Privacy Policy

Effective date: 19 August 2026
Controller: BrusselsMara Ltd (UK). Romela Pula is a software product of BrusselsMara Ltd.

Contents

1. Who we are
2. What this notice covers
3. What we collect
4. Why we use it
5. Who we share it with
6. Transfers outside the United Kingdom
7. How long we keep it
8. Security
9. Your rights
10. WhatsApp and the app
11. Other people’s data you give us
12. Cookies and device data
13. Children
14. Contact, complaints, and changes

1. Who we are

BrusselsMara Ltd (we, us, our), a company incorporated in England and Wales under company number 15157581, provides Romela Pula. Romela Pula is a software product of BrusselsMara Ltd (WhatsApp assistant, web app, business tools, APIs, receipts, and reports).

Registered office: 58 Northbank Gardens, Manchester M19 1BE, United Kingdom.

Privacy contact: info@brusselsmara.com.

We are the organisation that decides how personal data is used for the Platform (the data controller under UK GDPR and, where applicable, under the data-protection law of your country of residence). This notice stands on its own. It does not make you a customer of any Payment Partner, and it does not name those institutions.

In Botswana, the Platform may be marketed locally by RomelaPula (Pty) Ltd (CIPA BW00009946653), a wholly-owned subsidiary of BrusselsMara Ltd. Where its staff collect documents from you locally, they do so solely as our processor under our instructions — not as a separate controller (see our Terms and Conditions, clauses 1.2 and 13.1A).

2. What this notice covers

This notice applies when you message us on WhatsApp, sign in to the app, register, fund a Balance, send money, create or pay invoices, run payroll, or otherwise use Romela Pula.

It should be read with our Terms and Conditions. If you use the Platform in Botswana, the Botswana Country Addendum also applies. If you do not agree, do not use the Platform.

The Platform is offered to users in supported African countries only. We handle personal data in line with UK law, including UK GDPR and the Data Protection Act 2018, and with other laws that apply because of where you live or where a payment is processed (for example anti-money-laundering rules, Botswana’s Data Protection Act, South Africa’s POPIA, Nigeria’s NDPA, or Kenya’s Data Protection Act, where those apply).

3. What we collect

Account and contact

• WhatsApp / mobile number, name, email, country, account type (individual or business), business name.
• App sign-in codes, session cookies, and the time you accepted the Terms and Privacy Policy.

Identity and verification (KYC / KYB)

• Full name, date of birth, address, identity document type and number, copies of identity documents, proof of address, and (for businesses) registration, tax details, and authorised-representative IDs you upload.

Payments and ledger

• Top-up and payout amounts, currencies, channels (bank or mobile money), recipient names and account or wallet numbers, references, status, fees, and exchange-rate quotes we showed you.
• Your Romela Pula Balance and transaction history (a software record — not a bank account).

Invoices, customers, employees

• Invoice content, line items, customer names, emails, phones, and addresses you store.
• Employee names, payout details, and payroll amounts you enter.

Technical and support

• Device and browser data, IP address, app logs, and messages you send us for support or complaints.

We do not ask for card numbers. We do not collect special-category data unless you put it in a document you upload (for example an ID photo). Upload only what we request.

4. Why we use it

We use personal data to:

• create and secure your account, and send login codes on WhatsApp;
• verify identity and screen for fraud, sanctions, and financial crime;
• transmit payment instructions you give us to Payment Partners (collections, payouts, invoice settlement, payroll, user-to-user transfers);
• show balances, receipts, and business reports;
• quote fees and rates, and keep records we are required to keep;
• improve reliability, support, and complaint handling;
• meet legal duties and respond to competent authorities.

The main legal bases under UK GDPR are: performing our contract with you; complying with the law; and our legitimate interests in running a secure software platform (balanced against your rights). Where the law requires consent (for example certain cookies), we will ask. We do not rely on consent as the main basis for payment or AML processing.

