Privacy policy

01Who we are

KioskCluster Ghana Ltd (“KioskCluster”, “we”) runs kioskcluster.com, the dashboard where merchants run their business, and the storefronts we host for them. This policy explains what personal data we handle, why, and your choices, under Ghana's Data Protection Act, 2012 (Act 843).

• For merchants and their staff, and for visitors to kioskcluster.com, we decide how data is used: we are the data controller.
• For people who shop on a store we host, the store decides: it is the controller, and we handle the data for it. Questions about an order or a store's mailing list go to that store first, and we help where we can.

02What we collect

When you run a store with us

• You: your name, email address or mobile number, and your role in the business.
• Your business: its name, store address, what you sell, your theme, pickup points and locations, and your plan and billing history.
• Signing in: the codes we send you, and your password if you set one. If you sign in with Google, the name and email address on that Google account. We never get your Google password.
• Your devices: for each signed-in session, the kind of device and browser, its IP address, and when it started and was last used, so you can see your sessions and end them.
• What you add: products, prices, photos, stock, coupons, banners, bookings, the messages you send, and your settings.
• Support: what you tell us when you ask for help.

When you shop on a store we host

• Your name, mobile number and email, and your delivery address or pickup point.
• Your orders: what you bought, the prices, and delivery and payment status. Card numbers and mobile money PINs are entered with the payment provider, never given to us or to the store.
• If you sign in to a store: the code we send you, or the name and email on your Google account.
• If you choose to: reviews you write, gift lists, bookings, and joining the store's mailing list.
• Visit counts, and which page or link an order came from, so the store can see what brings customers in.

When you visit kioskcluster.com

• Our servers note standard request details (IP address, browser, the page and the time) to keep the site running and secure. There are no analytics or advertising trackers on it.
• If you type your email or phone into Start free, it travels in the link to our sign-up page, which keeps it in that browser tab. It reaches our servers only when you ask for a code.

03How we use it

• To run the service: sign you in, show your dashboard, host your store, take orders, and send codes and order updates.
• To keep it safe: limit sign-in attempts, spot fraud and abuse, and look into problems.
• To bill your plan and order fees.
• To help when you ask, and to tell you about changes to the service, your plan or these policies.
• To improve KioskCluster, from figures that don't identify anyone wherever we can.
• To meet the law, such as keeping accounting records.

We send merchants news about KioskCluster only if they haven't said no, and every message lets them stop it. We never use a store's customers for our own marketing.

Our legal grounds are the contract with you, our legitimate interest in a safe and working service, the law, and your consent where we ask for it.

04Messages we send

• Sign-in codes, by text message or email, when you ask for one.
• For shoppers: order confirmations, delivery updates and tracking links, from the store you ordered from.
• Broadcasts: a store may email only the shoppers who joined its mailing list.

05Who we share it with

We don't sell personal data, or share it for anyone's advertising. We share it only:

• with the store you buy from, so it can fulfil your order, including whoever it uses to deliver;
• with providers who work for us under contract: Hubtel for payments, the services that deliver our text messages and email, and our hosting and storage, each with only what it needs;
• with Google, when you choose to sign in with Google;
• when the law requires it, or to protect people and the service from fraud and harm;
• with a new owner if KioskCluster is reorganised or sold, who must keep to this policy.

06When our team looks into an account

Our support team can look inside a merchant's account only to help or to keep the service safe. Each look needs a written reason, ends after an hour at most, and is recorded.

07Cookies and storage on your device

• kioskcluster.com sets no cookies.
• The dashboard keeps you signed in with one encrypted cookie that the page's own scripts can't read, and a small marker beside it. With “Keep me signed in” it lasts up to 30 days; without, it ends when you close the browser. While you sign up, the tab also keeps what you typed on our website and the theme you picked, until your business is open.
• Storefronts keep your basket, recent orders and preferences in your browser's storage on that device. Signing in to a store lasts up to 30 days on that device.
• There are no advertising cookies. If you choose Google sign-in, Google's script runs on that page under Google's own privacy policy.

08Where your data is kept

Our providers may store or process data outside Ghana. When they do, we use providers bound by contract to protect it to the standard the Data Protection Act requires.

09How long we keep it

• Sign-in codes work for 10 minutes. A signed-in session lasts up to 30 days, or until you sign out.
• Your account's data, for as long as the account is open.
• After an account closes, we delete or anonymise its data within 90 days, including its stores' customer data, except records the law makes us keep, such as billing and tax records, for as long as it requires.

10Keeping it safe

• Every connection is encrypted. The dashboard's session lives in an encrypted cookie that page scripts can't read.
• Codes instead of passwords by default. A code works for 10 minutes and 5 tries, and repeated failed sign-ins are slowed down. A password, if you set one, locks for 15 minutes after 5 wrong tries.
• Staff accounts, so everyone signs in as themselves. You can see every signed-in device and end any session, and changing your password signs out every other device.
• No system is perfectly secure. If a breach affects your data, we tell you and the Data Protection Commission, as the law requires.

11Your rights

Under the Data Protection Act, you can:

• ask what personal data we hold about you, and get a copy;
• ask us to correct it, or to delete it;
• tell us to stop using it for direct marketing, at any time;
• object to other uses, or withdraw consent you gave;
• complain to the Data Protection Commission of Ghana.

Merchants can see and correct most of their details in the dashboard. For anything else, write to us and we answer within the time the law sets. If you shop on a store we host, ask the store first; if it doesn't answer, write to us.

12Children

KioskCluster is for businesses, and merchants must be 18 or older. We don't knowingly collect data from children.

13Changes to this policy

When we change this policy in a way that matters, we tell merchants by email or in the dashboard before it takes effect, and update the date at the top. The terms of service say how changes to the agreement work.

14Contact

KioskCluster Ghana Ltd, Accra, Ghana. Write to support@kioskcluster.com, or talk to a person from 7am to 10pm Accra time, every day.