Privacy Policy

Last updated: September 2026

1. About This Policy

This Privacy Policy explains how EXM Games ("EXM", "we", "us") collects, uses, stores, and shares information when you use PesaTu ("the Game") and the EXM Games website. It also describes your choices regarding your information and your rights under applicable data protection law.

EXM Games is the data controller responsible for your personal information. If you have questions about this Policy or wish to exercise your rights, contact us at support@exm-gms.com.

2. Information We Collect

When you create an account and use the Game, we collect the following categories of information:

Account Information

• Name: Your first and last name, provided during account registration.
• Email address: Used for account registration, email verification, and account-related communications (such as password reset).
• Phone number: Where provided, used for account verification, payment account linkage, and account recovery. Your phone number may be stored in two forms: as your registration identifier and as your payment account number for transactions.
• Country: The country you select during registration, used for service availability and payment currency determination.
• Authentication credentials: Passwords are processed through secure hashing (Argon2id). EXM does not store your password in plaintext.

Transaction and Payment Information

• Deposit records: Amount of PTT purchased, timestamp, payment provider reference, and currency.
• Withdrawal records: Amount of PTT redeemed, timestamp, processing status, and payment provider reference.
• Token balance history: Your PTT balance changes over time, including purchases, gameplay winnings, losses, and redemptions.
• Payment account number: The phone number linked to your payment account for mobile money transactions.
• EXM does not store full payment card numbers, CVV codes, or bank account details. Payment transactions are processed by third-party payment providers who collect and process payment information independently.

Gameplay Information

• Match records: Entry costs, outcomes (win, loss, draw), opponents, and timestamps.
• Room participation: Rooms created or joined, and associated entry costs.
• Token balance changes: PTT debited or credited as a result of gameplay.

Device and Technical Information

• Push notification tokens: If you enable push notifications, a device token (Firebase Cloud Messaging identifier) is stored to deliver notifications to your device. Device tokens do not identify you personally outside the context of delivering Game notifications.
• Platform and device name: The operating system (e.g., Android) and optional device name you provide when registering for notifications.
• IP address: Logged for security monitoring and rate limiting on administrative interfaces. IP addresses are not stored in user profile records.
• Authentication tokens: Your email address is included in authentication tokens issued during login for session verification purposes. These tokens are stored on your device and are not transmitted to third parties.

Information We Do Not Collect

The Game does not collect: GPS or location data, contact lists, photos or media, browser user-agent strings, device fingerprints, social media profiles, or browsing history. The Game does not use analytics scripts, advertising pixels, or tracking cookies.

3. How We Use Information

We use the information we collect for the following purposes:

• Account operation: Creating, maintaining, and securing your account.
• Authentication: Verifying your identity when you sign in.
• Gameplay: Processing match entries, determining outcomes, crediting rewards, and maintaining game state.
• Transaction processing: Recording purchases, maintaining token balances, and processing redemption requests.
• Fraud prevention: Detecting and preventing cheating, payment fraud, collusion, account abuse, and other violations of our Terms.
• Customer support: Responding to inquiries, investigating reported issues, and resolving disputes.
• Security: Monitoring for unauthorised access, attacks, and system abuse.
• System monitoring and improvement: Analysing performance, diagnosing errors, and improving the Game's stability and features.
• Legal compliance: Meeting obligations under applicable law, responding to lawful requests from authorities, and enforcing our Terms.
• Communication: Sending service-related announcements, security alerts, and account notices (such as email verification and password reset). We do not send marketing emails.

4. Legal Basis for Processing

We process your personal information on the following legal bases:

• Contractual necessity: Processing necessary to provide the Game, process your transactions, and perform our obligations under the Terms of Service.
• Legal obligation: Processing required to comply with applicable laws, including financial record-keeping, anti-money laundering obligations, and tax requirements.
• Legitimate interests: Processing necessary for fraud prevention, security monitoring, and system improvement, where such interests are not overridden by your rights.
• Consent: Where you have given explicit consent for specific processing activities (such as enabling push notifications). You may withdraw consent at any time by disabling notifications in your device settings.

5. Data Sharing

We do not sell personal information. We share information only in the following circumstances:

Payment Providers

When you make a deposit or withdrawal, we share the necessary transaction information with our payment provider to process the transaction: your name, phone number, email address (for deposits), transaction amount, currency, and a unique transaction reference. For withdrawals, we also share your payment account details (name and account number). The payment provider processes this information according to its own privacy policy and terms of service.

