Preamble: Scope, Corporate Structure & Regulatory Baseline
This Privacy Policy (this "Policy") explains how Kolect Technologies("Kolect", "we", "us", or "our") collects, processes, stores, transfers, and protects Personal Data across our multi-tenant business management platform, dual-balance accounting ledger, point-of-sale (POS) checkout, inventory management, billing, fulfillment tracking, and customer self-service applications (collectively, the "Services").
All data protection commitments, controller-processor governance frameworks, and privacy obligations established under this Policy apply to Kolect Technologies and shall automatically bind and inure to the benefit of any corporate parent, subsidiary, regional affiliate, or successor corporate entity established or designated by Kolect to operate the Services, without requiring separate contractual novation.
Dual Statutory Regulatory Baseline: Kolect provides cloud software on a cross-border basis and adheres to two primary statutory data protection frameworks:
- In Nigeria: The Nigeria Data Protection Act 2023 (NDPA), regulated and enforced by the Nigeria Data Protection Commission (NDPC), governing operations, workspaces, and Data Subjects within the Federal Republic of Nigeria.
- In Kenya: The Kenya Data Protection Act, 2019 (DPA 2019) and its subsidiary regulations, regulated and enforced by the Office of the Data Protection Commissioner (ODPC), governing operations, workspaces, and Data Subjects within the Republic of Kenya.
Section 1. Statutory & Platform Privacy Definitions
- "Personal Data" (or "PII"): Any information relating to an identified or identifiable natural person.
- "Data Subject": Any identified or identifiable natural person whose Personal Data is processed through the Services, including Workspace Owners, Managers, Staff, Logistics Personnel, retail customers, debtors, students, parents or guardians, and property tenants.
- "Data Controller": A natural or legal person, public authority, educational institution, business, or organization that alone or jointly determines the purposes and means of processing Personal Data.
- "Data Processor": A natural or legal person or organization that processes Personal Data on behalf of and in accordance with the instructions of a Data Controller.
- "Workspace" (or "Space"): A logically isolated organizational environment created within the Services by a subscribing business, school, or property management entity.
- "Service Data": All financial records, transaction entries, invoices, receipts, customer profiles, student rosters, tenant ledgers, communications, and associated metadata uploaded, created, or processed within a Workspace.
- "Dual-Balance Ledger": Kolect's accounting structure that maintains two separate balance accounts for each customer record: a Receivables Balance (amounts owed by the customer to the Workspace Owner) and a Store Credit Balance (prepayments, overpayments, or store credits owed by the Workspace Owner to the customer).
- "Workspace Roles": Kolect's five-tier role-based access control framework comprising: Workspace Owner, Workspace Manager, Workspace Staff, Logistics Personnel, and Customer Portal User (Kolect Personal).
- "Fulfillment Lifecycle": The seven-stage physical order and service tracking workflow: Unissued, Under Verification, Packaging, In Transit, Delivered, Accepted, and Cancelled.
Section 2. Data Protection Roles & Responsibilities
2.1 Kolect as a Data Controller
- Account registration details and identity verification records of Workspace Owners.
- Subscription billing records, payment method tokens, and platform invoicing data.
- Platform security telemetry, access control logs, and fraud prevention metrics.
- Sanitized diagnostic telemetry and infrastructure performance records.
2.2 Kolect as a Data Processor
Kolect acts strictly as a Data Processor with respect to all Service Data uploaded into a Workspace (customer directories, debtor balances, student rosters, parent contacts, tenant ledgers).
The Workspace Owner acts as statutory Data Controller and holds primary legal responsibility for establishing a valid lawful basis under Section 25 of the NDPA and Section 30 of the Kenya DPA.
2.3 Workspace Owner Responsibility for Authorized Personnel: The Workspace Owner is legally and financially responsible for configuring appropriate role permissions and ensuring that all Managers, Staff, and Logistics Personnel invited into their Workspace comply with applicable data protection laws.
Section 3. Dual-Balance Ledger & Financial Data Privacy
3.1 Separation of Receivables and Store Credits. For each customer profile within a Workspace, the Dual-Balance Ledger tracks two distinct monetary values: the Receivables Balance and the Store Credit Balance.
Customer Store Credit Balances recorded within Kolect represent solely internal merchant store credit, advance prepayments, or unallocated overpayments owed directly by the respective Workspace Owner to their customer. Kolect is a software provider—not a bank, deposit-taking institution, or electronic money issuer—and does not custody, hold, or control underlying customer funds. All monetary funds remain under the exclusive control and liability of the Workspace Owner.
3.2 Refund & Adjustment Audit Trail. Whenever a store credit adjustment or refund payout is recorded within a Workspace, the platform logs the customer identifier, transaction value, authorizing staff member identifier, timestamp, and resulting balance adjustment within an append-only operational audit trail.
Section 4. Industry-Specific Privacy Protections
In accordance with the statutory principle of data minimization, point-of-sale checkouts processed as anonymous walk-in counter transactions do not require or collect customer Personal Data (no customer name, telephone number, email address, or physical address is recorded).
