (new categories of data, new purposes, new Sub-processors with broader scope, retention extensions): 30 days’ notice by email + in-app banner.
Non-material changes (clarifications, contact-info updates, correction of typos): notice on next sign-in.
Continued use of the Portal after the effective date of a change constitutes acceptance. If you do not accept, you may close your account per §9 of the Terms.
The following addenda apply to creators registered in the named market and override this Notice where conflicting. Each lists: applicable law, regulator, your rights window, and the per-market DPO.
dpo-<market>@jiji.partners)If we cannot resolve your complaint, you may complain to your market’s data-protection authority (§13).