1. INTRODUCTION

Mutual Life Africa (“we,” “us,” or “our”) is committed to protecting the privacy of our users and ensuring transparency in how we collect, use, and share personal data. This App Privacy Policy and Data Sharing Agreement (“Policy”) describes how personal information is processed through the Mutual Life Africa mobile and web application (the “App”) and how it is shared across the Mutual Life Africa Group of companies.

By downloading, accessing, or using the App, you agree to the practices described in this Policy. If you do not agree, please do not use the App.

2. DEFINITIONS

• “Personal Data” means any information that identifies or can reasonably identify you as an individual, including name, contact details, financial information, and identification documents.
• “Group” or “Mutual Life Africa Group” means Mutual Life Africa and its affiliated companies listed in Section 4 of this Policy.
• “App” means the Mutual Life Africa mobile application, web application, and associated platforms available at app.mutuallifeafrica.com.
• “Processing” means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• “User” or “you” means any individual who accesses or uses the App.

3. DATA CONTROLLER

Mutual Life Africa (operating as Mutual Lifeco Africa), headquartered at 420 Fifth Avenue, Manhattan, New York, NY 10018, United States, is the primary data controller for personal data collected through the App.

When your data is shared with affiliated Group entities (see Section 4), those entities may act as independent data controllers or joint controllers in respect of their own processing activities. Each entity is responsible for compliance with applicable data protection laws within their jurisdiction.

4. THE MUTUAL LIFE AFRICA GROUP

Your personal data may be shared among the following affiliated entities within the Mutual Life Africa Group. Each entity contributes to the delivery of services available through the App:

• Mutual Life Africa — The primary platform through which insurance, travel, and financial services are delivered to the global African diaspora community.
• African Mutual Capital — A Group affiliate providing financial and capital-related services to Group customers.
• Mutual Africa Pay — The Group’s digital payments platform, facilitating payments, payouts, and cross-border financial transactions.
• Mutual Life Global — A Group affiliate providing insurance and financial protection products across international markets.
• Taesan Insurance — A Group insurance partner supporting claims processing, risk services, and insurance product fulfilment.

All Group entities are required to process your personal data in accordance with this Policy and applicable data protection legislation. Data sharing between Group entities is governed by intra-group data sharing agreements that impose binding obligations on each party.

5. DATA WE COLLECT

5.1 Information You Provide Directly

• Identity data: Full name, date of birth, gender, nationality, and government-issued identification numbers.
• Contact data: Email address, phone number, postal address, and country of residence.
• Account data: Username, password (encrypted), and authentication credentials.
• Financial data: Payment card details, bank account information, billing address, and transaction history.
• Insurance data: Policy details, beneficiary information, family member information, health declarations, and claims history.
• Travel data: Flight bookings, travel itineraries, eSIM orders, and experience bookings made through the App.
• KYC/AML data: Proof of identity documents, proof of address, and information required for regulatory compliance.

5.2 Information Collected Automatically

• Device data: Device type, operating system, unique device identifiers, and mobile network information.
• Usage data: Pages viewed, features used, session duration, and in-app interactions.
• Location data: General location derived from IP address; precise GPS location only with your explicit consent.
• Log data: IP addresses, access timestamps, error logs, and app crash reports.

5.3 Information from Third Parties

• Payment processors (PayPal, PayFast): Transaction confirmations, payment status, and fraud signals.
• Travel partners (Duffel, Viator, Airalo): Booking confirmations, reservation details, and eSIM activation data.
• Insurance and claims partners: Policy and claims-related data received in connection with the processing and fulfilment of your insurance coverage.

6. HOW WE USE YOUR PERSONAL DATA

We process your personal data for the following purposes:

• Account Management: To create, manage, and maintain your account; verify your identity; and provide customer support.
• Insurance Services: To issue and administer life, funeral, and related insurance policies; to process and support claims; and to manage your policy throughout its lifecycle.
• Payment Processing: To process premium payments, policy payouts, and other transactions; to detect and prevent fraud; and to comply with financial regulations.
• Travel Services: To facilitate flight bookings (Duffel), experience bookings (Viator), and eSIM purchases (Airalo) on your behalf.
• AI-Powered Support: To operate Clara, our AI support agent, which uses your account and policy information to answer your queries.
• Communications: To send policy documents, renewal reminders, payment confirmations, and service updates via email and push notifications.
• Regulatory Compliance: To comply with applicable AML, KYC, tax reporting, and insurance regulatory requirements.
• Analytics and Improvement: To understand how users engage with the App and to improve our products and services.
• Marketing: To send you relevant product information and offers, with your consent where required by law. You may opt out at any time.

7. LEGAL BASES FOR PROCESSING

We process your personal data on the following legal bases:

• Contractual Necessity: Processing required to enter into or perform a contract with you, including issuing and administering insurance policies and processing payments.
• Legal Obligation: Processing required to comply with applicable laws, including AML/KYC obligations, tax reporting, and insurance regulatory requirements.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, app security, claims management, and improving our services, where these interests are not overridden by your rights.
• Consent: Processing based on your freely given consent, including marketing communications and precise location tracking. You may withdraw consent at any time without affecting the lawfulness of prior processing.