Pursuant to Section 31 of the Nigeria Data Protection Act 2023 and Section 33 of the Kenya Data Protection Act 2019, the educational institution (as Data Controller) warrants that it has obtained and documented verifiable consent from each minor student's parent or legal guardian prior to uploading student identifiers or fee records into the Services.
Strict Purpose Limitation: Student rosters, academic identifiers, and guardian contact records are processed exclusively for institutional fee administration, billing transparency, and authorized school-to-parent communications. Kolect never uses minor student data for behavioral profiling, advertising, commercial marketing, or third-party credit scoring.
Tenant contact details, unit identifiers, lease references, and utility or service charge ledgers are processed strictly as property administration records under the instructions of the property manager or estate association acting as Data Controller.
Section 5. Role-Based Access Controls & Multi-Tenant Isolation
Kolect enforces logical multi-tenant isolation and role-based access controls designed to restrict Personal Data visibility strictly to authorized personnel:
- Workspace Owner: Full administrative access to Workspace configuration, subscription billing instruments, member permissions, financial ledgers, and complete activity history.
- Workspace Manager: Operational access to catalog inventory, customer directories, and receivables ledgers, without access to subscription payment instruments or Workspace deletion controls.
- Workspace Staff: Point-of-sale checkout, invoice generation, and payment recording access, without visibility into organizational profit margins, subscription settings, or administrative audit logs.
- Logistics Personnel: Access limited to physical inventory counts, warehouse intake, and fulfillment dispatch queues, without visibility into customer debt balances, financial ledgers, or organizational revenue.
- Customer Portal User (Kolect Personal): Self-service access for customers, parents, and tenants restricted exclusively to their own statements, payment receipts, transaction history, and delivery confirmations (Delivered to Accepted). Customer Portal Users have no visibility into other customers' records or internal Workspace operations.
Section 6. Physical Goods Fulfillment Tracking
To protect both merchants and buyers against delivery disputes or lost-parcel claims, Kolect tracks physical order fulfillment across seven operational stages (Unissued, Under Verification, Packaging, In Transit, Delivered, Accepted, and Cancelled). Fulfillment audit records capture the designated recipient's name, status transition timestamps, handling staff identifiers, and digital delivery confirmation records.
Section 7. Categories of Personal Data Collected
7.1 Workspace Account & Registration Data
Full name, business or institutional name, corporate or statutory registration numbers (such as CAC registration in Nigeria or BRS registration in Kenya), email address, telephone number, authentication credentials, and assigned Workspace Role.
7.2 Workspace Service Data
Customer, debtor, student, parent, and tenant records (names, telephone numbers, email addresses, physical or unit addresses); product and service catalogs; invoices, receipts, checkout line items, discounts, and ledger balance histories; and in-platform transaction messages.
7.3 Subscription & Payment Metadata
Tokenized payment gateway references, card brand, expiration month and year, billing currency (including NGN, KES, or USD), subscription invoice records, and bank transfer confirmation references. Full payment card numbers (PAN) and security codes (CVV) are transmitted directly to PCI-DSS compliant payment processors and are never stored on Kolect servers.
7.4 Technical Telemetry & Sanitized Diagnostic Logs
IP addresses, device hardware models, operating system versions, application version identifiers, network status, and request latency metrics. Crash reports and exception logs collected for platform reliability are processed through automated filtering routines designed to redact customer names, ledger balances, and financial PII prior to storage.
Section 8. Lawful Bases for Processing (NDPA 2023 & Kenya DPA 2019)
| Processing Activity | Categories of Data | Applicable Lawful Basis |
|---|---|---|
| Account Provisioning & Access Control | Registration Data, Assigned Role | Performance of a Contract |
| Dual-Balance Ledger & POS Operations | Service Data, Invoices, Receipts, Balances | Performance of a Contract & Legitimate Interests |
| Subscription Billing & Metering | Payment Tokens, Active Customer Counts | Performance of a Contract |
| Student Fee & Roster Administration | Student Identifiers, Guardian Contact Data | Verified Parental Consent & Educational Mandate |
| Automated Payment Reminders | Customer Phone Number, Outstanding Balance | Processor Acting on Controller's Instructions |
| Physical Goods Fulfillment Auditing | Recipient Name, Delivery Confirmation Logs | Performance of a Contract & Fraud Prevention |
| Cash Flow Analytics & AI Insights | Aggregated, De-identified Metrics | Legitimate Interests (Service Optimization) |
| Merchant Credit & Loan Underwriting | Aggregated Workspace Cash Flow (Zero Debtor PII) | Explicit Workspace Owner Consent (Opt-In) |
| Platform Security & Abuse Prevention | IP Addresses, Session Tokens, Security Logs | Legal Obligation & Legitimate Interests |
| Tax, Accounting & Statutory Retention | Finalized Transaction Totals, Invoice Numbers | Compliance with a Legal Obligation |
Section 9. Data Sharing & Authorized Sub-Processors
Kolect does not sell, rent, or trade Personal Data to third parties. We disclose Personal Data only to vetted third-party service providers ("Sub-Processors") bound by written data processing agreements:
Section 10. Financing Services & The Debtor Privacy Wall
Under no circumstances does Kolect disclose, sell, or transmit the Personal Data of third-party debtors, retail customers, students, parents, or property tenants to commercial banks, microfinance institutions, or third-party lenders.
