Mobile Application Terms and Conditions

THESE MOBILE APPLICATION TERMS AND CONDITIONS ("Terms") constitute a legally binding agreement between the organization that has contracted with Reja Technologies Limited for access to the Reja platform ("Client" or "Customer") and each individual authorized to use the Reja mobile application ("User" or "you"), and Reja Technologies Limited and its subsidiaries and affiliates (collectively, "Reja," "Provider," "we," "us," or "our"). These Terms govern all access to and use of the Reja mobile application, including all offline capture, synchronization, task execution, visit management, route optimization, field evidence collection, and telemetry features (collectively, the "App"). By installing, accessing, or using the App, you acknowledge that you have read, understood, and agree to be bound by these Terms.

1. Scope and Applicability

These Terms govern all use of the Reja mobile application across all supported platforms (including but not limited to Android and iOS). These Terms supplement and are subject to any Master Services Agreement, Order Form, or other Governing Agreements between Reja and the Client. In the event of any conflict, the Governing Agreements shall prevail. The Client is responsible for ensuring that all Users are aware of and comply with these Terms prior to using the App.

2. License Grant

Subject to compliance with these Terms and the applicable Governing Agreements, Reja grants to each Authorized User a limited, non-exclusive, non-transferable, revocable license to install and use the App on authorized devices solely for the purpose of performing business functions authorized under the Client's subscription. This license does not convey any ownership interest in the App or any underlying intellectual property.

3. Device and Access Requirements

• Users must use devices authorized by the Client and maintain the operating system and App at reasonably current, supported versions as specified in Reja's compatibility documentation;
• The User and the Client organization are jointly responsible for securing all devices on which the App is installed, including but not limited to maintaining PIN, passcode, or biometric screen lock protection;
• Lost, stolen, or compromised devices must be reported immediately to the Client Administrator and, where applicable, to Reja support. Failure to report promptly may result in unauthorized data access for which Reja bears no liability;
• Users must not install or use the App on rooted, jailbroken, or otherwise modified devices, as such devices present unacceptable security risks;
• The Client is responsible for ensuring that all devices used to access the App comply with any applicable mobile device management ("MDM") policies and security requirements.

4. Location Data and Telemetry Processing

The App may collect, process, and transmit location data and device telemetry as follows:

• Where enabled by Client configuration and organizational policy, Global Positioning System (GPS) coordinates, movement data, speed, bearing, and related location signals may be collected for the purposes of route execution, visit verification, geofencing, safety monitoring, and operational analytics;
• Location data collection may occur during both foreground (active use) and background (when the App is running but not in active view) operation, subject to the device operating system's permission model and the User's granted permissions;
• The Client is solely responsible for ensuring compliance with all applicable data protection laws regarding the collection of employee location data, including but not limited to providing adequate notice, obtaining necessary consents, conducting required impact assessments, and establishing a lawful basis for processing;
• Reja processes location data as a data processor on behalf of the Client. Reja does not independently determine the purposes or means of location data processing;
• Users may revoke location permissions through device settings, but doing so may render certain App features inoperable. The Client's organizational policies determine whether location sharing is mandatory for job functions.

5. Offline Data Capture and Synchronization

• The App is designed to operate in areas with limited or intermittent network connectivity. Data captured offline is stored locally on the device in an encrypted queue and synchronized with Reja servers when connectivity is restored;
• Synchronization is subject to automatic retry mechanisms, server-side validation, and conflict resolution rules. The final accepted state of a record on the server may differ from the locally captured version due to conflict resolution, validation failures, or administrative overrides;
• Users must not tamper with, modify, falsify, or manipulate offline data payloads, timestamps, geolocation evidence, sequence numbers, or synchronization metadata. Such tampering constitutes a material breach of these Terms and may result in immediate account suspension;
• Reja is not liable for data loss resulting from device failure, operating system crashes, unauthorized device modifications, or User actions that corrupt the local data store;
• The Client acknowledges that synchronization timing depends on network availability and device state, and Reja does not guarantee real-time data availability for offline-originated records.

6. Field Evidence Collection (Photos, Notes, Signatures, and Forms)

• All media (photographs, videos, audio recordings), notes, form submissions, signatures, and other evidence captured through the App must be directly related to assigned job functions and captured in accordance with the Client's organizational policies;
• Users must not capture, upload, or transmit any content that is unlawful, defamatory, obscene, harassing, threatening, or that infringes upon the rights of any third party;
• The collection of personal data through field evidence (including photographs of individuals, handwritten signatures, or personally identifiable information in forms) must comply with applicable data protection legislation. The Client is responsible for ensuring that appropriate notices and consents are in place;
• Reja may apply metadata (including but not limited to timestamps, GPS coordinates, device identifiers, and user identifiers) to captured evidence for authenticity, audit trail, and compliance purposes;
• Evidence captured through the App may be used by the Client for operational reporting, compliance verification, dispute resolution, and quality assurance purposes.

