01Overview
MaliPOS ("we", "us" or "our"), based in Kampala, Uganda, provides cloud point of sale, inventory, invoicing, installment and mobile apps for businesses (the "Service"). This Privacy Policy explains what personal information we handle, why, and how you can control it.
We aim to comply with the Data Protection and Privacy Act, 2019 of Uganda and its regulations, and with other data protection laws that apply where our customers operate. This policy should be read together with our Terms of Service.
02Our role and yours
- Account information. For information about the businesses that subscribe and the people who use MaliPOS (such as names, emails and login activity), MaliPOS decides how it is used and acts as the data controller.
- Business data. For information a business records about its own customers, staff and suppliers, the business is the data controller and MaliPOS acts as a data processor, handling it only to provide the Service on the business's instructions.
03Information we collect
Information you give us
- Account and business details: business name, email, phone number and address; the names, email addresses, phone numbers and roles of users; and passwords, which we store only in hashed form.
- Business data you enter: products, prices, stock, sales, receipts, invoices, expenses, suppliers, employees, branches and installment plans, including details of your own customers such as names, phone numbers, purchase history, balances and credit information.
- Employee records (HR module): if a business uses our HR features, the details it records about its staff, such as contact details, national ID, TIN and NSSF numbers, job details, attendance and clock-in times, leave requests, salaries, allowances, deductions, bank or mobile money details, payslips and uploaded documents. This information is visible only to the business's authorised users and, for their own records, to the employee.
- Communications: messages you send through our contact form, email or phone, and records of support conversations.
- Subscription and billing details: your plan, billing history and payment references. We do not store full card numbers or mobile money PINs.
Information collected automatically
- Usage and device information: IP address, browser and device type, operating system, pages and features used, and the date and time of each request.
- Security records: sign-in and sign-out times, failed sign-in attempts, and blocked or suspicious requests.
- Audit log: a record of actions taken inside a business account, such as which user created, changed or deleted a record, the before-and-after values, and when. This log is visible to the business's owner and admins.
- Diagnostic logs: technical records of requests and errors that help us keep the Service reliable and fix problems.
- Mobile app data: information the app stores on the device so it can work offline until it synchronises.
04How we use information
- To provide the Service: creating accounts, processing sales, generating receipts, invoices and reports, and synchronising the mobile app.
- To keep accounts and the platform secure, including detecting fraud, blocking abusive traffic and investigating suspicious activity.
- To send service messages, such as welcome emails, security alerts, stock alerts, subscription reminders and important changes to the Service.
- To provide customer support and respond to your requests.
- To maintain backups and restore data after an incident.
- To understand how the Service is used so we can fix problems and improve it.
- To provide the AI assistant when you choose to use it.
- To comply with legal obligations and enforce our Terms.
We do not sell personal information, and we do not use your business data or your customers' information for advertising.
05Legal bases
Depending on the activity, we rely on one or more of the following:
- Contract: to provide the Service you signed up for.
- Legitimate interests: to secure, maintain and improve the Service, provided those interests are not overridden by your rights.
- Consent: where we ask for it, for example for optional communications. You can withdraw consent at any time.
- Legal obligation: where the law requires us to keep or disclose information.
07Your customers' information
If you are a business using MaliPOS, you are responsible for telling your customers, staff and suppliers how you use their information and for having a lawful basis to record it, including obtaining consent where required.
If one of your customers contacts us about their information, we will refer them to you and support you in responding. If you are a customer of a business that uses MaliPOS, please contact that business directly about your information.
08How long we keep data
- Account and business data is kept for as long as the account is active. When an account closes, the business has 30 days to request an export, after which the data is deleted from our active systems.
- Backups are kept on a short rotating schedule for disaster recovery, and older copies are automatically overwritten.
- Audit log entries are kept for up to 12 months and then deleted automatically.
- Diagnostic logs are kept only briefly, usually no more than a few days.
- Records we must keep by law, such as billing records, are kept for the period the law requires.
09How we protect data
We use administrative, technical and organisational measures designed to protect personal information, including:
- encrypted connections (HTTPS) between your browser or app and our servers;
- passwords stored only as one-way hashes;
- separation of each business's data, and role-based permissions within each business;
- monitoring of sign-in attempts and automatic blocking of abusive traffic;
- audit logs that show business owners who did what in their account;
- regular backups and restricted access to production systems.
No system is completely secure. If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities as required by law.
10International transfers
Some of our service providers, including hosting, email and AI providers, may process information outside Uganda. When that happens, we take steps to make sure the information is protected to a standard comparable to Ugandan law, for example through contractual safeguards with those providers.
11Your rights
Subject to the law that applies to you, you have the right to:
- ask whether we hold personal information about you and get a copy of it;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete information, or to restrict or stop processing it;
- object to processing based on our legitimate interests;
- receive your information in a portable format;
- withdraw consent where processing is based on consent.
To exercise these rights, email info@malipos.com. We may need to verify your identity first, and we will respond within the time the law requires. You also have the right to complain to the Personal Data Protection Office of Uganda, or to the data protection authority where you live.
13Children
The Service is designed for businesses and is not directed at children under 18. We do not knowingly collect personal information from children for our own purposes. If you believe a child has given us personal information, contact us and we will delete it.
14Changes to this policy
We may update this policy as the Service or the law changes. If we make material changes, we will notify you by email or in the app before they take effect. The effective date at the top of this page shows when it was last updated.
15Contact us
If you have questions about this policy or how we handle personal information, contact us:
- Email: info@malipos.com
- Phone: +256 779 225 589
- Address: Kampala, Uganda