Where a Workspace Owner opts into merchant financing or working capital assessment, risk evaluation models are computed exclusively using anonymized, aggregated Workspace cash flow velocity, aggregate transaction volume, and overall receivables recovery ratios. Participating financial institutions never receive individual customer names, telephone numbers, or personal balance records.
Section 11. AI-Assisted Insights & Opt-Out Controls
11.1 De-Identification Prior to Processing: Before Workspace transaction summaries are analyzed by automated forecasting or recommendation models, automated pre-processing routines strip customer names, contact details, and unstructured free-text notes.
11.2 Prohibition on External Model Training:Kolect's commercial agreements with third-party artificial intelligence infrastructure providers strictly prohibit those providers from using Kolect Service Data to train or improve public or third-party foundation models.
11.3 Workspace Opt-Out Control: Workspace Owners may disable automated machine learning analytics and internal model optimization for their Workspace at any time through their Workspace Settings.
Section 12. Data Retention Schedule & Statutory Archiving
1. Operational Activity Logs (180-Day Retention)
Granular operational activity logs, stock adjustment trails, and intermediate fulfillment status timestamps are retained for one hundred eighty (180) days to support operational auditing and dispute resolution, after which they are automatically purged on a rolling schedule.
2. Soft-Deleted Workspaces & Records (30-Day Recovery Window)
When a Workspace Owner deletes a Workspace or specific catalog/directory records, the records are placed in a restricted recovery state for thirty (30) calendar days to prevent accidental data loss. Upon expiration of the 30-day window, associated Personal Data is permanently erased or irreversibly anonymized.
3. Statutory Financial & Tax Archives (Pseudonymized Retention)
To comply with mandatory corporate accounting, tax administration, and anti-fraud statutes in Nigeria and Kenya, finalized financial transaction amounts, dates, and invoice numbers must be retained for the applicable statutory limitation period. Where a valid erasure request is executed for a historical customer record, Kolect permanently strips and replaces the customer's Personal Data with an irreversible anonymous token while preserving underlying mathematical ledger integrity.
Section 13. Your Statutory Data Subject Rights
For Service Data Controlled by a Workspace Owner: Please direct your request first to that organization (the Data Controller). Kolect provides built-in tools enabling Workspace Owners to fulfill access, rectification, and erasure requests.
For Direct Requests to Kolect: Submit requests directly to our Data Protection Officer at legal@kolectfinance.com. We acknowledge and respond to all verified requests within thirty (30) calendar days at no charge.
Section 14. Security Safeguards & Cross-Border Data Transfers
14.1 Technical and Organizational Safeguards. Kolect protects Personal Data using industry-standard security controls, including Transport Layer Security (TLS 1.3 / HTTPS) encryption for all data in transit, AES-256 encryption at rest for database volumes and backup archives, strict logical tenant isolation, cryptographic password hashing, and role-based access auditing.
14.2 Cross-Border Data Transfers. Whenever Kolect transfers Personal Data across national borders, we comply with Part VIII of the NDPA 2023 and Part VI of the Kenya DPA 2019 by verifying destination jurisdiction adequacy, executing Standard Contractual Clauses (SCCs) with Sub-Processors, and maintaining required regulatory transfer documentation.
Section 15. 72-Hour Data Breach Notification Protocol
In the event of a confirmed personal data breach that presents a risk to the rights and freedoms of Data Subjects:
- Regulatory Notification: Pursuant to Section 40 of the NDPA 2023 and Section 43 of the Kenya DPA 2019, Kolect will notify the Nigeria Data Protection Commission (NDPC) and/or the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours of becoming aware of the breach.
- Controller & Data Subject Notification: Where the incident affects Workspace Service Data, Kolect will notify affected Workspace Owners without undue delay with actionable incident details and remediation steps. Where Kolect acts as Data Controller and the breach poses a high risk to Data Subjects, Kolect will notify affected individuals directly without undue delay.
Section 16. Data Protection Officer & Supervisory Authorities
Nigeria Regulatory Authority
Nigeria Data Protection Commission (NDPC)
Email: info@ndpc.gov.ng
Website: https://ndpc.gov.ng
Kenya Regulatory Authority
Office of the Data Protection Commissioner (ODPC)
Email: info@odpc.go.ke
Website: https://www.odpc.go.ke
Kolect Data Protection Officer (DPO):
Kolect Technologies • Privacy & Legal Compliance
Email: legal@kolectfinance.com
Website: https://www.kolectfinance.com
Primary Operations: Abuja, Federal Capital Territory, Nigeria & Cross-Border Digital Services