TORRID PETRIC ACCOUNTING SYSTEM

PRIVACY POLICY

Effective Date: 3 October 2026 Last Updated: 3 October 2026

1. INTRODUCTION

1.1 Torrid Petric Legacy Enterprises Ltd ("the Company", "we", "us", or "our") operates the Torrid Petric Accounting System (the "Platform"). We are committed to protecting and respecting your privacy and the confidentiality of your personal data.

1.2 This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you access or use the Platform. It applies to all users — personal account holders, business account owners and members, property module owners and team members, POS module owners and team members, employee portal users, advertisers, Mindcheck participants, newsletter subscribers, and visitors.

1.3 This Privacy Policy forms part of, and is incorporated into, our Terms & Conditions. Capitalised terms used but not defined here have the meaning given to them in the Terms & Conditions.

1.4 By creating an account, accessing, or using the Platform, you consent to the collection, use, and processing of your personal data as described in this Privacy Policy.

2. DATA CONTROLLER AND CONTACT

2.1 The Company is the data controller responsible for your personal data processed through the Platform. For any questions or requests regarding your personal data, contact us at:

Torrid Petric Legacy Enterprises Ltd Komamboga, Waligo Road, Kampala, Uganda torridpetriclegacyent.ltd@gmail.com +256 781860240

3. PERSONAL DATA WE COLLECT

3.1 Account Registration Data. When you register, we collect your name, email, phone number(s), NIN, date of birth, gender, place of birth, current residence, sector/occupation, and account type.

3.2 Financial and Operational Data. We collect and store the data you input, including income, expense, asset, savings, loan, and budget records, will and estate planning data, and generated financial summaries or reports.

3.3 Business and Module Data. For business accounts, property modules, and POS modules, we collect business names, sector classifications, member details, property and tenancy records, assessments, demand notes, receipts, expenses, invoices, bills, product catalogs, stock items, payroll records, employee records, and meeting minutes.

3.4 Transaction and Payment Data. When you make or receive payments, including mobile money (MoMo), we collect transaction references, amounts, payment methods, and metadata. Where you submit payment proof through the recovery flow, we also store the uploaded receipt and transaction ID.

3.5 Communication Data. We collect the content of messages you send through the Platform's messaging features, AI Agent and assistant conversations, community posts and replies, screening threads, and engagement messages.

3.6 Device and Usage Data. We automatically collect device information, IP address, browser type, access times, pages viewed, GPS location (when you explicitly enable it for document sign-off), and usage analytics.

3.7 Uploaded Content. We store files you upload, including profile photos, digital signatures, seals, document attachments, receipts, land titles, MOUs, blog post media, advertising creative assets, and music tracks.

3.8 Usage and Metering Data. When you use payable features, we collect metering data including your Point Account balance, PointTransaction ledger entries (debits, credits, carry-forwards, refills, rollovers, gift transfers, reconstructions, balance reconciliation entries), action and feature keys, installment-schedule nodes and status, milestone-compliance snapshots, and Refill Request records. This operates the Points Fuel & Metering System.

3.9 Mindcheck (Sensitive) Data. When you complete Mindcheck, we collect your responses, demographic selections (age range, gender, country, district, subcounty, village), optional contact details, optional employer fields, the computed result band, and feedback. We also record your consent and marketing opt-in. This is sensitive personal data processed under Clause 7.

3.10 Conversion and Gamification Data. To operate the Conversion Psychology Engine, we process the count of features you have activated and your milestones. Aggregated, non-identifying counts may be displayed to other users as social proof. Your individual activation data is not shown to other users.

4. HOW WE USE YOUR PERSONAL DATA

4.1 We process your personal data to: (a) provide the Services (account management, financial/property/POS/payroll/AI tools, document and report generation); (b) communicate with you (in-app notifications, email, engagement messages, demand notes, receipts, reminders); (c) verify identity and secure documents (QR verification, sign-off recording, fraud prevention); (d) process payments and manage billing (mobile money, Points conversion, installment schedules, milestone compliance, invoices, receipts); (e) analyse usage and improve the Platform; (f) comply with Ugandan law; (g) display advertisements and operate the referral program; (h) enforce metering and billing (debiting Points, Hard-Gates, renewal cycles, Grace Periods, suspension for overdue renewals); (i) auto-calibrate Point rates using aggregated, anonymised data; (j) operate the Conversion Psychology Engine (urgency campaigns, social-proof notifications, gamified milestones); and (k) export, sync, or publish data to Microsoft 365 and social-media platforms you have connected.

4.2 We do not process your personal data for purposes that are incompatible with those for which the data was collected.

5. LEGAL BASIS FOR PROCESSING

5.1 We process your personal data on the following legal bases: (a) Consent — where you have affirmatively consented, such as accepting the Terms, enabling location capture, completing Mindcheck, opting in to marketing, subscribing to newsletters, or connecting a third-party integration; (b) Contract — where processing is necessary to provide the Services you have requested, including metering payable actions and enforcing billing cycles; (c) Legal Obligation — where processing is required to comply with Ugandan law; and (d) Legitimate Interests — where processing is necessary for our legitimate interests in operating, securing, and improving the Platform, provided those interests do not override your rights and freedoms.