5. Who we share it with

We share personal data only as needed:

• Payment Partners — independently licensed banks, mobile money operators, and payment institutions that collect or pay out funds on the rails described in our Terms. We transmit instructions and data to them by API. We do not name them in this notice. They use the data to execute, screen, or reverse the payment under their own rules and licences. BrusselsMara does not receive, hold, or control the underlying funds (Terms clause 7.2).
• Local marketing entity — RomelaPula (Pty) Ltd in Botswana, only where it collects documents from you on our behalf as a processor.
• Infrastructure providers — hosting, database, email, and messaging providers that process data on our instructions (including WhatsApp as the channel you chose to message us).
• Professional advisers and authorities — auditors, lawyers, and regulators or law-enforcement where the law requires or allows it.
• The other party to a payment — a recipient, invoice issuer, or payer may see your name, reference, amount, and similar details needed to recognise the payment.

We do not sell personal data. We do not share it for unrelated third-party marketing.

6. Transfers outside the United Kingdom

Cross-border payments and cloud hosting mean some data is processed outside the United Kingdom, including in African countries where you, a recipient, or a Payment Partner is located. Those countries may have different data-protection laws.

We only transfer what is needed to operate the Platform and complete a payment. Where UK GDPR requires it, we use appropriate safeguards (such as adequacy decisions, standard contractual clauses, or equivalent mechanisms) for transfers to countries that do not have an adequacy decision.

7. How long we keep it

We keep account, KYC, and transaction records for as long as you have an account and for a further period required for financial-crime, tax, and dispute purposes — typically at least five years after the account closes or the transaction, or longer if the law or an investigation requires. Support and complaint logs are kept for a shorter operational period unless they form part of a compliance file.

When we no longer need data, we delete or irreversibly anonymise it where practical.

8. Security

We use access controls, encryption in transit, and restricted staff access. We redact sensitive payment identifiers from operational logs where practical. No method of transmission or storage is completely secure. You must keep your phone and login codes confidential. Tell us promptly if you think your account was used without permission.

9. Your rights

Subject to UK GDPR and any other law that applies in your country of residence, you may ask to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete data, where the law allows (we may retain what we must keep for payments and AML);
• object to or restrict certain processing;
• receive a copy of data you provided, in a reasonable format;
• withdraw consent, where we relied on consent (this does not affect processing already done).

To use these rights, email info@brusselsmara.com. We may need to verify it is you.

You may complain to the Information Commissioner’s Office (ICO) in the United Kingdom. You may also complain to a supervisory authority in your country of residence if one applies (for example the Information and Data Protection Commission in Botswana, the Information Regulator in South Africa, or equivalent authorities elsewhere in Africa).

10. WhatsApp and the app

WhatsApp is used to activate the app and to deliver your login code. Meta/WhatsApp processes those messages under their own terms. Do not send identity documents on WhatsApp unless we ask you to in the app flow.

Banking, invoices, and payroll happen in the Romela Pula app. Session cookies keep you signed in. We record the time you accepted the Terms when you message us on WhatsApp and when you sign in on the web.

11. Other people’s data you give us

If you enter a recipient, customer, employee, or supplier, you must have a right to give us that data. You are responsible for telling them, where the law requires. We use that data only to follow your instructions (pay them, invoice them, or store them in your directory).

12. Cookies and device data

We use a session cookie to keep you signed in after you enter the WhatsApp login code. That cookie is necessary for the app to work. We may also log technical data to prevent abuse. We do not use advertising cookies.

13. Children

The Platform is for people 18 and over. We do not knowingly create accounts for children. If you believe we have, contact us and we will delete the account where the law allows.

14. Contact, complaints, and changes

Privacy questions: info@brusselsmara.com.

Platform or payment complaints: support@brusselsmara.com or use our complaint form. We will acknowledge your complaint within 2 business days and provide a substantive response within 15 business days (Terms clause 18.1). Disputes about whether a specific collection or payout was executed may need to go through the relevant Payment Partner’s process.

General enquiries: contact form on our website.

We may update this notice. The new version will be posted at this page. Material changes will be announced in the app or on WhatsApp where practical. Continued use after the effective date means you accept the updated notice.

This notice is issued under UK law, without limiting any mandatory rights you have in your country of residence.