Under-18 privacy notice
How Mytalu collects, uses, shares and protects information about children who use Mytalu Under 18, and about the parents and legal guardians who apply for them. Please read it before you apply.
Who we are
Mytalu Under 18 is provided by Mytalu (Zambia) Limited, an electronic money issuer licensed by the Bank of Zambia (PSC No. 09/PSB/2023). We decide how your child's information is used, so we are the data controller under Zambia's Data Protection Act, 2021.
Mytalu (Zambia) LimitedAfricaWorks, Agora Village, Lusaka, Zambia
- Email: hello@mytalu.io (subject “Under-18 privacy”)
- WhatsApp: +260 967 727 903
About this notice
Mytalu Under 18 is a wallet for children aged 8 to 17. Only a parent or legal guardian with a verified Mytalu account can apply for one, in the Mytalu app. Two members of our team review each application. When it is approved, the child sets up their own sign-in in the Mytalu Under 18 app with a link code that we give you.
This notice covers the child's information, and the information about you that we use because you are their parent or guardian. Our main Privacy Policy covers your own Mytalu account and applies too. If the two differ about a child, this notice applies.
In this notice, “you” means the parent or legal guardian, and “your child” means the child the account is for.
What we collect
When you apply (from you)
| Information | Details |
|---|---|
| Your child's details | First name, last name, date of birth, gender and nationality, as you enter them. |
| Your relationship to the child | Whether you are the child's parent or legal guardian. |
| Supporting document | A photo or scan of your child's birth certificate (or an affidavit) naming you as the parent. |
| Guardianship document | Legal guardians only: the court order or other document that names you as the child's guardian. |
| A live photo of your child | Taken with the camera in the Mytalu app when you apply, and the time the phone says it was taken. |
| Your consent record | Which versions of the terms and of this notice you agreed to, when, your IP address, the app version, and your phone's model and operating system. |
| More information you send | If our team asks for more information, the note and any new documents or photo you send, and the files they replace. |
| Our review | The checks our reviewers tick, any corrections they make to typing mistakes (with the original kept), who approved or rejected the application and when, and the result of checking your child's name against sanctions and other watchlists. |
About you, as the parent or guardian
| Information | Details |
|---|---|
| Your own Mytalu account | To apply you must have a Mytalu account with your identity verified (KYC). We use the identity details, documents and screening results we already hold about you, as described in our Privacy Policy, to confirm you can open an account for a child. |
| What you do as guardian | Payments you approve, decline, accept or return; the people you approve or block; the daily limit you set; when you pause or resume payments; top-ups and withdrawals; requests to close the account. |
When your child uses the account
| Information | Details |
|---|---|
| Sign-in details | Your child's email address, mobile number and @TaluTag. Their password and payment PIN are stored only in scrambled (hashed) form that we can't read. |
| Devices and sign-ins | The phone model they sign in on, the phones they have used before, IP address and app details, the dates and times of sign-ins, and failed attempts. |
| Face ID or fingerprint sign-in | If your child turns it on, their face or fingerprint stays on their phone: we never receive it. We store a scrambled code for that phone and app install so it can sign them in. |
| Money | Balance; every payment in and out, with the amount, fee, category, note, date and the other person's name or @TaluTag; payments waiting for your approval and payments held for you to accept; money requests to you; airtime and bill payments (provider, number or account paid, and any token or PIN the provider sends). |
| Saving pots and planning | Saving pots (name, emoji, goal and money moved in and out), budgets and the upcoming payments your child plans in the app. |
| Contacts (only matches) | If your child chooses to find friends, the app turns each Zambian mobile number in their phone's contacts into a scrambled code (a SHA-256 hash) on the phone and sends only those codes. We keep only the contacts who are already on Mytalu (their Mytalu name, @TaluTag and number). Names and other numbers are never sent by the current app; if an older version of the app sends a contact list, we still keep only the people who are on Mytalu. |
| Notifications | The messages we send your child in the app (for example when money arrives) and whether they have been read, and, where a phone is set up to receive them, the codes used to send it push notifications. |
| Learning and activity | Badges and challenges they have earned and the days they have used the app. |
| Support | What you or your child tell us when you contact us, by WhatsApp, email or in the app. |
We don't ask for or collect your child's location. The Mytalu Under 18 app uses the camera only to scan Mytalu QR codes, and reads contacts only if your child chooses to find friends (the phone asks first).