7. Prohibited Conduct

The following activities are strictly prohibited and constitute material violations of these Terms:

• Reverse-engineering, decompiling, disassembling, or otherwise attempting to derive the source code of the App;
• Using rooted or jailbroken devices, device emulators, virtual machines, or simulation environments to access the App;
• Employing GPS spoofing, location mocking, VPN-based geolocation manipulation, or any other technique to falsify location data;
• Manipulating, falsifying, or fabricating visit completion evidence, task statuses, check-in/check-out records, signatures, stock counts, order records, or any other operational data;
• Running unauthorized automated scripts, bots, or macros against the App;
• Using the App outside of organization-authorized business workflows or for personal purposes;
• Sharing, transferring, or allowing unauthorized individuals to use App credentials or authenticated sessions;
• Attempting to bypass, disable, or circumvent any security control, integrity check, or tamper-detection mechanism embedded in the App;
• Interfering with the App's communication with Reja servers, including intercepting, modifying, or blocking synchronization traffic.

8. Notifications and Communications

The App may deliver push notifications, in-app messages, task reminders, schedule alerts, and operational communications as part of normal service operation. Users may manage device-level notification settings, subject to the Client's organizational policies regarding mandatory notification categories. Reja is not responsible for undelivered notifications resulting from User or device-level notification blocking.

9. Data Retention, Deletion, and Local Storage

Operational data retention periods are determined by the Client's organizational configuration and applicable contractual terms. Local cached data on the device may be purged upon: (a) User logout; (b) account revocation or deprovisioning by a Client Administrator; (c) App reinstallation; (d) workspace or organization reset; or (e) remote wipe initiated by the Client through MDM or Reja administrative controls. Users should not rely on local device storage as a primary or backup data repository.

10. Security, Enforcement, and Incident Response

Reja and Client Administrators may take the following actions without prior notice when suspicious activity, policy violations, or security threats are detected:

• Disable or suspend individual User sessions or accounts;
• Block specific devices from accessing the App;
• Enforce immediate re-authentication or credential reset;
• Remotely clear cached data or revoke local encryption keys;
• Escalate to the Client's designated security contact and, where appropriate, to law enforcement.

The Client is responsible for establishing and communicating internal incident response procedures that include the App and mobile devices within scope.

11. Intellectual Property

All intellectual property rights in the App, including software, algorithms, user interfaces, designs, icons, documentation, and all updates and derivatives thereof, are and shall remain the sole and exclusive property of Reja Technologies Limited. No right, title, or interest in any Reja intellectual property is transferred by these Terms.

12. Disclaimer of Warranties

THE APP IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. REJA DISCLAIMS ALL WARRANTIES INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. MOBILE SERVICE QUALITY, PERFORMANCE, AND AVAILABILITY DEPEND ON FACTORS OUTSIDE REJA'S CONTROL, INCLUDING BUT NOT LIMITED TO DEVICE HARDWARE AND SOFTWARE STATE, OPERATING SYSTEM CONSTRAINTS AND UPDATES, MOBILE NETWORK COVERAGE AND RELIABILITY, GPS SIGNAL AVAILABILITY AND ACCURACY, AND THIRD-PARTY SERVICE DEPENDENCIES. REJA DOES NOT WARRANT THAT THE APP WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPATIBLE WITH ALL DEVICES OR OPERATING SYSTEM VERSIONS.

13. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, REJA SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING FROM OR RELATED TO THE USE OR INABILITY TO USE THE APP. LIABILITY ALLOCATION, CAPS, AND EXCLUSIONS ARE AS DEFINED IN THE GOVERNING AGREEMENTS. WHERE NO GOVERNING AGREEMENTS EXIST, THE APP IS USED ENTIRELY AT THE USER'S AND CLIENT'S OWN RISK.

14. Indemnification

The Client agrees to indemnify, defend, and hold harmless Reja from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising from: (a) any User's violation of these Terms; (b) unlawful collection or processing of personal data through the App; (c) misuse of field evidence or operational data; or (d) the Client's failure to comply with applicable data protection or employment laws in connection with App deployment.

15. Modifications to Terms

Reja reserves the right to update these Terms at any time. Updated Terms may require in-app acknowledgment before continued use. Failure to accept updated Terms may result in restricted or suspended access to the App.

16. Data Collection, Categories, and Processing Purposes

The App collects, processes, and transmits the following categories of data in connection with its operation. The Client, as the data controller, is responsible for ensuring that all Users are informed of this data collection and that an appropriate lawful basis exists under applicable data protection legislation.

16.1 Account and Identity Data

• Full name, employee ID, email address, phone number, and organizational role/title;
• Authentication credentials (hashed passwords, session tokens, multi-factor authentication identifiers);
• User profile photographs (where uploaded by the Client or User).

