Privacy Policy

BongoMart is a business management and point of sale platform for merchants in Tanzania. It records what a business sells, what it holds in stock, what it is owed and what it spends, across a single shop or many branches. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what you can do about it. It applies to the BongoMart web portal and to the BongoMart mobile app. The date shown at the top of this page is the date of this version.

Registered name: to be confirmed

Registration number: to be confirmed

Registered address: to be confirmed

Registration of the operating company is in progress, so the three facts above are marked as not yet confirmed rather than filled in with a guess. Every request under this policy reaches us at the email address in the contact section, which works today.

This policy covers more than one kind of personal data, and the difference matters because our role is not the same for each.

• Your own data as a person who uses BongoMart: the account you sign in with, the devices you sign in from and the record of our dealings with you. For this data we decide how it is handled, and this policy is our account of that.
• The data your business records about its own customers: the names, phone numbers, notes and buying history a merchant enters in order to serve the people who shop with them. For this data your business decides what is collected and why. We hold it and we act on your instructions.
• What we need in order to charge for the service: the plan your business is on, what it has been billed and the record of every change to it.

Where your customers' data is concerned the obligations run in both directions, and they are set out in full in the data protection section of our Terms and Conditions. If you are a customer of a business that uses BongoMart and you want your details changed or removed, ask that business. They hold the controls, and we cannot alter their records without their instruction.

We collect what the service needs in order to work, and the five groups below are the whole of it. Each is grouped by where the data comes from rather than by what we do with it, so that you can tell at a glance which of it you gave us and which of it the app recorded as you worked.

Your account

Your mobile number, which is required and must be unique to you. Your email address, which is optional. Your full name. Your password, which we store only as a one way hash and never in a form that anyone can read. The dates your phone number and your email address were verified. When you last signed in.

Devices and sign-in records

Each time you sign in we record the platform you came from, the app version, a readable label for the device, your browser or app user agent and your IP address. If you turn on notifications we also keep a push token for each device you enable them on, so that a notice can reach that device and no other.

What you record in the app

Your products and their prices, your stock levels and every movement in and out, sales and refunds, orders, purchases and suppliers, expenses, quotations, pay later agreements, your shop details, and the people who work in the business together with the roles and permissions you give them.

Your customers' records, as you enter them

A customer's name, their phone number, your own notes about them, their marketing consent state together with where and when that consent was captured and which member of your staff captured it, how many times they have bought from you, what they have spent in total, when they last bought, and any credit limit you have set for them.

Messages, support and billing

A record of every SMS sent on your behalf, including the recipient's number, the sending status and the delivery report the mobile network returns. Notifications inside the app and the outcome of each channel they were sent on. One time verification codes and when they expire. Any feedback you send us. The ledger of every change to your subscription, with the amounts.

Each group above is used for the purpose it was collected for. The purposes that are not obvious from the data itself are named here, because those are the ones a reader is entitled to ask about.

• To let you sign in, to keep your session alive, and to let you back in when you forget your password.
• To run the service you are paying for: to show you your figures, print your receipts, send your orders and keep your books.
• To bill you correctly. The delivery reports the mobile network returns are used to work out how many message segments were actually delivered, so that your SMS credit is charged for what went out rather than for what was attempted.
• To keep your account secure and to look into abuse. The sign-in records are what make a list of the devices you are signed in on possible at all, and they are what we read when an account looks as though someone else has reached it.
• To keep an audit trail of who changed what inside a business, so that a disagreement between an owner and a member of staff can be settled by reading the record rather than by argument.
• To answer you when you write to us, and to tell you about your account, your subscription and anything that affects your money.

We do not use your data, or your customers' data, to train machine learning models. The customer segments and campaign tools inside the app do group your customers, but they do it for you, on your instruction and within your own business only. No customer list and no segment ever crosses from one business to another.

We handle personal data under the Personal Data Protection Act, 2022 of the United Republic of Tanzania. The lawful bases we rely on are these.

• Your consent, where you have given it. You can withdraw it, and the contact section says how.
• Performance of our contract with you, which covers almost everything the app does. We cannot run a point of sale for you without holding what you sell and who you sold it to.
• Our legitimate interests in keeping the service secure, in preventing abuse of it, and in billing accurately for what was used.
• Compliance with a legal obligation, where the law requires us to keep a record or to produce one.