5.2 Where we rely on your consent, you may withdraw it at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

6. DATA SHARING AND DISCLOSURE

6.1 We do not sell your personal data. We may share your personal data with the following categories of recipients, and only to the extent necessary: (a) Service Providers — third parties acting on our behalf under confidentiality obligations, such as cloud hosting providers, email delivery services, payment processors, and AI model providers; (b) Business and Module Members — within a business, property module, or POS module, data is shared with members according to the capabilities and access scope granted by the account owner; (c) Employees — through the employee portal, employees access only their own payslips, leave, and attendance records; (d) Advertisers — aggregated, non-identifying statistics may be shared with advertisers regarding ad performance; (e) Legal Authorities — where required by law, court order, or to protect the rights, property, or safety of the Company, our users, or the public; and (f) Business Transfers — in connection with a merger, acquisition, or sale of all or part of our business, subject to confidentiality protections.

6.2 Multi-Tenant Data Isolation. We employ row-level security to ensure that business, property module, and POS module data is scoped to the owning account. Members and team members may only access data within their assigned account and within their granted capabilities.

7. SENSITIVE PERSONAL DATA (MINDCHECK)

7.1 Mindcheck collects data relating to mental and financial wellness, which constitutes sensitive personal data under the Data Protection and Privacy Act, 2019 of Uganda. We process this data only with your explicit, affirmative consent, given when you start the assessment.

7.2 You may complete Mindcheck without providing any contact details; results are shown to you regardless. Where you do provide an email and opt in to marketing, we may send you engagement and wellness content and may subscribe you to the Platform's newsletter.

7.3 We do not share your individual Mindcheck responses, band, or feedback with other users, advertisers, or third parties, except where required by law or with your separate explicit consent. Only authorised administrators may access Mindcheck records for Platform operations, and only in aggregated or de-identified form for analytics.

7.4 Conversion Psychology Engine. The Engine processes aggregated, non-identifying counts to display social-proof notifications. These counts are derived from real Platform data but are aggregated so that no individual user is identifiable. Your individual activation data and Mindcheck results are never displayed to other users.

7.5 You may withdraw your Mindcheck consent at any time by contacting us; withdrawal does not delete historical records retained for legal or audit purposes under Clause 8.

8. MICROSOFT 365 AND THIRD-PARTY INTEGRATIONS

8.1 The Platform may integrate with Microsoft 365 (Outlook, OneDrive, Word, and Excel) and other third-party services. When you connect such an integration, your data is transferred to and processed by the third-party provider under that provider's terms and privacy policy.

8.2 Microsoft 365 data is processed and stored by Microsoft in data centres that may be located outside Uganda. By connecting a Microsoft 365 integration, you consent to the international transfer of your data to Microsoft for the purposes described in this Privacy Policy.

8.3 We process only the data necessary to perform the action you requested. We do not retain Microsoft 365 credentials, and you may disconnect an integration at any time, after which we cease new processing (previously transferred data remains subject to the third party's policies).

9. SOCIAL-MEDIA PUBLISHING

9.1 The Platform's automated social marketing engine may generate and publish content to connected social-media accounts (LinkedIn, Facebook, Instagram, and others) on your behalf or on the Platform's behalf. When content is published, your account data and the published content are shared with the third-party social-media platform under its terms and privacy policy.

9.2 TikTok publishing is not automated; the Platform stages draft content for manual posting, and no data is sent to TikTok without your manual action.

9.3 You may disconnect a social-media integration at any time. Previously published content remains subject to the platform's policies.

10. AI-ASSISTED PROCESSING

10.1 The Platform uses artificial intelligence to generate summaries, classifications, recommendations, financial digests, fuel-efficiency insights, Mindcheck guidance, marketing content, and other outputs based on your data.

10.2 When you use AI-assisted features (AI Advisor, AI Agents, business co-pilots, HR assistant, customer assistant, inventory and sales co-pilots), your input data and relevant account data are sent to AI model providers for processing.

10.3 We do not authorise AI model providers to use your data for training their models. However, we cannot guarantee that AI model providers will not process your data in ways outside our control.

10.4 AI-generated outputs are tools for your use and do not constitute professional advice. You are responsible for reviewing and verifying all AI-generated content before acting on it or publishing it.

10.5 Fuel-Efficiency Insights. The Platform may generate AI-derived insights about your Fuel usage and efficiency based on your PointTransaction history and metering data. These insights are provided to you for informational purposes. We do not share your individual fuel-efficiency insights with third parties; only aggregated, anonymised statistics may be used for auto-calibration and platform improvement.

11. DATA RETENTION

11.1 We retain your personal data for as long as your account is active, or as long as necessary to provide the Services.

11.2 After account closure or termination, we may retain your data for a reasonable period to comply with legal obligations, resolve disputes, enforce our agreements, and maintain audit trails.

11.3 Financial and property records may be retained for the period required by Ugandan tax and accounting laws, which may extend beyond the closure of your account.

