Privacy Policy

Who we are

RibiBenefits is the employee benefits platform operated by RibiRewards Limited. References to 'we', 'us', or 'RibiBenefits' in this policy refer to RibiRewards Limited and its operating entities across Africa.

We act as a data controller in respect of employer and administrator data. For employee data, we typically act as a data processor on behalf of the employer (the data controller) in accordance with our Data Processing Agreement.

Data we collect

We collect the following categories of personal data:

• Identity data: name, employee ID, job title, department
• Contact data: work email address, phone number
• Employment data: employer name, team, location, employment status
• Financial data: benefit allowance amounts and category allocations (not salary)
• Usage data: which benefits were accessed and when, transaction amounts, benefit category
• Technical data: IP address, browser type, device information, session data
• Communications data: enquiries and support messages sent to us

What we do not collect

We do not collect or store the content of mental wellness therapy sessions. For mental wellness benefits, we record only that a credit was used and the date — never the nature of any session, diagnosis, or clinical notes.

We do not collect salary or payroll data. Benefit allowance amounts are set by employers and do not constitute salary information.

We do not sell personal data to third parties for advertising or marketing purposes.

How we use your data

We process personal data for the following purposes:

• Delivering benefit services: activating allowances, processing transactions, issuing vouchers and passes
• Platform operation: authentication, account management, customer support
• Compliance: meeting legal obligations in the countries we operate in
• Analytics: understanding platform usage to improve our services (aggregated and anonymised where possible)
• Communications: responding to enquiries and sending service-related notifications

Legal basis for processing

We process personal data under the following legal bases: (a) performance of a contract — to deliver the benefits services you or your employer has engaged us to provide; (b) legitimate interests — for platform security, fraud prevention, and service improvement; (c) legal obligation — where required by applicable law in the jurisdictions we operate in; and (d) consent — where you have given explicit consent, such as for marketing communications.

Data sharing

We share personal data only in the following circumstances:

• Benefit delivery partners: we share necessary data with local partner gyms, restaurants, transit providers, and healthcare providers solely to activate and deliver the specific benefit requested
• Payment processors: for transaction processing where applicable
• Employers: we share usage reports with the employing organisation. These reports show benefit category usage at an individual level but never disclose details of sensitive benefits such as mental wellness sessions
• Legal requirements: where required by applicable law, court order, or regulatory authority in relevant jurisdictions
• Business transfers: in the event of a merger or acquisition, subject to appropriate confidentiality obligations

Data retention

We retain personal data for as long as necessary to deliver our services and meet our legal obligations. Employment and benefits records are typically retained for 7 years from the end of an employment relationship to meet accounting and tax obligations in most African jurisdictions.

Usage and transaction data is retained for 5 years. Technical and session data is retained for 12 months. You may request earlier deletion of your data subject to applicable legal retention requirements.

Your rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of access: to receive a copy of the personal data we hold about you
• Right of rectification: to correct inaccurate data
• Right of erasure: to request deletion, subject to legal retention obligations
• Right to restrict processing: to limit how we use your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests

International data transfers

RibiBenefits operates across multiple African countries. Data may be transferred between our operating entities and to benefit delivery partners in different countries. We ensure appropriate safeguards are in place for all cross-border transfers, including contractual protections aligned with applicable data protection laws.

Cookies

We use essential cookies to operate the platform and analytics cookies to understand how the platform is used. You can manage cookie preferences through your browser settings. Refusing analytics cookies will not affect your ability to use the platform.

Changes to this policy

We may update this policy to reflect changes in our practices or applicable law. We will notify registered users of material changes by email and will post the updated policy on this page with a revised effective date. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.