Last updated: July 22, 2026
KipBox is a point-of-sale and inventory service for businesses in Nigeria, operated by Kipbox ("KipBox", "we", "us"). This policy explains what personal information we collect, why we collect it, who we share it with, and the rights you have over it.
We handle personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the regulations made under it.
Two different roles we play
This distinction matters, because it decides who you should contact about a given record.
- Your account and business data. When you sign up, subscribe and use KipBox, we decide how that information is handled. For this we are the data controller.
- The records you enter into KipBox. Your customers, your staff, your sales and your stock belong to your business. You decide what to record and why; we only hold and process it so the service works for you. For this we are a data processor acting on your instructions, and your business is the controller.
If you are a customer of a shop that uses KipBox and you want to see, correct or delete what that shop has recorded about you, please contact the shop directly. If you cannot reach them, write to us and we will help you get through to them.
Information we collect
Information you give us when you register:
- Your name, email address, phone number and password. Passwords are stored only as a one-way hash — we never see or store the password itself.
- Your business name, business address, logo, currency and the stores or locations you set up.
- The staff accounts you create, and the role and permissions you assign to each one.
Business records you enter or generate while using KipBox:
- Products, categories, brands, units, stock levels, stock counts, transfers and adjustments.
- Sales, invoices, receipts, payments, held sales and refunds.
- Customers you save — typically a name, and optionally a phone number, email address and address.
- Suppliers, purchase orders, expenses and payment accounts.
Billing information: your chosen plan, billing cycle, subscription status, renewal dates, and the transaction reference returned by our payment gateway. We never receive or store your card number, CVV or bank login details — those are entered on the payment provider's own secure page and stay with them.
Technical and security information collected automatically:
- Your IP address and browser or device information.
- Session records, sign-in times and last-login timestamps.
- An activity log of records created, updated and deleted in your account, including which user made the change, what changed, and the IP address it came from. This exists so a business owner can see who did what.
Messages you send us: anything you submit through the contact form on this site, or send to our support address, along with the email address you sent it from.
Why we use it, and our lawful basis
- To provide the service — creating your account, running your shop's records, processing sales, producing reports and receipts. Basis: performance of our contract with you.
- To bill you — starting your free trial, taking subscription payments, issuing renewal reminders. Basis: performance of our contract.
- To keep accounts secure — verifying your email, detecting suspicious sign-ins, maintaining the activity log. Basis: our legitimate interest in protecting your business data.
- To support you — answering questions, investigating faults, helping you set up. Basis: performance of our contract and our legitimate interest.
- To improve KipBox — understanding which features are used and where the service is slow or failing. Basis: our legitimate interest, using the least identifiable information that will do the job.
- To send service messages — verification emails, trial and renewal notices, security alerts and important changes. These are part of the service and are not marketing. Basis: performance of our contract.
- To send optional updates about KipBox — only if you have opted in, and every message carries an unsubscribe link. Basis: your consent, which you can withdraw at any time.
- To meet legal obligations — tax, accounting and lawful requests from a competent authority. Basis: compliance with a legal obligation.
What we do not do
- We do not sell, rent or trade your personal data, or your customers' data, to anyone.
- We do not share your business records with other businesses using KipBox.
- We do not use your sales data to advertise to your customers.
- We do not run advertising or cross-site tracking networks on your account.
Who we share information with
We share only what is necessary, and only with:
- Payment providers who take your subscription payment and confirm it back to us.
- Our hosting provider, which runs the servers your data sits on.
- Our email provider, which delivers verification, billing and support messages.
- Professional advisers such as accountants or lawyers, where they are bound to keep it confidential.
- A competent authority, where we are legally required to disclose it. Where the law allows, we will tell you first.
- A buyer or successor, if the business is sold or reorganised. You would be told before your data moved, and this policy would continue to apply.
Every provider we use is bound by contract to protect the data and to use it only for the service they provide to us. The current list is on our Data Protection page.
Cookies
We use a small number of strictly necessary cookies: one to keep you signed in, and one to protect forms against cross-site request forgery. Without these, the service cannot work. We do not use advertising or cross-site tracking cookies. You can clear cookies in your browser at any time, but you will be signed out.
How long we keep it
- Your business records are kept for as long as your account is open, so that your history and reports stay complete.
- After you close your account, we keep your data for a limited winding-down period so you can change your mind or export your records, and then delete or anonymise it.
- Billing and transaction records are kept for as long as tax and accounting law requires.
- Security and activity logs are kept for a limited period for audit and fraud investigation.
Your rights
Under the Nigeria Data Protection Act 2023 you have the right to:
- Ask what personal data we hold about you and get a copy of it.
- Have inaccurate or incomplete information corrected.
- Ask us to delete your personal data, where we are not required to keep it.
- Ask us to restrict how we use it, or object to a use based on our legitimate interest.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time, where we relied on consent. This does not undo what was lawfully done before you withdrew it.
- Complain to the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your data.
To exercise any of these, email us at hello@kipbox.co. We will respond within 30 days. We may ask you to confirm your identity first, so that we do not hand your data to someone else.
Security
We take reasonable technical and organisational measures to protect your data, including encryption in transit, hashed passwords, strict separation between businesses, and role-based staff permissions. Our Data Protection page sets these out in full. No online service can promise perfect security, so please use a strong, unique password and give staff only the access they need.
Changes to this policy
We may update this policy as KipBox changes or the law changes. We will update the date at the top, and for significant changes we will tell you by email or a notice in the app before they take effect.
Contact us
KIPBOX
A Product of Dignity Technology Limited
Email: hello@kipbox.co