11.4 Archived account data is preserved in a read-only state and may be restored at the account owner's request or as required by law.

11.5 Metering and Transaction Records. PointTransaction ledger entries, Refill Request records, installment-schedule records, milestone-compliance snapshots, gift-transfer records, and renewal payment records form part of the financial record of your account and are retained for the same period as financial and property records (up to ten (10) years) to comply with Ugandan tax, accounting, and audit obligations. These records are kept even after your account is closed, in accordance with applicable law.

11.6 Mindcheck Records. Mindcheck assessment responses, bands, and feedback are retained for the period necessary to provide the Service and for Platform analytics. You may request erasure of your Mindcheck data subject to legal retention obligations and the retention of de-identified, aggregated analytics.

12. DATA SECURITY

12.1 We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including encryption, access controls, row-level security, and regular security reviews.

12.2 Document sign-off features create tamper-evident audit records, including the issuer's email, timestamp, and GPS location (when captured), to provide proof of who issued or printed a document.

12.3 Sensitive data, including Mindcheck responses, is access-controlled so that only authorised administrators may view individual records, and analytics are produced in aggregated or de-identified form.

12.4 Despite our efforts, no system can be guaranteed to be perfectly secure. We will notify you of any personal data breach affecting you where required by law.

13. YOUR DATA PROTECTION RIGHTS

13.1 Under the Data Protection and Privacy Act, 2019 of Uganda, you have the following rights regarding your personal data: (a) Right of Access — to request a copy of the personal data we hold about you; (b) Right to Rectification — to request correction of inaccurate or incomplete personal data; (c) Right to Erasure — to request deletion of your personal data, subject to legal retention obligations, including the retention of metering and transaction records under Clause 11.5 and the retention of de-identified Mindcheck analytics under Clause 11.6; (d) Right to Data Portability — to receive your personal data in a structured, machine-readable format and transmit it to another controller; (e) Right to Object — to object to the processing of your personal data for direct marketing or other purposes based on legitimate interests; (f) Right to Restrict Processing — to request that we restrict the processing of your personal data in certain circumstances; and (g) Right to Withdraw Consent — to withdraw your consent to processing at any time where we rely on consent, including for Mindcheck and for marketing communications.

13.2 To exercise any of these rights, contact us using the details in Clause 2.1. We will respond to your request within a reasonable time and may require verification of your identity.

14. COOKIES AND ELECTRONIC COMMUNICATIONS

14.1 The Platform uses local storage and similar technologies to remember your preferences, maintain your session, and provide a personalised experience. We do not use tracking cookies for third-party advertising.

14.2 By accepting the Terms & Conditions, you consent to receive electronic communications from us, including in-app notifications, email, and engagement messages, in accordance with the Electronic Transactions Act of Uganda.

14.3 You may opt out of non-essential communications at any time by adjusting your settings or using the unsubscribe link provided in our emails.

15. CHILDREN'S DATA

15.1 The Platform is not directed at individuals under the age of 18, and we do not knowingly collect personal data from children. Mindcheck is not available to individuals under 18.

15.2 If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete that data.

15.3 For estate planning features involving minors (beneficiaries), the account holder is responsible for providing the minor's data and acting in the minor's best interests.

16. INTERNATIONAL DATA TRANSFERS

16.1 Your personal data is primarily stored and processed in data centres that may be located outside Uganda. By using the Platform, you consent to the transfer of your personal data to such countries for the purposes described in this Privacy Policy.

16.2 Where your data is transferred outside Uganda — including to Microsoft 365, social-media platforms, AI model providers, and other service providers — we take reasonable steps to ensure that it is protected by appropriate safeguards, such as standard contractual clauses or equivalent protections.

17. AGGREGATED AND ANONYMISED DATA

17.1 We may collect, use, and share aggregated or anonymised data that does not identify you personally — such as usage statistics, platform performance metrics, fuel-rate calibration data, conversion-engine social-proof counts, Mindcheck aggregate statistics, and sector-wide trends — for analytics, improvement, and marketing purposes.

17.2 Once data is anonymised, it is no longer personal data and is not subject to the rights described in Clause 13.

18. CHANGES TO THIS PRIVACY POLICY

18.1 We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features.

18.2 When we make material changes, we will update the "Last Updated" date above and notify you through the Platform or by email.

18.3 By continuing to access or use the Platform after the amended Privacy Policy is posted, you accept the amended Privacy Policy.

19. COMPLAINTS

19.1 If you believe we have not complied with this Privacy Policy or applicable data protection laws, you may lodge a complaint with us using the contact details in Clause 2.1.

19.2 You also have the right to lodge a complaint with the relevant data protection authority in Uganda.

20. CONTACT INFORMATION

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, you may contact us at:

Torrid Petric Legacy Enterprises Ltd Komamboga, Waligo Road, Kampala, Uganda torridpetriclegacyent.ltd@gmail.com +256 781860240

By continuing to use and/or access the Platform, you acknowledge that you have read and understood this Privacy Policy.