Why we use it, and our lawful bases
Under the Data Protection Act, 2021 we may only use personal data when we have a lawful basis. These are ours:
| What we use it for | Lawful basis |
|---|---|
| Checking your child's identity and age, that you are their parent or legal guardian, and screening names against sanctions and watchlists, before we open the account | Legal obligation (anti-money laundering and counter-terrorist financing law, including the Financial Intelligence Centre Act, and Bank of Zambia rules for e-money issuers), and your consent |
| Running the account: the wallet, payments, airtime and bills, saving pots, budgets, money requests, sign-in and support | Contract (our terms with you) and your consent |
| Guardian controls and alerts: sending you payments to approve, holding payments from people you haven't approved, applying limits, and telling you about important activity | Contract and your consent |
| Keeping accounts and money safe: limits, sign-in protection, new-phone alerts, fraud prevention | Contract and legal obligation (Bank of Zambia rules on payment systems and cyber security) |
| Monitoring payments for money laundering, fraud and financing of terrorism, reporting suspicious activity, and keeping records | Legal obligation |
| Regulatory returns and reports to the Bank of Zambia and other authorities, and answering lawful requests | Legal obligation |
| Letting your child find friends who are already on Mytalu (only if they choose to) | Consent (your child chooses to share; the phone asks before contacts are read) |
Consent. You give consent for your child when you apply. We record which version of this notice and of our terms you agreed to, and when. Where we rely on consent you can withdraw it (see section 11).
Decisions. No application is approved or rejected by a computer alone: two people on our team review it. Our systems flag possible watchlist matches and apply limits automatically; a person reviews any flag.
No selling, no advertising. We don't sell your child's information, and we don't use it to show your child advertising or share it for anyone else's marketing.
Who we share it with
We share only what each one needs:
- You, the parent or guardian: your child's balance and recent payments, the payments and bills waiting for your approval, payments held for you to accept, and the alerts in section 9.
- People your child pays or is paid by: what any Mytalu payment shows. Someone you haven't approved who pays your child sees only that the payment is waiting for the guardian, not your child's name.
- Identity and screening providers that help us verify identities and check names against sanctions and other watchlists.
- Payment partners: mobile money operators and the companies that connect us to them, airtime and bill payment providers, banks, and card processors, so they can carry out a payment.
- Technology providers: cloud hosting and storage, and the services that deliver our emails and push notifications. They act only on our instructions.
- Regulators, law enforcement and courts when the law requires it: for example the Bank of Zambia, the Financial Intelligence Centre, the Office of the Data Protection Commissioner, the police, or a court order.
Your child isn't findable by strangers on Mytalu: their name and @TaluTag only show up in contacts and people search for you and the people you approve. Other children see only their first name and initial, unless they share a guardian.
Transfers outside Zambia
Our systems run on cloud hosting, so your child's information (including the documents and photo) is stored and processed in data centres outside Zambia. Some of the providers in section 5 may also be outside Zambia.
We protect it when it leaves Zambia by:
- transferring it only as the Data Protection Act, 2021 allows, with your consent and with contracts that require the provider to protect it;
- encrypting it in transit, and limiting access to the staff who need it;
- keeping the documents and photo private: our staff and you see them through links that stop working after 10 minutes, and staff access to under-18 records is logged.
How long we keep it
We keep information only as long as we need it, or as long as the law makes us keep it.
| Record | Details |
|---|---|
| Documents and photo of an application that is rejected or withdrawn | Deleted 90 days after the decision (birth certificate or affidavit, guardianship document, the child's photo, and any files sent when we asked for more information). |
| Documents and photo of an application left waiting for information | If we ask for more information and nothing is sent for 90 days, the documents and photo are deleted. You can apply again. |
| The record of an application that wasn't approved | The application itself (names, date of birth, our decision and who made it) is kept as the record of our decision, without the documents or photo. |
| Identity (KYC) records of an approved account | The application, documents and photo, kept while the account is open and then for the minimum period Zambian law requires after it closes (currently 10 years under the Financial Intelligence Centre Act), then destroyed. |
| Transaction records | Kept while the account is open and then for the same legal minimum period after it closes (currently 10 years), then destroyed. |
| When an account closes | Sign-in ends at once. We delete your child's matched contacts, saved devices and push notification codes, Face ID or fingerprint sign-in, budgets, planned payments, notifications and any profile picture. We keep the identity and transaction records above, and our audit logs, for the legal period. |
| Face ID or fingerprint sign-in | Stops working after 90 days without use, and at once when the password changes, payments are paused, the account closes or moves to an adult account. |
While we must keep records, we don't use them for anything except meeting the law, and we destroy them when the period ends.
How we protect children
- Every payment your child sends, to a @TaluTag or to mobile money, waits for your approval. Bills, and airtime to any number except your child's or yours, wait for you too.
- Payments to your child from anyone except you and the people you approve are held until you accept them.
- Limits: K1,000 per send, K2,000 a day for sends and bills together, and a K5,000 maximum balance.
- Your child can't be found by strangers, and adults can't request money from them.
- On Android, screenshots and screen recording are blocked in the app while your child is signed in.
- Passwords and PINs are stored scrambled, and new PINs that are easy to guess, such as 1234 or a year of birth, are refused.
Guardian controls
In the Mytalu app, you can:
- see your child's balance and recent payments, top up their wallet and move money back to yours;
- approve or decline each send and bill (a request you don't answer within 48 hours expires and the money goes back to your child);
- accept or decline payments held for you (if you don't decide within 7 days, the money goes back to the sender);
- approve people whose payments go straight in (up to K1,000 each and K2,000 a day), and block people;
- set a daily limit lower than K2,000, and pause your child's payments out (money can still come in);
- issue a new link code, and ask us to close the account.
We alert you when: a payment or bill needs your approval, a payment is held for you, your child asks you for money, buys airtime or data straight away, signs in on a new phone, resets their password or PIN, or asks to close the account; when a payment you approved fails; when we need more information about your application; and when your child turns 18.
Your child gets a notice in the app when money arrives. If you pause their payments, the app tells them when they try to pay.
What happens at 18
- The morning after your child's 18th birthday, we tell you both that they can move to an adult Mytalu account. Nothing changes until they do.
- They move in the Mytalu Under 18 app with their PIN (or by asking us). They then sign in to the main Mytalu app with the same email and password and verify their own identity there. Their money stays in their wallet, but can't move until that check is approved.
- From that moment you can no longer see or manage the account, and your controls for it are deleted. The account's history stays with it, and the person, now an adult, controls their own information under our Privacy Policy. We keep a record that you were their guardian.
Your rights and your child's
Under the Data Protection Act, 2021, your child has rights over their information. You can use them on your child's behalf, and your child can ask us too: we'll listen to them and involve you.
- Access: ask what we hold and for a copy.
- Correction: ask us to fix anything that is wrong or incomplete.
- Deletion: ask us to delete information. We will, except what the law makes us keep (see section 7).
- Objection: object to a use of the information, or ask us to limit it.
- Withdrawing consent: you can withdraw your consent at any time. Because the account depends on it, we will then close the account (once the money is moved out) and keep only the records the law requires. Withdrawing consent doesn't affect what we did before.
- Complaint: complain to us or to the Office of the Data Protection Commissioner (section 12).
How: email hello@mytalu.io or message us on WhatsApp from the email address or phone number on your Mytalu account, with your child's name and @TaluTag. We'll check it's really you before we act. It's free. To close the account, see close your account and delete your data.
Complaints
If you're unhappy with how we handle your child's information, please tell us first, so we can put it right. See how to make a complaint for the steps and timescales.
You can also complain to Zambia's data protection authority, the Office of the Data Protection Commissioner, set up under the Data Protection Act, 2021.
Changes to this notice
When we change this notice, we publish it here with a new version and date, and update the children's version to match. If a change affects how we use your child's information, we'll tell you in the Mytalu app before it applies, and ask for your consent again where the law requires.
This is version u18-2026-10, last updated 27 October 2026. It's the version shown in the Mytalu app when you apply.