Push Notification Services

If you enable push notifications, your device token is transmitted to Firebase Cloud Messaging (FCM) to deliver notifications. No personal information (name, email, phone) is shared with FCM. You can disable push notifications at any time through your device settings.

Email Services

Transactional emails (email verification, password reset, account change confirmations) are sent through a third-party email service provider (Resend). Your email address and name are shared with the email provider solely to deliver these messages.

Legal Obligations

We may share information with law enforcement, regulators, or other government bodies when required by applicable law, court order, or legal process.

Safety and Enforcement

We may share information where necessary to investigate, prevent, or take action regarding suspected fraud, illegal activity, violations of our Terms, or threats to the safety of users or the public.

Business Transfers

In connection with a merger, acquisition, or sale of assets, user information may be among the transferred assets. You will be notified of any change in ownership or use of your personal information.

Administrative Monitoring

EXM uses an internal administrative messaging system (Telegram) for operational alerts, system health monitoring, and deployment notifications. Administrative alerts contain system-level information (server health, error rates, deployment status) and do not include individual user personal information in normal operation. If an error or alert incidentally references a user action, the information is limited to what is necessary for troubleshooting and is not retained beyond the operational purpose.

6. Cross-Border Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, where our service providers operate. These countries may have data protection laws that differ from the laws of your jurisdiction.

Where we transfer personal data across borders, we take steps to ensure that appropriate safeguards are in place, including contractual protections with our service providers. By using the Game, you consent to the transfer of your information as described in this Policy, to the extent such consent is required by applicable law.

7. Data Retention

We retain information for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following specific retention periods apply:

Account Information

Retained while your account is active. Upon account deletion, account information (name, email, phone number) is retained in deactivated form for fraud prevention and legal compliance purposes. Deactivated account records are maintained for as long as necessary to fulfil these purposes, or as required by applicable law.

Financial Transaction Records

Retained for the period required by applicable financial, tax, and anti-money laundering regulations, which may extend to ten (10) years or longer after the transaction. Financial ledger records are stored in an immutable system that prevents modification or deletion after creation.

Gameplay Records

Retained for fraud detection, dispute resolution, and service improvement. May be retained after account closure in aggregated or anonymised form.

Session Data

Active session records are retained for the duration of your login session. Sessions expire automatically: after 24 hours for standard logins, or after 30 days for sessions where "remember me" was selected. Expired sessions are automatically removed.

Device Tokens

Push notification device tokens are retained while your account is active and notifications are enabled. Device tokens are deleted upon account deletion or when you disable notifications.

Technical Logs

IP address logs and security monitoring data are retained for a limited period necessary for security monitoring and performance analysis.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right of access: You may request confirmation of what personal information we hold about you and obtain a copy of that information.
• Right to rectification: You may request correction of inaccurate or incomplete personal information. Currently, PesaTu does not offer in-app profile editing. To request correction of your personal information, contact us at support@exm-gms.com.
• Right to deletion: You may request deletion of your account and personal information through the Game's account management features, or by contacting us. See Section 9 for details on what is deleted and what is retained.
• Right to restrict processing: You may request that we restrict processing of your personal information in certain circumstances.
• Right to data portability: You may request a copy of your personal information in a structured, commonly used, machine-readable format. To request a data export, contact us at support@exm-gms.com.
• Right to object: You may object to processing of your personal information based on legitimate interests.

To exercise these rights, contact us at support@exm-gms.com. We may need to verify your identity before processing your request. Certain information may be retained where required by law or for legitimate business purposes as described in this Policy.

9. Account Deletion

You may request deletion of your account through the Game's account management features. When you delete your account:

• Your account is permanently deactivated and you lose access to the Game.
• Your active session is terminated and your login credentials are invalidated. Any remaining access token in your device will expire within its normal validity period.
• Push notification device tokens are deleted from our systems.
• Any available (unlocked) PTT balance in your account is forfeited and transferred to the platform. PTT that is locked due to pending transactions or active matches may also be forfeited.

