Privacy notice

1. Who we are

Kit Africa Ltd is a company registered in Uganda with its office in Kampala. We build and run Kit, a business management system (point of sale, stock, accounting, CRM, hotel, restaurant, gym, laundry, projects, HR and payroll, manufacturing, assets, support, Kit Pay and Kit AI). You can reach us at hello@kit.africa or +256 200 900 604.

We process personal data under the Data Protection and Privacy Act, 2019 of Uganda and the Data Protection and Privacy Regulations, 2021, and we intend to register with the Personal Data Protection Office as required. Where a business uses Kit outside Uganda, local law may give you further rights; nothing here reduces them.

2. When we are a controller and when we are a processor

Your business's data. When a business ("the Customer") signs up for Kit and records its sales, stock, customers, suppliers, staff, payroll and bookings, the Customer decides what is collected and why. For that data the Customer is the data controller and Kit is the data processor: we act on the Customer's instructions under our terms of service. If you are a customer, employee or supplier of a business that uses Kit, ask that business about how your data is used; we will help them answer.

Our own data. When you visit kit.africa, create a Kit account, contact us, book a demo, download an app or watch our videos, we decide the purposes, and Kit is the controller. The rest of this notice is mostly about that.

3. The data we collect

• Account data: name, business name, phone number, email address, country, currency, role in the business, password (hashed), sign-in method (including Google sign-in where chosen), language.
• Business records entered by the Customer's users: products, prices, sales, receipts, purchases, stock movements, customers and suppliers (names, phone numbers, TINs, balances), bookings and guests, members, orders, employees (contracts, attendance, leave, salaries, bank and mobile money details for payroll), ledger entries and attached files.
• Tax data: for Ugandan businesses using EFRIS, the invoice details the law requires (TIN, buyer details where given, items, taxes, fiscal document numbers) that we send to and receive from the Uganda Revenue Authority.
• Payment data: for Kit Pay and mobile money, the payer's phone number, amount, reference and status returned by MTN, Airtel or the bank. We never see or store full card numbers.
• Kit AI data: the questions you type or say, the answers, the records Kit AI read to answer (always within your own permissions), your standing instructions and skills, and the token usage recorded against your business's weekly allowance and credits.
• Device and usage data: IP address, device and browser type, app version, till identifier and sync state, pages and screens used, error logs. Kit POS Desktop stores sales locally on the till until they sync.
• Communications: emails, WhatsApp messages, calls and support cases with us, including the screen you were on when you opened a case from inside Kit.
• Website data: kit.africa uses privacy-friendly analytics without cookies (see section 10) and embeds YouTube videos in privacy-enhanced mode, which load only when you press play.

4. Why we use it and on what basis

• To provide the Service to the Customer and its users: performance of a contract.
• To send invoices to URA through EFRIS, keep accounting and payroll records, and answer lawful requests: legal obligation.
• To take payments through Kit Pay and mobile money: performance of a contract.
• To keep the Service secure, prevent fraud and fix faults: legitimate interests.
• To answer your enquiries, run demos and tell existing customers about changes to the Service: legitimate interests, and consent for marketing to anyone who is not yet a customer. You can opt out at any time.
• To improve Kit using aggregated, de-identified usage statistics: legitimate interests. We do not sell personal data, and we do not use the Customer's business records to train artificial intelligence models.

5. Kit AI

Kit AI answers questions about your business by reading records through the same permission rules that apply to your login. It holds no permissions of its own. Your questions and the records needed to answer are sent to our AI model provider for processing and are not used by that provider to train its models under our agreement with it. Kit keeps the conversation so you can return to it; you can delete conversations, and the Customer's administrator can set a retention period. Kit AI is included in every plan with a weekly token allowance; usage is metered, not the content of what you ask.

6. Who we share it with

We share personal data only with people and companies that help us run the Service, and only what they need:

• the Uganda Revenue Authority (EFRIS fiscalisation) where the law requires it;
• mobile money and payment providers (MTN Mobile Money, Airtel Money and partner banks) to complete payments the Customer or its customers initiate;
• our hosting, backup, email delivery, SMS and AI model providers, under written contracts that bind them to confidentiality and to our instructions (a current list is available from support@kit.africa; we will name sub-processors here once contracts are finalised);
• Google, where you choose to sign in with Google or install an app from Google Play; Apple, where you install Kit Business from the App Store;
• professional advisers, auditors and authorities where the law requires, and a buyer if Kit is sold, under the same protections.

7. Where it is stored

Kit is hosted on cloud infrastructure that may be located outside Uganda. Where data leaves Uganda we rely on contracts with our providers that require adequate protection, as the Act allows, and we keep a record of those transfers. Kit POS Desktop keeps a copy of the till's data on the till itself, under the Customer's control.

8. How long we keep it

• Business records: for as long as the Customer's account is active, and then 90 days so the Customer can export them, after which they are deleted from live systems and fall out of backups within a further 90 days. Where tax law requires, fiscal records are kept for the statutory period (currently five years in Uganda) in archived form only.
• Account and billing records: seven years after the account closes, for accounting and tax reasons.
• Support communications: three years after the case closes.
• CVs sent to careers: twelve months.
• Server logs: 90 days. Website analytics: aggregated only, no personal data kept.

9. Your rights

You have the right to know what personal data we hold about you, to receive a copy, to have it corrected or deleted, to object to or restrict processing, to withdraw consent, and to complain to the Personal Data Protection Office of Uganda. Write to support@kit.africa; we answer within 30 days. If your request concerns data held in a Customer's Kit account, we will pass it to that Customer and help them respond.

10. Cookies

kit.africa sets no cookies and shows no cookie banner. Analytics are measured without identifying you. pos.kit.africa and the apps use strictly necessary cookies and local storage to keep you signed in and remember your settings.

11. Children

Kit is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18 except where a Customer records a dependant for HR purposes under its own responsibility.

12. Changes to this notice

We will post changes here with a new version number and date, and email Customer administrators about material changes at least 14 days before they take effect.

13. Contact

Kit Africa Ltd, Kampala, Uganda. Data protection enquiries: support@kit.africa · +256 200 900 604. We will name a data protection officer here once appointed.