Service Level Agreement

This Service Level Agreement ("SLA") sets out the service commitments made by Istinara for Multi-Activities and Technology Limited ("Bravo", "we", "us", "our"), a company registered in the Republic of the Sudan under the Companies Act 1925 with Commercial Registration Number 35771, and licensed by the Central Bank of Sudan ("CBOS") as an electronic wallet provider under Licence No. 2025/FIMP/1, to registered users ("Customer", "you") of the Bravo mobile wallet application ("Service").

This SLA supplements, and does not replace, the Bravo Terms and Conditions and Privacy Policy, and is issued in support of Bravo's obligations under the CBOS regulatory framework applicable to licensed electronic wallet providers.

This SLA covers the Bravo mobile wallet Service, including:

• Account access and authentication;
• Wallet-to-wallet transfers;
• Cash-in and cash-out operations;
• Bill payment and merchant payment functions;
• Transaction history and account statements;
• Customer support channels operated by Bravo.

This SLA does not cover services provided by third parties (mobile network operators, banks, merchants, agents, billers, or the national payment switch) or issues arising from the Customer's own device, connectivity, or actions.

• Availability — the percentage of time in a calendar month during which the Service is accessible and able to process transactions, excluding Scheduled Maintenance and the Exclusions defined in Section 11.
• Business Day — Sunday through Thursday, 09:00–17:00 Sudan Standard Time, excluding public holidays observed in the Republic of the Sudan.
• Downstream System — any third-party system on which the completion of a Bravo transaction depends, including EBS, partner banks' core banking systems, mobile network operators, biller aggregators, agent networks, and the national payment switch.
• Incident — any unplanned event that disrupts or reduces the quality of the Service.
• MFA — multi-factor authentication requiring the Customer to present two or more independent credentials.
• Provisional Debit — a hold or debit placed on a Customer's wallet balance while a transaction is pending downstream confirmation.
• Recovery Time Objective (RTO) — the maximum time within which Bravo commits to restore the Service after a critical incident involving system failure or data loss.
• Response Time — the time between our receipt of a Customer request or Incident report through an official support channel and our first substantive reply to the Customer.
• Resolution Time — the time between our receipt of a report and the restoration of Service or closure of the request.
• Service Credit — an amount credited to a Customer's Bravo wallet in accordance with Section 16 as a remedy for a failure by Bravo to meet a stated SLA commitment.
• Unauthorized Transaction — a transaction executed on a Customer's account that the Customer did not authorize and did not benefit from.

4.1 Platform Availability

Bravo commits to a monthly Service Availability of 99.9%, measured on a calendar-month basis. Availability is calculated as follows:

Availability (%) = (Total minutes in month − Unplanned Downtime minutes) ÷ (Total minutes in month − Scheduled Maintenance minutes) × 100

4.2 Platform Transaction Processing

Bravo commits to the following platform processing times, measured from the moment a valid, authenticated request is received by the Bravo platform to the moment Bravo dispatches the request to the relevant Downstream System and returns an acknowledgment to the Customer:

In addition to the per-type commitments above, Bravo commits to an aggregate transaction performance target: 95% of all transactions submitted to the Bravo platform are processed within 2 seconds, measured on a rolling monthly basis.

4.3 End-to-End Completion

End-to-end transaction completion — including confirmation from Downstream Systems — is not solely within Bravo's control and is therefore not committed under this SLA. Under normal operating conditions, most transactions complete within 10 to 60 seconds depending on transaction type and destination.

4.4 Downstream Failure Handling

Where a transaction cannot be completed within 60 seconds due to a Downstream System delay or failure, Bravo commits to:

• Notify the Customer of the delay through the application;
• Automatically reverse any Provisional Debit within 24 hours if the transaction has not completed;
• Provide the Customer with a transaction reference for follow-up through the channels in Section 6.1.

4.5 Measurement

Compliance with Sections 4.1 and 4.2 is measured against Bravo's internal platform logs. Delays attributable to Customer device performance, network connectivity, or third-party systems listed in Section 11 are excluded from measurement.

4.6 Business Continuity

Bravo operates geo-redundant infrastructure across multiple data centres, with automatic failover to backup systems in the event of primary system failure. For critical incidents involving system failure or data loss, Bravo commits to a Recovery Time Objective (RTO) of 2 hours.

Bravo commits to the following security measures for the protection of Customer accounts, funds, and data:

• Encryption — all Customer data is encrypted in transit (TLS 1.2 or higher) and at rest using AES-256 or an equivalent strong cipher. Sensitive data at rest is additionally protected using strong cryptographic hashing functions where applicable.
• Authentication — access to the Service requires a Customer PIN. MFA is required for account login on new devices, for high-value transactions exceeding the threshold defined in Bravo's Fraud and Risk Management Policy, and for changes to core account settings.
• Device binding — accounts are bound to registered devices; access from a new device requires re-verification.
• Session management — inactive sessions are terminated automatically after a defined period.
• Threat monitoring — transactions and platform activity are monitored 24 hours a day, 7 days a week, by automated systems designed to detect and block suspicious activity and platform vulnerabilities.
• Regulatory compliance — Bravo maintains security controls consistent with CBOS requirements applicable to licensed electronic wallet providers.

6.1 Support Channels

• Short code — 6902 (24 hours a day, 7 days a week)
• Call centre — +249 187 199 304 (24 hours a day, 7 days a week)
• In-app chat — available 24 hours a day, 7 days a week
• Email — info@bravo-sudan.com — monitored during Business Days
• Website — https://bravo-sudan.com
• Social media — official Bravo channels, monitored during Business Days

6.2 Incident Severity, Response and Resolution

Response and Resolution Times are measured from the moment we receive the report through an official support channel listed in Section 6.1.

7.1 Reporting

Customers must report any suspected Unauthorized Transaction to Bravo as soon as reasonably possible, and in any event within 60 calendar days of the transaction appearing in the Customer's transaction history. Reports may be made through any support channel in Section 6.1; the fastest channels are 6902 and the 24/7 call centre.

7.2 Immediate Protective Action

Upon receipt of a credible report of unauthorized activity, Bravo will, within 30 minutes:

• Suspend further transactions on the affected account;
• Block the device or session identified as the source, where possible;
• Register a formal fraud case with a unique reference number and provide it to the Customer.

7.3 Investigation and Provisional Credit

7.4 Customer Cooperation

Customers agree to cooperate with the investigation by providing requested information (transaction details, device information, incident description) and, where appropriate, filing a report with the relevant authorities. Delays caused by the Customer's failure to provide requested information are excluded from the timelines above.

Where a transaction fails, is duplicated, or is otherwise processed incorrectly and is not the subject of a fraud investigation under Section 7, Bravo will process reversals and refunds according to the following timelines:

9.1 Planned Maintenance

Planned maintenance is scheduled during low-traffic hours, typically 02:00–05:00 Sudan Standard Time. Advance notice is provided as follows:

9.2 Emergency Maintenance

Where urgent action is required to protect the Service, Customer funds, or Customer data, emergency maintenance may be performed with shorter or no advance notice. In such cases, Bravo provides notification as soon as practicable and issues a post-incident summary within 5 Business Days.

9.3 Incident Notifications

For unplanned outages affecting a significant portion of Customers, Bravo publishes:

• Initial notification within 30 minutes of detection;
• Status updates at least every 60 minutes until resolution;
• A post-incident summary within 5 Business Days.

• Transaction history — available in the application in real time and retained for a minimum of 12 months.
• Statement generation — Customers may generate an account statement in the application for any period within the retention window; standard statements are available immediately.
• Data export on request — where a Customer requests a copy of their personal data or transaction history under applicable data protection rights, Bravo will provide the export within 10 Business Days of receiving a verified request.

The commitments in this SLA do not apply where Service disruption, delay, or failure is caused by:

• Force majeure events (natural disasters, war, civil unrest, government action, pandemic, or regulatory change);
• Downstream System delays, degradation, or outages, including but not limited to EBS and the national payment switch, partner banks' core banking systems, mobile network operators (Zain, MTN, Sudani, and others), biller and aggregator systems, agent networks, and SMS gateway providers;
• Failures in internet or telecommunications services outside Bravo's reasonable control;
• Customer actions or omissions (incorrect credentials, sharing of PIN or OTP, use on unsupported devices, insufficient device storage or connectivity, or use of jailbroken or rooted devices);
• Scheduled maintenance conducted in accordance with Section 9;
• Suspension of a Customer account for suspected fraud, sanctions screening, AML review, or breach of the Terms and Conditions;
• Beta features or services explicitly labelled as such.

Bravo publishes real-time and historical performance information so that Customers can independently verify the Service:

• Public status page — Bravo maintains a public status page showing current platform availability, ongoing incidents, and recent uptime history.
• In-app dashboards — Customers can view their transaction history, average processing times, and account activity in real time within the application.
• Monthly performance summary — Bravo publishes a monthly summary of key performance indicators (availability, average transaction processing time, incident count, and resolution times) via the application and, on request, by email.
• Incident post-mortems — for significant incidents, a public post-incident summary is published within 5 Business Days.

13.1 How to Raise a Dispute

Customers may raise a dispute through any support channel listed in Section 6.1, or in writing to info@bravo-sudan.com. Each dispute is assigned a unique reference number that is provided to the Customer.

13.2 Dispute Handling Timelines

13.3 Internal Escalation

If a Customer is not satisfied with the outcome, the matter may be escalated to Bravo's Customer Experience Manager. Escalated disputes receive a final written response within 10 Business Days.

13.4 Regulatory Escalation

Where a Customer remains dissatisfied after exhausting Bravo's internal escalation process, the Customer has the right to escalate the complaint to the Consumer Protection Directorate of the Central Bank of Sudan. Contact details for the CBOS complaints channel are published by CBOS on its official website. Bravo will cooperate fully with any CBOS enquiry into a Customer complaint. Nothing in this SLA limits or excludes any right of the Customer to escalate a complaint to CBOS or to any other competent authority.

To enable Bravo to meet these commitments, Customers agree to:

• Keep their registered mobile number and email address up to date;
• Protect their PIN, password, and OTP codes and never share them, including with persons claiming to be Bravo staff;
• Use a supported version of the Bravo mobile application on a supported device;
• Report suspected unauthorized activity immediately through an official channel;
• Provide accurate information when raising disputes or support requests;
• Cooperate with security, fraud, and AML enquiries where reasonably requested.

Bravo commissions an independent third-party audit of platform performance, security controls, and adherence to this SLA at least once per calendar year. A summary of audit findings relevant to Customer service commitments is made available to Customers upon reasonable written request and to CBOS as required under Bravo's licence obligations.

16.1 Entitlement

Where Bravo fails to meet a service commitment stated in Sections 4, 6, 7, 8, or 9, and the failure is not attributable to an Exclusion in Section 11, the affected Customer is entitled to claim a Service Credit. Service Credits are applied directly to the Customer's Bravo wallet balance.

16.2 Calculation

The amount of a Service Credit is determined by the type and severity of the SLA breach in accordance with the Bravo Service Credit Schedule, which is maintained on the Bravo website and updated from time to time. Service Credits are the Customer's sole and exclusive monetary remedy under this SLA and are without prejudice to any other Customer right under the Terms and Conditions, CBOS regulations, or applicable law.

16.3 Claim Procedure

• Claim window — Customers must submit Service Credit claims within 60 calendar days of the incident giving rise to the claim.
• Submission — claims may be submitted through any support channel in Section 6.1, quoting the relevant transaction or incident reference.
• Processing — Bravo will assess and process valid claims, and apply any Service Credit due, within 10 Business Days of receipt of a complete claim.

This SLA is governed by the laws of the Republic of the Sudan and by the applicable regulations issued by the Central Bank of Sudan. Any dispute arising in connection with this SLA that is not resolved through the procedures in Section 13 shall be subject to the exclusive jurisdiction of the competent courts of Khartoum, without prejudice to the Customer's right to escalate a complaint to CBOS or to any other competent authority.

This SLA is issued in English and is the operative version. Bravo may publish an Arabic translation for the convenience of Customers; upon publication of the Arabic translation, the Arabic version shall prevail in the event of any conflict or inconsistency between the two versions.

Bravo formally reviews this SLA at least every six months to ensure it remains aligned with industry standards, CBOS regulatory requirements, and Customer needs. Bravo may update this SLA from time to time following such review or as required by regulatory or operational developments. Material changes are communicated to Customers with at least 30 days' advance notice through the notification channels listed in Section 9.1. Continued use of the Service after the effective date of a change constitutes acceptance of the updated SLA.

If any provision of this SLA is held to be invalid or unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions shall continue in full force and effect. This SLA, together with the Bravo Terms and Conditions and Privacy Policy, constitutes the entire agreement between Bravo and the Customer with respect to the service commitments described herein.

This Service Level Agreement is issued and approved by the undersigned officers of Istinara for Multi-Activities and Technology Limited.