The following information is retained after account deletion:

• Account information (name, email, phone number) is retained in deactivated form to prevent fraud, resolve disputes, and comply with legal obligations.
• Financial transaction records (purchases, withdrawals, match entries, winnings) are retained as required by applicable financial, tax, and anti-money laundering regulations, which may require retention for up to ten (10) years.
• Match records may be retained in anonymised or aggregated form for analytics and fraud detection.
• System and audit logs may be retained for security monitoring and compliance.

Account deletion is permanent and cannot be undone. If you wish to use PesaTu again, you must create a new account.

10. Children's Privacy

The Game is intended for users who meet the minimum legal age and eligibility requirements applicable to PesaTu in their jurisdiction. The Game is not intended for individuals who do not meet these requirements. We do not knowingly collect personal information from individuals who do not meet the applicable age requirements.

If we learn that we have collected personal information from an individual who does not meet the applicable age requirements without appropriate consent, we will take steps to delete that information promptly.

11. Security Measures

We implement reasonable technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Password hashing: Passwords are hashed using Argon2id, an industry-standard password hashing algorithm, before storage. Plaintext passwords are never stored.
• Encryption in transit: Data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
• Access controls: Personal information is accessible only to authorised personnel who require it for legitimate operational purposes.
• Rate limiting: Authentication attempts and API access are rate-limited to prevent brute-force attacks and abuse.
• Input validation: All user inputs are validated and sanitised to prevent injection attacks and data corruption.

However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials. Do not share your password with others. Notify us immediately if you suspect unauthorised access to your account.

12. Cookies and Tracking

Our website uses essential, session-only cookies required for security and basic functionality. We do not use tracking cookies, advertising cookies, analytics cookies, or similar technologies for profiling or marketing purposes. We do not integrate third-party analytics scripts, advertising pixels, or tracking technologies.

13. Third-Party Services

The Game relies on the following categories of third-party service providers:

• Payment processing: Processes token purchases and redemptions. Receives your name, phone number, email address (for deposits), transaction amounts, and transaction references. Processes data according to its own privacy policy and terms.
• Push notifications (Firebase Cloud Messaging): Delivers push notifications to your device. Receives only device tokens and notification content. No personal information (name, email, phone) is shared with FCM.
• Email delivery (Resend): Sends transactional emails (verification, password reset, account change confirmations). Receives your email address and name solely to deliver these messages.
• Exchange rates (Frankfurter API): Provides currency exchange rate data. No personal information is shared with this service.

The Game or website may contain links to external sites. We are not responsible for the privacy practices of those sites.

14. No Sale of Personal Information

EXM Games does not sell, rent, or trade your personal information to third parties for their marketing or commercial purposes. We do not share your personal information with third parties except as described in this Privacy Policy.

15. Push Notifications

If you enable push notifications, a device token is stored to deliver notifications about gameplay events (such as available rooms). You can disable push notifications at any time through your device settings. Disabling notifications does not affect your ability to use the Game.

Notification device tokens are stored in our database associated with your account. We do not use notification tokens for tracking or profiling purposes.

16. Email Communications

We send the following types of transactional emails:

• Email verification: Sent upon account registration to verify your email address.
• Password reset: Sent when you request a password reset.
• Account change confirmations: Sent when you change your email address or payment account phone number.

We do not send marketing emails, promotional offers, newsletters, or advertising content. You cannot opt out of transactional emails as they are necessary for account security and operation.

17. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within the timeframe required by applicable law.
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
• Document the breach, its effects, and the remedial measures taken in our internal breach register.

18. Your Choices

You have the following choices regarding your information:

• Push notifications: You can enable or disable push notifications at any time through your device settings.
• Account information: You can view your account information through the Game's account management features. To request correction of your information, contact us at support@exm-gms.com.
• Account deletion: You can delete your account through the Game's account management features. See Section 9 for details.
• Data export: You can request a copy of your personal information by contacting us at support@exm-gms.com.

19. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Material changes will be communicated through the Game client, website, or email where reasonably possible. Changes take effect when the updated Policy is posted on this page or when notified through the Game, whichever occurs first. Continued use of the Game after changes take effect constitutes acceptance of the updated Policy.

20. Contact and Complaints

For privacy-related inquiries, data access requests, or to report a concern, contact EXM Games:

support@exm-gms.com

If you believe that our processing of your personal information violates applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. Where applicable, you may contact the Personal Data Protection Office (PDPO) under the National Information Technology Authority — Uganda (NITA-U) for matters relating to the Uganda Data Protection and Privacy Act, 2019.