Privacy Policy

1. Information We Collect

We collect information you voluntarily provide when creating an account, listing a property, or contacting support. This includes your full name, phone number, email address, government-issued identification documents (for KYC verification), property details, photographs, and financial information necessary for payment processing. We also automatically collect certain technical data such as device type, IP address, operating system, and usage patterns to improve our service. Payment card and banking details are processed directly by Chapa (our payment gateway) and never stored on our servers.

2. How We Use Your Information

We use your personal information for the following purposes: (a) to create and maintain your account; (b) to facilitate property listings, inquiries, and transactions between buyers and sellers; (c) to process payments through our third-party payment processor, Chapa; (d) to communicate with you about your account, listings, and transactions; (e) to provide customer support and resolve disputes; (f) to detect, prevent, and address fraud, security incidents, and illegal activity; (g) to comply with legal obligations, including anti-money laundering and know-your-customer regulations; and (h) to improve our platform through analytics and usage data. We do not use your data for automated profiling or decision-making that produces legal effects.

3. Information Sharing and Disclosure

We share your personal information only in the following circumstances: (a) with your explicit consent; (b) with service providers who act on our behalf, including Chapa (payment processing), Firebase (push notifications), Jitsi (video calls), and GitHub Actions (video processing) — each bound by contractual data processing agreements; (c) when required by law, legal process, or governmental request from Ethiopian authorities or other applicable jurisdictions; (d) to protect our rights, property, or safety, or those of our users; and (e) in connection with a business transfer, merger, or acquisition. We do not sell your personal information to third parties for marketing or advertising purposes.

4. Data Security and Storage

We implement industry-standard technical and organizational security measures to protect your personal information, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls based on the principle of least privilege, regular security audits, and incident response procedures. Our servers are located in secure data centers. Despite these measures, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security. We will notify you and relevant authorities within 72 hours if we become aware of a data breach affecting your personal information, as required by applicable law.

5. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information: (a) the right to access and obtain a copy of your data; (b) the right to rectify inaccurate or incomplete data; (c) the right to erasure (deletion) of your data, subject to legal retention requirements; (d) the right to restrict processing in certain circumstances; (e) the right to data portability in a structured, commonly used format; (f) the right to object to processing based on legitimate interests; and (g) the right to withdraw consent at any time without affecting the lawfulness of prior processing. To exercise these rights, contact us at support@wavemart.et. We will respond within 30 days.

6. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Material changes will be communicated through prominent notice on our platform and/or via email at least 14 days before they take effect. Your continued use of WaveMart after the effective date constitutes acceptance of the updated policy. We encourage you to review this policy periodically. The "Last Updated" date at the top of this page indicates when the policy was last revised.

7. Data Retention and Deletion

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by Ethiopian law. Specifically: (a) account data is retained while your account is active and for 90 days after deletion, after which it is permanently deleted or anonymized; (b) KYC documentation is retained for the duration of your account plus 5 years to comply with anti-money laundering regulations; (c) transaction records are retained for 7 years as required by Ethiopian tax law; and (d) communications and support tickets are retained for 2 years. Data that has been anonymized (rendered no longer personally identifiable) may be retained indefinitely for analytical purposes.

8. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at support@wavemart.et or through our in-app help center. WaveMart is operated by WaveHub Solutions, Addis Ababa, Ethiopia. For data protection matters, you may also contact our Data Protection Officer at dpo@wavemart.et. You have the right to lodge a complaint with the relevant data protection authority in your jurisdiction if you believe your data protection rights have been violated.

9. Cookies and Analytics

We use essential cookies and similar tracking technologies to ensure the proper functioning of our platform, maintain security, and remember your preferences. These cannot be disabled. We also use analytics services (including Firebase Analytics) to understand how users interact with our platform, measure engagement, and improve our services. The data collected through analytics is aggregated and anonymized where possible. You can control non-essential cookies through your browser settings. Third parties do not place tracking cookies on our platform for advertising purposes.

10. Children's Privacy

WaveMart is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a user under 18 has provided us with personal data without verifiable parental consent, we will take steps to delete that information promptly. If you believe a minor has provided us with their personal data, please contact us immediately at support@wavemart.et so that we can investigate and take appropriate action.

11. International Data Transfers

Your personal information may be transferred to and processed in countries other than Ethiopia where our service providers operate (including the United States, European Union, and other jurisdictions). When we transfer your data across borders, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) adopted by the European Commission or equivalent mechanisms recognized under applicable law. By using our services, you consent to the transfer of your data to countries that may have different data protection laws than your country of residence. We will take all steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy.