Legal & policies

1. Who controls your data

Mpabeat, Nandee Towers, Plot 12 Wilson Road, Kampala, Uganda, is the data controller for the personal data described in this policy. Our data protection contact is support@mpabeat.com.

We are registered with, or are preparing registration with, the Personal Data Protection Office (PDPO) as required for data collectors and processors. You can contact the PDPO through its official channels if you are not satisfied with our response.

2. Personal data we collect

• Account data: name, email address, password hash, profile image, phone number if you provide one, role and account status.
• Creator data: stage name, biography, location, application details, catalogue metadata, payout and tax information where required.
• Listening and library data: records played, play counts, queue state, likes, follows, playlists, downloads and notification preferences.
• Commerce data: songs purchased, amount, currency, payment status, mobile money provider, masked phone number, transaction references and entitlement records. We do not receive your mobile money PIN.
• Technical data: IP address, browser and device type, operating system, approximate location derived from IP, session identifiers, error logs and security events.
• Support data: messages, email and WhatsApp conversations, attachments and complaint records.
• Cookie and local-storage data described in the Cookie Policy.

3. Why we use it and our lawful bases

• To create and secure your account, provide the player, process downloads and maintain your library — performance of our contract with you.
• To process MTN MoMo and Airtel Money payments, prevent fraud, keep financial records and handle refunds — contract, legal obligation and our legitimate interest in preventing fraud.
• To recommend music, show trending or new releases and understand what is working — our legitimate interest in operating and improving the service, with safeguards for your rights.
• To send service messages, security alerts and responses to support requests — contract and legitimate interest.
• To send marketing about Mpabeat where you have opted in, or where the law permits soft opt-in marketing to existing customers — consent or legitimate interest, with an unsubscribe link in every message.
• To comply with copyright, tax, accounting, law enforcement and data protection obligations — legal obligation.

4. Payments and mobile money

When you start a payment, we send the phone number, amount and a transaction reference to MTN MoMo or Airtel Money. The provider authenticates the payment on your handset and returns a result to us.

We store the payment result and a masked or partial phone number for reconciliation, entitlements, refunds and fraud prevention. We do not store your mobile money PIN or full authentication credentials.

The provider's own privacy policy also applies to the data it handles.

5. Who we share data with

• Payment providers: MTN Mobile Money and Airtel Money, for collection, settlement, refunds and reconciliation.
• Infrastructure providers: hosting, database, storage, email, SMS and security providers acting on our instructions under appropriate confidentiality and data protection terms.
• Creators: aggregate plays, downloads and earnings. We do not give creators your email address, phone number or payment details.
• Professional advisers and auditors, where necessary and under confidentiality.
• Regulators, courts, police or other authorities where the law requires it or where necessary to establish, exercise or defend legal claims.
• A successor entity in a merger, acquisition or restructuring, subject to this policy and applicable law.

6. International transfers

Some service providers may process data outside Uganda. Where that happens, we use contractual safeguards, provider security commitments and other measures intended to meet the cross-border transfer requirements of the Data Protection and Privacy Act, 2019 and its Regulations.

You can ask us for more information about the safeguards used for a particular transfer by emailing support@mpabeat.com.

7. How we protect data

• Passwords are hashed with scrypt and are never stored in plain text.
• Sessions use random tokens stored in httpOnly cookies; sensitive actions are checked on the server.
• Payment callbacks are signature-verified and settlement is idempotent.
• Access to production systems is restricted, logged where appropriate and reviewed.
• We use encryption in transit, input validation, rate limiting and upload validation.
• No system is perfectly secure. If you suspect unauthorized access, contact support@mpabeat.com immediately.

8. How long we keep data

Account data is kept while your account is open and for a reasonable period afterwards to deal with disputes, fraud, backups and legal obligations.

Payment, entitlement and tax records are kept for at least the period required by Ugandan tax and accounting law, generally up to seven years after the transaction.

Support conversations are kept for up to three years unless they relate to a legal claim or a longer legal requirement.

Security and server logs are kept for a limited period, normally up to twelve months, unless needed for an investigation.

When data is no longer needed, we delete it or irreversibly anonymise it.

9. Your data protection rights

Under the Data Protection and Privacy Act, 2019 you may have the right to:

• be informed about how your data is used;
• access a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete data where there is no lawful reason to keep it;
• object to processing based on legitimate interests, and to direct marketing;
• withdraw consent where processing relies on consent;
• ask us to restrict processing in certain circumstances;
• request portability where applicable;
• complain to the Personal Data Protection Office.

10. How to exercise your rights

Email support@mpabeat.com with the subject "Data request" and tell us what you want. We may need to verify your identity before acting, and we will not charge a fee unless the law permits one for manifestly unfounded or excessive requests.

We aim to respond within 30 days. If we cannot meet that deadline, we will explain why and give you an updated date. Some rights are limited by legal retention, fraud prevention or the rights of other people.

11. Children

Mpabeat accounts are intended for people aged 18 and over. If you are under 18, you may use Mpabeat only with the consent and supervision of a parent or guardian. We do not knowingly collect personal data from children without that consent.

If you believe a child has created an account without appropriate consent, contact support@mpabeat.com and we will investigate and remove the account where appropriate.

12. Marketing and automated decisions

We may send you service messages that are necessary for your account. Marketing messages are sent only where you have opted in or where the law otherwise permits, and every marketing message includes a way to opt out.

We do not make decisions that produce legal or similarly significant effects about you solely by automated means. Recommendations and trending lists are not decisions about your access to the service.

13. Data breaches

If a personal data breach occurs, we will contain it, assess the risk, notify the Personal Data Protection Office where required and notify affected individuals where there is a high risk to their rights and freedoms.

We keep records of breaches and the remedial action taken.

14. Complaints and contact

Contact support@mpabeat.com or write to Mpabeat, Nandee Towers, Plot 12 Wilson Road, Kampala, Uganda. We aim to reply within two business days.

If we do not resolve your concern, you can complain to the Personal Data Protection Office in Uganda. You can also seek a remedy through the courts.

15. Changes to this policy

We may update this policy to reflect changes in our service or the law. We will post the new version here and change the "last updated" date. Material changes will be communicated by email or in the service where appropriate.