16.2 Device and Technical Data

• Device manufacturer, model, operating system name and version, App version;
• Unique device identifiers (device ID, advertising ID where applicable);
• Network information (IP address, connection type, carrier name, signal strength);
• Device storage capacity, battery level, and screen resolution;
• Language and locale settings;
• Push notification tokens.

16.3 Location and Movement Data

• GPS coordinates (latitude, longitude, altitude, accuracy);
• Speed, bearing, and movement trajectory;
• Geofence entry and exit events;
• Check-in and check-out location stamps;
• Route data (planned versus actual routes traveled);
• Distance traveled and time spent at locations.

Location data collection frequency and context (foreground, background, or both) are determined by the Client's organizational configuration. Reja processes location data solely as a data processor on behalf of the Client.

16.4 Operational and Task Data

• Task assignments, visit schedules, and route plans;
• Task completion statuses, timestamps, and duration;
• Form submissions, survey responses, and checklist entries;
• Stock counts, inventory records, order details, and pricing data;
• Customer or outlet information (names, addresses, contact details, classifications);
• Notes, comments, and free-text entries recorded during field activities.

16.5 Media and Evidence Data

• Photographs and images captured through the App (with embedded metadata including timestamp and GPS coordinates);
• Digital signatures captured on-device;
• Audio recordings (where the App feature is enabled by Client configuration);
• Document scans and barcode/QR code scan results.

16.6 Usage and Analytics Data

• App usage patterns (screens viewed, features used, session duration, interaction timestamps);
• Synchronization events (sync start/end times, records synced, conflicts detected);
• Error logs, crash reports, and performance diagnostics;
• Offline queue depth and retry event counts.

16.7 Processing Purposes

The data described above is processed for the following purposes:

• Service delivery: enabling task assignment, visit execution, route optimization, data capture, and synchronization;
• Operational monitoring: providing dashboards, reports, and analytics to the Client organization;
• Security and fraud prevention: detecting unauthorized access, location spoofing, data tampering, and policy violations;
• Compliance and audit: maintaining audit trails, evidence integrity, and regulatory compliance records;
• Platform improvement: using aggregated, de-identified data for performance optimization, feature development, and benchmarking (in accordance with the Governing Agreements);
• Support and troubleshooting: diagnosing technical issues, resolving sync conflicts, and providing customer support.

16.8 Data Retention

Operational data is retained for the period specified in the Client's organizational configuration and applicable Governing Agreements. Upon termination, the data return and deletion provisions of the Client Services Agreement apply. Reja may retain anonymized, aggregated data indefinitely for analytical purposes, provided it cannot reasonably be used to identify any individual or Client.

17. Cross-Border Operations and Regional Compliance

Where the App is deployed across multiple African jurisdictions:

• The Client must ensure compliance with data protection, employment, and telecommunications laws in each jurisdiction where the App is used by field personnel;
• Reja processes data in accordance with the applicable data protection legislation in each jurisdiction of operation, including but not limited to: the Kenya Data Protection Act, 2019; the South Africa Protection of Personal Information Act, 2013 (POPIA); the Nigeria Data Protection Act, 2023 (NDPA); the Rwanda Law Relating to the Protection of Personal Data and Privacy, 2021; the Uganda Data Protection and Privacy Act, 2019; the Ghana Data Protection Act, 2012; the Egypt Personal Data Protection Law No. 151 of 2020; and any other applicable legislation;
• Cross-border transfers of data collected through the App shall comply with applicable transfer mechanisms and safeguards required by the originating jurisdiction;
• Where local law requires employee consent, impact assessments, or regulatory filings for GPS tracking or workplace monitoring, the Client is solely responsible for obtaining such consents and completing such filings prior to deploying the App;
• Reja may designate local data protection representatives or compliance contacts as required by applicable regulatory frameworks in each territory of operation.

18. Governing Law

These Terms shall be governed by and construed in accordance with the laws specified in the Governing Agreements. Where no Governing Agreements exist, these Terms shall be governed by the laws of the jurisdiction in which the applicable Reja contracting entity is registered. In the absence of a specific jurisdictional designation, the laws of the Republic of Kenya shall apply, and disputes shall be subject to the exclusive jurisdiction of the courts of Nairobi, Kenya.

19. Severability and Survival

If any provision of these Terms is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. Provisions relating to Intellectual Property, Limitation of Liability, Indemnification, Data Collection and Processing, Cross-Border Compliance, Confidentiality, and Governing Law shall survive any termination of these Terms.

20. Contact

For questions or concerns regarding these Terms, the App, or data processing practices, contact the legal department of the applicable Reja contracting entity in your jurisdiction, or: Reja Technologies Limited — Legal Department, Nairobi, Kenya.