If you want to know which of those bases applies to a particular thing the app does, write to us at the address in the contact section and we will tell you.

The records your business keeps about its own customers are yours to decide about. You choose what you collect, why you collect it and how long you keep it. We hold that data for you, we handle it in order to provide the service, and we act on your instructions.

That split carries obligations for you as well as for us, and they are set out in the data protection section of our Terms and Conditions: a lawful basis for every customer record you enter, consent in hand before any marketing message goes out, and an answer for your customer when they ask what you hold about them. The app gives you the controls you need in order to keep those promises, including one that erases a customer's personal details while leaving your own sales history intact.

We share personal data with the providers listed below, only for the purpose named against each one, and only to the extent that one needs. Each acts for us as a processor rather than as an independent recipient free to use the data for its own ends.

Beem Africa

Sends the SMS your business sends. It receives the recipient's phone number and the text of the message, and it returns a delivery report.

Resend

Sends our transactional email, such as a verification link or a document you asked us to email out. It receives the recipient's email address and the message.

Flutterwave

Takes payment when you pay for a subscription. Your payment details go to it directly, and we do not store your card number.

Expo, which hands off to Google FCM or Apple APNs

Delivers push notifications to your phone. It receives the push token for your device and the text of the notice. Expo's push service fronts both Google's Android service and Apple's iOS service, so one of those two carries the last leg.

Google Cloud Platform

Hosts the service: the application, the database, and the files your business uploads, such as product photographs and your logo.

Komoot Photon

Suggests addresses while you are typing a shop location. It receives the place text you type and nothing else about you.

One name a careful reader may find in our code is not in that list, and it belongs here as a correction rather than as an omission. Pesapal payment handling exists in our code as scaffolding only. It is switched off by configuration, no payment has been routed through it, and it receives nothing.

We do not sell your data. We do not sell your customers' data. We do not share either with advertisers or with data brokers, and we never pass one business's customer list to another. We will disclose data to a court, a regulator or a law enforcement agency only where we are legally required to, and where we are permitted to tell you that we have, we will.

Your data is stored and processed in Google Cloud's africa-south1 region, which is in Johannesburg, South Africa. That is outside the United Republic of Tanzania, so using BongoMart involves a transfer of personal data out of the country. Several of the providers named in the previous section also operate from outside Tanzania.

The Personal Data Protection Act, 2022 regulates transfers of this kind, and we would rather be exact about what protects your data than reassuring about it. What protects it is a written agreement with each provider limiting what it may do with the data, the technical measures described in the security section below, and the fact that each provider receives only the narrow slice its job needs.

We make no claim to any approval, certification or adequacy decision that we do not hold. If that position changes, this section is where the change will appear.

While your business is active we keep its records, because the records are the service. A sale from two years ago is in your books, and the app has to be able to show it to you.

An owner can schedule a single shop, or the whole business, for deletion from inside the app, under business settings. The business keeps working for 30 days, and the owner can cancel at any point in that window. After 30 days a daily sweep deletes every record the business owns and every file it uploaded, including product photographs and your logo.

An owner can also end one person's access to the business, and what that does depends on where that person's own account lives. If their account belongs to another business and they were working in yours as a guest, their permissions here and their link to your business are both removed, and their own account is left alone because it is not ours to switch off. If the person's account belongs to your business, their sign-in is switched off and their record stays, because your own history refers to it: the sales they rang up, the stock they counted and the audit entries naming them would otherwise point at nothing.

There is no single control in the app that removes one person's account on its own, and we would rather say so plainly than imply that one exists. Every account belongs to a business, and one person can be reached from more than one business, so such a control would have to decide something it is not in a position to decide. If you want your personal account removed, write to us at the address in the contact section and we will do it by hand.

Some records are deliberately kept after a business has been deleted. There are three of them. They are named here rather than hidden behind a general phrase, and two of the three contain personal data.

The subscription ledger

Every change to a subscription, with the amount and the name of the person who made it. It is append only and it is kept as our financial record. It never had a database link to your business, so there is no link to remove.

The audit trail

Who did what and when, with the actor's name, their user identifier and the IP address the action came from. It is append only, so rows in it are never updated or deleted, and a shop reference inside it is blanked when the shop goes. It is kept so that a later dispute about an action inside a business can be settled.

The SMS send log

Each message we sent, including the number it was sent to, how many segments it used and what the network reported back. The link to your business is removed when the business is purged, but the row stays, as billing evidence and as proof of what was and was not delivered.

We do not promise an end date for those three, because we do not enforce one today. They are retained indefinitely, and telling you that is more use to you than naming a period we would not keep to. If we do start enforcing one, this is the section that will say so.

Your own customers are a separate matter, and the control is yours. From inside the app you can erase a customer's name, phone number, notes and tags, which replaces those details rather than merely hiding them. The sale history and the running totals stay, because those are your books. One honest caveat: the SMS send log described above still holds the number any message was sent to, so erasing a customer inside the app does not reach it. The control is also unavailable while that customer has an unsettled Pay Later sale, because the debt is still owed to you and the record of who owes it has to survive until it is settled or cancelled.

Under the Personal Data Protection Act, 2022 you have the rights set out below over your own personal data, and several of them you can exercise yourself without asking us for anything.

• To know what we hold about you and to be given a copy of it. A good deal of it is already on your screen: your profile, your shops, your staff list and the devices you are signed in on.
• To have it corrected. Your name, your email address and your phone number are all editable in the app.
• To have it erased, within the limits that the retention section above describes and explains.
• To object to a particular use we make of it.
• To ask us to restrict what we do with it while a question about it is open.
• To withdraw a consent you gave. Withdrawal takes effect from the moment you withdraw it and does not undo what was lawfully done before.
• To complain to the Personal Data Protection Commission of Tanzania. You do not have to come to us first.

For anything that is not already self service, write to us at the address in the contact section. We will acknowledge your request within 7 days and answer it within 30 days. If it is a request we are not able to act on, for example a demand to delete a record that another business controls, we will tell you so and tell you who can.

Security is a practice rather than a promise, so this section says what is actually in place rather than how seriously we take it.

• Your password is stored only as a hash. Nobody here can read it, and a support request asking us to read it back to you will be refused because it cannot be met.
• Traffic between your device and our servers travels over HTTPS.
• What a person can see and do inside a business is limited by the role and the permissions the owner gave them, and that limit is enforced on the server rather than merely hidden on the screen.
• Changes inside a business are written to an audit trail that is only ever added to. No part of the app updates or deletes a row in it.
• Signing out or changing your password invalidates every session that was already open, so a device you have lost stops being signed in.

No system is perfectly secure, and we are not going to tell you ours is. If you think someone else has reached your account, change your password, which ends every other session, and then write to us.

BongoMart is for registered businesses and the people who work in them. It is not directed at children, we do not knowingly collect a child's personal data, and there is no feature in it aimed at anyone under eighteen. If you believe a child's data has reached us through an account, write to us and we will remove it.

We send you messages about the service, and you have a say over most of them.

• Messages you can switch off: product news, tips and other notices that are not about your account. Your preference is recorded for each kind of message separately, and it is yours rather than the whole business's.
• Messages that always send: anything about the security of your account, about your subscription, about your money, or about a change to this policy. We send those because you need them, and letting them be switched off would make the service less safe to use.
• Messages your own business sends to its customers, which are a different thing altogether. Those go out on your instruction, are charged against your credit, and rest on the consent you hold.

Whether a notice reaches you by email, by SMS or by push rather than only inside the app depends on the plan your business is on, not on this policy.

We change this policy when the service changes or when the law does. The date at the top of this page is the date of the version you are reading, and it is set by hand when the words change rather than generated from the clock, so it tells you something true.

Where a change materially affects you we will tell you through the channels described in the previous section before it takes effect rather than after. Using the service after a change has taken effect means the new version applies to you, and if you would rather it did not, the deletion route in the retention section is open to you.

Write to us about anything in this policy, including a request to exercise one of the rights above. The email address below is monitored today; the other three are shown as not yet confirmed rather than invented.

Email: support@bongomarts.com

Data protection contact: to be confirmed

Telephone: to be confirmed

Postal address: to be confirmed

This policy is published in English and in Swahili, and the two versions are meant to say the same thing. If they disagree, the English version governs.