8. DATA SHARING AND DISCLOSURE

8.1 Sharing Within the Mutual Life Africa Group

We share personal data within the Mutual Life Africa Group to deliver connected, consistent services to you across all platforms. The purposes for which data is shared include:

• Claims Processing & Support: Group entities collaborate to process, assess, and fulfil insurance claims efficiently, including cross-border claims that require coordination across multiple jurisdictions.
• Payments & Payouts: Personal and financial data is shared to facilitate premium collections, policy payouts, beneficiary payments, and cross-border transactions across Group platforms.
• Fraud Prevention & Security: Group entities share data signals to detect, investigate, and prevent fraudulent activity, identity theft, and financial crime across all platforms.
• Credit & Risk Assessment: Where relevant to your policy or financial product, data may be shared to support credit and risk assessments conducted across the Group.
• Cross-Company Service Support: To deliver a seamless customer experience, Group entities share relevant account and policy data to assist with queries, escalations, and service requests regardless of which platform you first engaged with.
• Cross-Border Assistance: For members travelling or relocating internationally, data is shared across Group entities to coordinate travel assistance, emergency support, and continuity of cover across borders.
• Unified Customer Assistance: Group entities may access your profile and product history to provide consistent, informed support — ensuring you never have to repeat yourself when seeking help across any Mutual Life Africa Group platform.
• Compliance & Regulatory Reporting: Group entities may share data to fulfil joint regulatory obligations, group-level compliance reporting, and responses to lawful authority requests.

8.2 Sharing with Third-Party Service Providers

We share personal data with carefully selected third parties who process data on our behalf under contractual data processing agreements:

• Supabase: Cloud database, authentication, and storage infrastructure.
• Resend: Transactional email delivery.
• Duffel: Flight booking services. Your name, contact details, and travel preferences are shared solely to fulfil bookings.
• Viator: Experience and activity bookings.
• Airalo: eSIM purchases and activation.
• PayPal and PayFast: Payment processing for premium payments and one-time transactions.
• Anthropic (Claude AI): Query content submitted to Clara, our AI support agent, is processed by Anthropic’s API. No identifying data beyond what you include in your query is shared.

8.3 Sharing for Legal and Regulatory Purposes

We may disclose personal data to regulators, law enforcement, courts, or other public authorities where required by law, or to protect the rights, safety, or property of Mutual Life Africa, its users, or the public.

8.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. We will notify you of any such transfer where required by applicable law.

9. INTERNATIONAL DATA TRANSFERS

As a global platform serving the African diaspora, personal data may be transferred to and processed in countries other than your country of residence, including the United States, the United Kingdom, South Africa, and other jurisdictions where Group entities or service providers operate.

Where personal data is transferred outside your jurisdiction, we ensure appropriate safeguards are in place, including standard contractual clauses, adequacy decisions, or other legally recognised transfer mechanisms.

10. DATA RETENTION

We retain personal data for as long as necessary to fulfil the purposes described in this Policy:

• Active account data: Retained for the duration of your account and for seven (7) years after account closure.
• Insurance policy data: Retained for the life of the policy and for a minimum of ten (10) years after policy expiry or termination.
• Payment and transaction records: Retained for seven (7) years to comply with financial regulations.
• KYC/AML records: Retained for five (5) years after the end of the business relationship, or longer if required by law.
• Marketing data: Retained until you withdraw consent or opt out.

At the end of the applicable retention period, personal data is securely deleted or anonymised.

11. YOUR RIGHTS

Depending on your country of residence, you may have the following rights in relation to your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete data.
• Right to Erasure: To request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction: To request that we limit how we use your data in certain circumstances.
• Right to Data Portability: To receive your personal data in a structured, machine-readable format.
• Right to Object: To object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: To withdraw consent at any time where processing is consent-based.

To exercise any of these rights, please contact us at privacy@mutuallifeafrica.com. We will respond within 30 days. We may need to verify your identity before processing your request.

12. DATA SECURITY

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data at rest and in transit (TLS/SSL).
• Role-based access controls and row-level security on our database.
• Secure authentication including multi-factor authentication options.
• Regular security reviews and vulnerability assessments.
• Contractual security obligations imposed on all third-party processors.

No method of transmission or storage is 100% secure. If you believe your data has been compromised, please contact us immediately at security@mutuallifeafrica.com.

13. CHILDREN’S PRIVACY

The App is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it promptly.

14. COOKIES AND TRACKING TECHNOLOGIES

The App uses session tokens, analytics identifiers, and authentication cookies to provide core functionality and improve your experience. You can manage cookie preferences through your device or browser settings. Disabling certain cookies may affect App functionality.

15. CHANGES TO THIS POLICY

We may update this Policy from time to time to reflect changes in our practices, the law, or our services. We will notify you of material changes via the App or by email at least 14 days before the changes take effect. Your continued use of the App after that date constitutes acceptance of the updated Policy.

16. CONTACT US

If you have any questions, concerns, or requests regarding this Policy or the processing of your personal data, please contact us:

Mutual Life Africa (Mutual Lifeco Africa) 420 Fifth Avenue, Manhattan New York, NY 10018 United States

Email: privacy@mutuallife.africa Phone: +1 667 317 7991 Website: www.mutuallife.africa

This Policy was last updated on 16 April 2026.