Privacy Policy

1. Introduction

KoroWorks ("we", "us", or "our") operates a suite of applications — including KoroWorks ERP (business management), Koro Hub (consumer shopping and wellness), Koro Merchants (seller onboarding and store management), Koro Partners (partner management), Koro Staff (employee self-service), Koro School (student and parent companion), Koro POS (point-of-sale terminal), and Koro AI — collectively referred to as the "Platform". This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use any part of the Platform. By using any Koro application you consent to the practices described in this Policy.

2. Information We Collect

We collect the following categories of information:

• Account information: name, email address, phone number, and organisation details provided during registration.
• Business data: records, transactions, documents, and other data you enter into the Platform in the course of your operations.
• Usage data: log files, IP addresses, browser type, pages visited, and actions taken within the Platform.
• Payment information: billing details processed through our payment providers. We do not store full card numbers.
• Communications: messages and support requests you send to us.

3. How We Use Your Information

We use collected information to:

• Provide, operate, and improve the Platform and its features.
• Process transactions and send related billing and account notices.
• Respond to support requests and communicate service updates.
• Monitor security, detect fraud, and ensure compliance with our Terms and Conditions.

4. Data Storage and Security

For cloud-hosted accounts, your data is stored in secure infrastructure with encryption in transit (TLS) and at rest. Access controls, audit logs, and regular security reviews are in place to protect your data.

For on-premise deployments, you are solely responsible for the security, storage, and backup of your data. KoroWorks does not have access to on-premise instances unless you explicitly grant remote support access.

5. Data Sharing and Disclosure

We do not sell your personal data. We may share information in the following limited circumstances:

• Service providers: trusted third-party vendors (e.g., cloud hosting, payment processors, email delivery) who process data on our behalf under strict data processing agreements.
• Legal obligations: when required by law, court order, or governmental authority.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality obligations.
• With your consent: in any other case where you have given explicit permission.

6. Data Retention

We retain your data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations and resolve disputes. Upon account termination you may request deletion of your data. After a 30-day grace period, account data is permanently deleted from our systems.

7. Your Rights

Depending on your jurisdiction you may have the right to access, correct, export, or delete your personal data. You may also have the right to restrict or object to certain processing. To exercise any of these rights, contact us at support@koroworks.com. We will respond within 30 days.

8. Cookies and Tracking

The Platform uses the following types of cookies and similar technologies:

• Strictly necessary cookies: required for authentication and session management.
• Functional cookies: remember your preferences such as language and display settings.
• Analytics cookies: help us understand how the Platform is used so we can improve it (e.g., page visit counts, feature usage).
• You can control cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent you from using the Platform.
• We do not use cookies for third-party advertising.

9. Children's Privacy

The Platform is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. International Data Transfers

Your data may be processed in countries other than your own. Where we transfer data across borders we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent data protection mechanisms recognised under applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the Platform at least 14 days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

• Email: support@koroworks.com
• Website: koroworks.com
• Nairobi, Kenya