Privacy policy

Who we are

Tulindo is a point-of-sale system for restaurants, bars and shops in Kenya: a back office in the browser, a till, a waiter app, a kitchen display and an owner app. It is run by Tozvo Works Limited, called “we” on this page.

This policy covers the Tulindo website and back office; both Android apps — Tulindo, used at tills, by waiters and on kitchen screens, and Tulindo Manager, used by owners and managers on their own phones; the Windows till, installed on a business’s own computer; and the browser till, which runs a till in Chrome or Edge. It explains what personal data they handle, why, who else sees it, how long it is kept and what you can ask for.

Who is responsible for your data

Kenya’s Data Protection Act, 2019 separates whoever decides why personal data is used, the data controller, from whoever handles it on their behalf, the data processor.

The business you buy from or work for

Is the data controller for its customers’ and staff’s personal data. It decides what to record, and Tulindo keeps it on its behalf. Questions about that data go to the business first.

Tulindo, for that data

Is the data processor. We store and handle it only to run Tulindo for the business, on its instructions, and never use it for our own purposes.

Tulindo, for accounts and billing

Is the data controller for the details of the people who sign a business up and pay for it: their names, e-mail addresses, phone numbers and billing records.

What personal data we handle

Only what running a point of sale needs. Tulindo collects no health, biometric, genetic, racial or religious data, which the Act treats as sensitive.

Business accounts

The owner’s name, e-mail address and phone number; the business’s name, address name and branches; its plan, its invoices and the M-Pesa numbers it pays from.

Staff

Names, e-mail addresses, phone numbers, usernames and roles. Passwords and till PINs are stored only in a scrambled (hashed) form that cannot be turned back into the original, so nobody, us included, can read them.

A business’s customers

Names, phone numbers and e-mail addresses, when the business records them for receipts, tax invoices, loyalty points or account sales; the customer’s KRA PIN when a tax invoice needs one; and which kinds of message they agreed to receive.

Sales and payments

Bills, receipts, refunds and payments, with who served and who paid. For M-Pesa, the paying phone number and the transaction reference. For cards, only the last four digits, the card type and the authorisation code: full card numbers never enter Tulindo.

Devices

When a till, phone, tablet or computer is enrolled to a business: an identifier and a secret token for that device, its name and the branch it serves. When a till registers a USB printer, scale or card machine: its make, model and serial number as the device reports them.

Phone alerts

Tulindo Manager receives a push token from Google Firebase, so it can show alerts such as a short cash count or a failed posting.

Sign-in and activity records

The internet (IP) address and browser of each signed-in session, and an audit log of who changed what, so a business can trace any change. Passwords, PINs and other secrets are never written to it.

Crash reports

When crash reporting is switched on, a technical report of the fault goes to Sentry. Phone numbers, passwords, PINs, tokens and payment secrets are removed before it leaves, and a business is named only by its address name.

What the apps ask your device for

The Android apps, the Windows till and the browser till ask for these permissions and use each only for the reason given.

Camera, in Tulindo Manager

To scan barcodes and take product photos. A photo is kept only when you save it to a product.

Bluetooth, in Tulindo

To connect to receipt printers, cash drawers and barcode scanners.

Location, in Tulindo on Android 11 and earlier

Those versions of Android require it before an app may search for Bluetooth printers. The app never reads where you are.

Notifications, in Tulindo Manager

To show alerts about your business.

USB and serial devices, on the Windows till

To print receipts, open the cash drawer, read weights from scales and work with card machines plugged into the business’s own computer. The till reaches only the printers, scales and card machines registered to the business.

Serial ports, in the browser till

In Chrome or Edge, the browser asks you to choose a scale’s port the first time you press Connect scale (Web Serial, the browser’s way of reaching a device on a serial or USB port). The till reads weights from that port only, and you can withdraw the permission in the browser’s site settings at any time.

No Tulindo app asks for background location, text messages, call logs or access to all your files, and none shows advertising.

Why we use it

• To ring up sales, take payments, print and send receipts, and keep stock and accounts correct.
• To let staff sign in, check what each role may do, and keep each business’s data apart from every other’s.
• To send the receipts, invoices, loyalty codes and other messages a business sends its customers, only on the channels each customer agreed to.
• To run a business’s subscription: its invoices, its M-Pesa payments, and account e-mails such as invitations and password resets.
• To keep Tulindo secure, find and fix faults, and help a business when it asks for support.

Our legal basis

For the data a business keeps in Tulindo, the business chooses the legal basis under the Data Protection Act, 2019: usually carrying out a sale, meeting its legal duties such as keeping tax records, or a customer’s consent to marketing messages. We act only on its instructions, under our agreement with it.

For account and billing data, we rely on our contract with the business, on our own legal duties such as keeping financial records, and on our legitimate interest in keeping Tulindo secure and working.

Who we share it with

We share personal data only with the services below, only what each one needs, and only to run Tulindo. We never sell personal data.

Safaricom, for M-Pesa

The phone number and amount of an M-Pesa payment, to request it and confirm it.

Africa’s Talking, Twilio and Celcom Africa

A customer’s phone number and the message, only when a business connects one of them to send text messages.

E-mail services

Account e-mails, such as invitations and password resets, go through Resend. Receipts and other e-mails to a business’s customers go through the business’s own e-mail service, when it sets one up.

Google Firebase

Tulindo Manager’s push token, to deliver phone alerts.

Sentry

Crash reports with personal details removed, when crash reporting is switched on.

Hosting and storage providers

A cloud hosting provider runs the servers, the database and the backups. A storage provider keeps the files a business uploads.

The authorities

Only when Kenyan law requires it, such as a lawful order from a court or the Data Protection Commissioner.

Product photo search sends only a product’s name, category and details to Anthropic, Brave Search and Openverse, never anything about a person.

How long we keep it

A business’s data is kept while it uses Tulindo. After that, and for the records around it:

A business that leaves

Its account is suspended, then archived 30 days later, and its data is permanently deleted 30 days after that, unless its contract sets a different period.

Backups

Each business is backed up every night. Each backup is kept for 30 days and is gone for good within 37 days of being taken.

Audit log

Records of changes to money, stock, tax, staff access, settings and devices are kept for 7 years. Sign-in records are kept for 24 months, then reduced to counts with no names.

Report downloads

A report file is deleted 30 days after it is made.

Error records

Records of server errors, with personal details removed, are kept for 14 days.

Kenyan tax law requires a business to keep its sales and tax records for five years (Tax Procedures Act, 2015, section 23). Each business is responsible for keeping its own copy for as long as the law asks, including after it leaves Tulindo.

How we protect it

• All traffic to and from Tulindo is encrypted with HTTPS.
• Each business’s data sits in its own separate part of the database, and the database itself refuses to let one business read another’s.
• Passwords and PINs are stored hashed. Connection secrets, such as M-Pesa and text-message keys, are stored encrypted.
• Backups are encrypted where they are stored.
• Staff see and change only what their role allows, and every change is recorded in the audit log.
• Our support staff reach a business’s data only through time-limited access that is recorded, shown to every user of the business while it lasts, and listed on the business’s Support access page.

Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your personal data is used, as this page does;
• see the personal data held about you;
• have wrong or misleading data corrected;
• have data deleted when it is no longer needed or was collected unlawfully;
• object to its use, including for marketing, and withdraw consent you gave;
• receive your data in a form you can take elsewhere.

If you are a customer or a member of staff of a business, ask that business first: it controls your data, and we help it answer. For account and billing data, ask us. If you are not satisfied with the answer, you can complain to the Office of the Data Protection Commissioner, Kenya.

Asking for deletion

Customers and staff: ask the business, which can correct your details or ask us to remove them. Records the law requires the business to keep, such as tax invoices, are kept for that period.

Business owners: to close your business and have its data deleted, write to us from the e-mail address on the account (see Contact us). Its data is then deleted on the timetable under How long we keep it. Removing an app from a phone deletes what is stored on that phone, not the business’s records.

Children

Tulindo is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data about children. If you think a child’s data has been recorded, ask the business or contact us, and it will be removed.

Changes to this policy

When we change this policy we update this page and the date at the top. When a change affects how a business’s data is handled, we tell the business’s owner before it takes effect.

Contact us

For any question about this policy or your personal data, write to Tozvo Works Limited, which runs Tulindo: