Privacy Policy

Y-Ya is a digital event gifting and experience platform operated in Tanzania. We provide QR-based gifting, live contribution displays, guest photo sharing, and event management tools to event organisers and their guests.

For the purposes of this Privacy Policy, “Y-Ya”, “we”, “us”, or “our” refers to the company operating the Y-Ya platform. Our registered contact details appear in Section 13.

We collect information you provide directly, information generated through your use of our services, and information from third-party payment providers.

2.1 Event organisers provide:

• Full name and contact information (phone number, email address)
• Event details — name, date, type, and description
• Mobile money lipa number for receiving disbursed gifts
• Event branding materials such as photos and banners you choose to upload
• Transaction data relating to gifts collected and disbursements received through the platform

2.2 Guests and contributors provide:

• Name and optional personal message when sending a gift
• Mobile money payment information processed via your mobile network operator
• Photos uploaded through the Y-Ya guest photo-sharing feature
• Device information and IP address for security and fraud prevention

2.3 We automatically collect:

• Usage data including pages visited, features used, and time spent
• Device type, operating system, and browser information
• Event performance data including total contributions and guest count

We process your personal data only for legitimate purposes necessary to deliver and improve the Y-Ya service:

• Creating and managing your event page and QR code
• Processing and displaying live gift contributions during your event
• Calculating and deducting Y-Ya transaction fees before disbursement to organisers
• Sending event confirmation, QR codes, and post-event summaries
• Facilitating secure mobile money transactions through registered payment partners
• Providing customer support and responding to your queries
• Improving platform performance, reliability, and user experience
• Detecting and preventing fraud, abuse, or unauthorised access
• Complying with applicable Tanzanian law and regulatory requirements
• Sending service-related communications and, with your consent, promotional messages

Y-Ya facilitates gift payments via Tanzanian mobile money networks including M-Pesa, Tigo Pesa, and Airtel Money. We do not store full payment credentials on our servers.

When a guest initiates a gift payment, the transaction is processed directly by their mobile network operator via a secure API. Y-Ya receives only confirmation of a successful transaction, the amount, and the sender name for display purposes.

Organiser lipa numbers are stored securely and used solely to disburse collected gifts minus Y-Ya's transaction fee. We do not share payment details with third parties except as required to process your transaction or comply with Tanzanian law.

When a guest scans a Y-Ya QR code and makes a contribution, their name and gift amount are displayed on the event's live MC feed as part of the core service. By participating in a Y-Ya event, guests acknowledge and consent to this display.

Event organisers are responsible for informing their guests that a Y-Ya digital gifting system is in use at their event. Organisers must not use guest data collected through Y-Ya for any purpose unrelated to the event itself.

Gift contribution records are retained for 24 months from the event date, after which they are permanently deleted unless the organiser requests earlier deletion.

Guest photos uploaded through Y-Ya are stored securely and associated only with the specific event for which they were submitted. Photos are accessible to the event organiser and, depending on event settings, to other guests.

Y-Ya does not claim ownership of any photos or media uploaded by users. You retain all rights to content you upload. By uploading content, you grant Y-Ya a limited licence to store and display that content within the Y-Ya platform for the duration of the event and retention period.

Photo gallery access is available for the following periods:

After expiry, photos are permanently and irreversibly deleted from Y-Ya servers.

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Payment processors: We share transaction data with mobile network operators and payment gateways necessary to process payments and disbursements.
• Service providers: We use trusted technology providers for hosting, email delivery, and analytics. These providers are contractually bound to protect your data.
• Legal requirements: We may disclose data when required by Tanzanian law, court order, or government authority.
• Business transfer: In the event of a merger, acquisition, or sale of assets, user data may be transferred to the successor entity under equivalent privacy protections.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encrypted data transmission using HTTPS/TLS
• Secure storage with access controls limited to authorised personnel
• Regular security reviews and vulnerability assessments
• Automatic session timeouts for organiser dashboards

While we take security seriously, no internet transmission is 100% secure. We encourage you to use strong passwords and keep your account credentials confidential.

We retain personal data only for as long as necessary to deliver our services and comply with legal obligations:

Subject to applicable Tanzanian law, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right of correction: Request correction of inaccurate or incomplete data
• Right of deletion: Request deletion of your personal data, subject to legal retention requirements
• Right to object: Object to processing of your data for direct marketing purposes
• Right of portability: Request your data in a structured, machine-readable format

To exercise any of these rights, contact us using the details in Section 13. We will respond to verified requests within 30 days.

Y-Ya services are intended for users aged 18 and above. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal information, please contact us immediately and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or best practices. The version number and effective date at the top of this document will be updated accordingly.

For material changes, we will notify registered organisers by email or in-app notification at least 14 days before the change takes effect. Continued use of Y-Ya after the effective date constitutes acceptance of the updated policy.

For privacy questions, data requests, or complaints, please contact: