Privacy Policy

Tawala is a Business Management System operated by Nethub (“Nethub”, “we”, “us”, or “our”), a company registered in Kenya. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use the Tawala platform and related services (the “Service”).

This Policy is issued in accordance with the Data Protection Act, 2019 of Kenya and other applicable laws.

1. Who We Are

Legal Entity: Nethub

Product: Tawala Business Management System

For the purposes of the Data Protection Act, 2019:

Nethub acts as a Data Controller for account data, billing data, platform analytics, service improvement, and aggregated business insights.
Nethub acts as a Data Processor when processing Customer Data purely to deliver the core Service on behalf of our customers.

Email: privacy@nethub.co.ke

Website: https://nethub.co.ke

Physical Address: [Insert your registered Kenyan address]

2. Data We Collect

2.1 Account & Identity Data

Full name
Email address
Phone number
Business name and details
Password (stored hashed)
Staff PINs (stored hashed and salted)

2.2 Business & Operational Data (Customer Data)

Sales and transaction records
Invoices and receipts
Product, service, and inventory data
Customer records (names, phone numbers, emails)
Staff records
Expense records
Business settings and configurations

2.3 Technical & Usage Data

IP address
Device and browser information
Log data and activity timestamps
Approximate location (derived from IP)

2.4 Payment Data

M-Pesa and other payment references
We do not store full card details

3. How We Use Your Data

3.1 Core Service Delivery

Providing, maintaining, and supporting the Tawala platform
Account creation, authentication, and access management
Billing and subscription management
Customer support

3.2 Service Improvement & Artificial Intelligence

We may use Customer Data (including transaction and usage data) to:

Operate, analyse, and improve the Tawala platform
Train and improve our machine learning and artificial intelligence models
Develop new features and enhance performance, security, and usability

3.3 Aggregated and Anonymised Insights

We may create aggregated, anonymised, or de-identified datasets. Once data can no longer reasonably identify an individual or a specific business, we may use it for:

Analytics and benchmarking
Research and product development
Business development purposes

3.4 Relevant Business Opportunities

We may use aggregated or anonymised sales and category insights to identify potential supply opportunities and present relevant offers from wholesalers, distributors, or other business partners to our customers.

We do not sell Personal Identifiable Information (PII).
We do not share PII with third parties for their independent marketing without a lawful basis.

3.5 Legal Bases (Kenya Data Protection Act, 2019)

Performance of a contract
Legitimate interests (service improvement, security, aggregated insights, and relevant business opportunities)
Legal obligation
Consent (where required)

5. Cross-Border Data Transfers

Your data is primarily processed in Kenya or in jurisdictions with adequate protection. Where data is transferred outside Kenya, we apply appropriate safeguards in accordance with the Data Protection Act, 2019.

6. Data Retention

Active account data: retained for the life of the account
After termination: available for export for 30 days, then deleted or anonymised
Financial and transaction records: retained as required by Kenyan tax and commercial laws
Aggregated/anonymised data: may be retained indefinitely

7. Your Rights

Under the Data Protection Act, 2019, you have the right to:

Access your personal data
Request correction of inaccurate data
Request deletion (subject to legal retention requirements)
Object to certain processing
Request restriction of processing
Data portability
Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@nethub.co.ke.

You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

8. Security

We implement appropriate technical and organisational measures, including encryption in transit, hashed credentials, role-based access control, audit logging, and regular security reviews.

9. Cookies

We use essential cookies for authentication and session management, and limited analytics cookies to improve the Service.

10. Children’s Privacy

The Service is not directed at individuals under 18 years of age.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email or through the Service.

12. Contact