KUME Privacy Policy

1. Who We Are

This Privacy Policy explains how We Design Nice Things Limited ("WDNT," "Kume," "we," "us"), RC 1277556, registered address KANIZ ESTATE, KARSANA, ABUJA, collects, uses, shares, and protects personal data in connection with the Kume application (the "Service").

This Policy is issued in accordance with the Nigeria Data Protection Act, 2023 ("NDPA") and regulations issued by the Nigeria Data Protection Commission ("NDPC"), and, where applicable to users outside Nigeria, the EU/UK General Data Protection Regulation ("GDPR").

2. Our Role: Understanding the Data Hierarchy

Kume involves three categories of people whose data may be processed, and it's important to understand our role with respect to each:

• Shop Owners — the individuals or businesses that register for Kume. With respect to the Shop Owner's own account data (name, business details, contact information), WDNT acts as the Data Controller.
• Staff Members — employees or contractors added by a Shop Owner. With respect to Staff data, the Shop Owner is the Data Controller and WDNT acts as the Data Processor, processing that data only to provide the Service to the Shop Owner.
• Customers — the Shop Owner's own end customers, whose names and phone numbers may be entered into Kume (e.g., for credit tracking). With respect to Customer data, the Shop Owner is the Data Controller and WDNT acts as the Data Processor.

Where WDNT acts as a Processor, our obligations are further defined in our Data Processing Agreement (DPA), available at usekume.com/legal/#dpa. Shop Owners are responsible for ensuring they have a lawful basis (such as consent or contractual necessity) before entering Staff or Customer personal data into Kume.

3. What Data We Collect

3.1 Shop Owner (Account) Data

• Full name, business/shop name
• Phone number (used for authentication via one-time password)
• Email address (if provided)
• Business category, branch information
• Subscription tier and payment/billing history (excluding raw card details — see Section 5)

3.2 Staff Data

• Full name
• Phone number and, if provided, email address
• Login PIN (stored securely; not visible to the Shop Owner in plain text)
• Sales activity attributed to that Staff Member within the Service

3.3 Customer Data

• Name and phone number, where entered by a Shop Owner or Staff Member (e.g., for the Credit & Debt Tracker or QR feedback features)
• Feedback ratings and comments submitted via a Shop Owner's QR feedback page

3.4 Business Data

Sales records, inventory/product data, pricing, expense records, and reports generated from the above.

3.5 Technical Data

Device type, operating system, app version, and crash/diagnostic logs, collected for the purpose of maintaining and improving the Service.

We do not currently use third-party marketing or analytics trackers (such as Google Analytics or the Meta/Facebook Pixel) within the Service.

4. Legal Basis for Processing

We process personal data on the following legal bases, consistent with the NDPA and, where applicable, GDPR:

• Performance of a contract — to create and maintain your Account and provide the Service you've signed up for.
• Consent — for optional features, such as SMS/WhatsApp low-stock or reminder notifications.
• Legitimate interest — to maintain the security, integrity, and performance of the Service, and to communicate essential service updates.
• Legal obligation — where processing is required to comply with Nigerian law, including tax and financial recordkeeping obligations connected to Paystack transactions.

5. How We Use Third-Party Service Providers (Sub-processors)

We rely on the following third-party infrastructure providers to operate Kume. We do not sell personal data to any third party.

• Supabase: Database hosting, user authentication, backend/edge functions, offline sync. Data Involved: All Account, Staff, Customer, and Business Data.
• Paystack: Payment processing for Pro subscriptions. Data Involved: Billing name, transaction amount, and payment status. Kume never receives, transmits, or stores your raw card or bank account numbers — these are handled directly and securely by Paystack in compliance with PCI-DSS and CBN payment service provider requirements.

If we introduce new sub-processors (for example, an email delivery service such as SendGrid or Resend), we will update this Policy and, where required by our Data Processing Agreement, notify affected Shop Owners in advance.

6. International Data Transfers

Kume's infrastructure (via Supabase) may be hosted in a data center region outside Nigeria — AWS eu-west-1. Where personal data is transferred outside Nigeria or, for EU/UK users, outside the European Economic Area or United Kingdom, we rely on appropriate safeguards, including Standard Contractual Clauses or an equivalent mechanism recognized under the NDPA and GDPR, and Supabase's own compliance certifications.

7. Data Retention and Deletion

7.1. We retain your Business Data for as long as your Account remains active, and for a limited period thereafter as described below.

7.2. If a subscription lapses but the Account is not deleted: we retain Business Data associated with Pro-only features, in case the Shop Owner resubscribes, for 12 calendar months from the date of lapse, after which it may be permanently deleted.

7.3. If a Shop Owner deletes their Account: deletion is largely automatic due to our database design. Deleting the top-level user record triggers cascading deletion (ON DELETE CASCADE) of all associated Branches, Products, Sales, Expenses, Subscriptions, and Payment History, typically completed within 30 days, subject to any data we are legally required to retain for longer (e.g., financial transaction records under Nigerian tax law).

7.4. If a Shop Owner deletes a single Branch: all Products, Sales, and Expenses tied specifically to that Branch are permanently deleted. Staff Members assigned to that Branch are not deleted, but are unassigned and retained under the Shop Owner's Account unless separately removed.

7.5. If a Shop Owner deletes a Staff Member: that Staff Member's account access, PIN, and profile are permanently and irreversibly deleted via a dedicated secure deletion function; historical sales already attributed to them remain in the Shop Owner's records as part of their Business Data.

8. Your Rights

Depending on your role and location, you may have the right, under the NDPA (and GDPR, where applicable), to:

• Access the personal data we (or, where we act as Processor, the relevant Shop Owner) hold about you;
• Request correction of inaccurate data;
• Request erasure ("right to be forgotten"), subject to legal retention requirements;
• Request restriction of, or object to, certain processing;
• Request a copy of your data in a portable format;
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or, where applicable, your local supervisory authority.

If you are a Staff Member or Customer of a Shop Owner and wish to exercise these rights, please contact the Shop Owner directly, as they are the Data Controller for your information. If you contact WDNT directly with such a request, we will forward it to the relevant Shop Owner in accordance with our Data Processing Agreement, unless we are independently required to act on it.

If you are a Shop Owner, you may exercise these rights directly through the app (Account and Staff deletion tools) or by contacting us at helpdesk@usekume.com

9. Data Security

We rely on Supabase's Row Level Security (RLS), encrypted data transmission (TLS), and encrypted authentication tokens to protect your data. Access to production data by WDNT personnel is restricted to what is necessary for support and maintenance. No system is completely secure, and we encourage Shop Owners to safeguard their own account credentials and Staff PINs.

10. Children's Data

Kume is intended for use by business owners and their staff who are at least 18 years old. We do not knowingly collect data relating to children. Customer records entered by Shop Owners are expected to relate to adult customers in the ordinary course of retail business.

11. Cookies and Local Storage

Kume does not use traditional browser tracking cookies. Please see our separate Cookie Policy at usekume.com/legal/#cookies for details on our use of local device storage for authentication and offline functionality.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email at least 14 days before taking effect.

13. Contact Us

Kume By We Design Nice Things Limited
KANIZ ESTATE, KARSANA, ABUJA.
Data Protection Contact: legal@usekume.com

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng, or with your local data protection authority if you are located outside Nigeria.

KUME Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between the Shop Owner identified in the applicable Kume Account ("Controller") and We Design Nice Things Limited ("Processor," "WDNT," "Kume"), and forms part of, and is incorporated by reference into, the Kume Terms of Service. This DPA applies to the extent WDNT processes Personal Data on behalf of the Controller in connection with the Service, including Staff Data and Customer Data as defined in the Kume Privacy Policy.

1. Definitions

Terms such as "Personal Data," "Processing," "Data Subject," "Controller," "Processor," and "Personal Data Breach" have the meanings given to them under the Nigeria Data Protection Act 2023 ("NDPA") and, to the extent applicable, the EU/UK General Data Protection Regulation ("GDPR").

2. Roles of the Parties

2.1. The parties acknowledge that, with respect to Staff Data and Customer Data entered into the Service by or on behalf of the Controller, the Controller is the Data Controller and WDNT is the Data Processor.

2.2. The Controller is solely responsible for determining the purposes and legal basis for which Staff Data and Customer Data are entered into the Service, and for ensuring it has the necessary rights, consents, and notices in place with respect to its Staff and Customers.

3. Scope, Nature, and Purpose of Processing

3.1. Subject Matter: WDNT's provision of the Kume application and associated hosting, storage, and processing infrastructure.

3.2. Duration: For the duration of the Controller's Kume Account, plus any post-termination retention period described in Section 7 of the Kume Privacy Policy.

3.3. Nature and Purpose of Processing: Storage, retrieval, organization, and transmission of Personal Data solely to provide the Kume ledger, inventory, staff-management, credit-tracking, and feedback features of the Service to the Controller, and for no other purpose.

3.4. Categories of Data Subjects: The Controller's Staff Members and Customers.

3.5. Categories of Personal Data: Names, phone numbers, email addresses (where provided), transaction/sales history, credit balances, and feedback ratings/comments, as described in the Kume Privacy Policy.

4. Processor Obligations

WDNT shall:

4.1. Process Personal Data only on the documented instructions of the Controller (which include the instructions inherent in the Controller's configuration and use of standard Service features), unless required to do otherwise by Nigerian or other applicable law, in which case WDNT will inform the Controller of that legal requirement unless the law prohibits such notice;

4.2. Ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations;

4.3. Implement appropriate technical and organizational security measures, including Supabase Row Level Security policies, encryption of data in transit (TLS) and, where applicable, at rest, and restricted internal access to production data on a need-to-know basis;

4.4. Assist the Controller, insofar as reasonably possible, in responding to Data Subject requests (access, correction, deletion, portability, objection). Where WDNT receives a request directly from a Data Subject who is a Staff Member or Customer of the Controller, WDNT will forward that request to the Controller within a reasonable time and will not itself act on the request unless independently required to do so by law;

4.5. Notify the Controller without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting the Controller's data, providing available details of the nature of the breach, likely consequences, and remedial measures taken or proposed;

4.6. Assist the Controller, at the Controller's reasonable request, with data protection impact assessments or consultations with the NDPC or another supervisory authority, to the extent required by applicable law and relating to WDNT's processing;

4.7. Upon termination of the Controller's Account, delete or, if legally required and requested, return the Controller's Personal Data in accordance with Section 7 of the Kume Privacy Policy, unless further storage is required by applicable law.

5. Sub-processors

5.1. The Controller provides WDNT with general written authorization to engage the following sub-processors in connection with the Service:

5.2. WDNT will notify Controllers of any intended changes to this sub-processor list — including the addition or replacement of a sub-processor — with at least 14 days' notice via the Service or by email, giving the Controller an opportunity to object on reasonable data-protection grounds. If the parties cannot resolve the objection, the Controller may terminate the affected part of the Service.

5.3. WDNT will impose data protection obligations on each sub-processor that are materially no less protective than those set out in this DPA.

6. International Data Transfers

Where the processing of Personal Data under this DPA involves a transfer of data outside Nigeria, or, in respect of Controllers subject to GDPR, outside the European Economic Area or United Kingdom, WDNT will ensure such transfer is made subject to appropriate safeguards, such as Standard Contractual Clauses, an adequacy mechanism recognized by the NDPC, or the sub-processor's own equivalent compliance certifications (e.g., Supabase's data processing addendum and Standard Contractual Clauses framework).

7. Audit Rights

Upon the Controller's reasonable written request, no more than once per year (unless required following a Personal Data Breach or by a supervisory authority), WDNT will provide the Controller with reasonably requested information demonstrating compliance with this DPA, such as summaries of security practices or relevant sub-processor compliance certifications. On-site audits are not provided for; WDNT will make reasonable efforts to answer written compliance questionnaires instead.

8. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability set out in Section 12 of the Kume Terms of Service.

9. Term and Termination

This DPA remains in effect for as long as WDNT processes Personal Data on behalf of the Controller under the Terms of Service, and terminates automatically upon termination of the Controller's Kume Account and completion of the data deletion process described in Section 7 of the Kume Privacy Policy.

10. Governing Law

This DPA is governed by the laws of the Federal Republic of Nigeria, consistent with Section 14 of the Kume Terms of Service, without prejudice to any mandatory data protection law applicable to a Controller located outside Nigeria.

11. Acceptance

By subscribing to the Kume Pro tier or otherwise entering Staff or Customer Personal Data into the Service, the Controller accepts the terms of this DPA. WDNT will make a signed or countersigned version of this DPA available upon written request from Controllers who require one for their own compliance records (for example, Controllers subject to GDPR).

We Design Nice Things Limited
KANIZ ESTATE, KARSANA, ABUJA.
Data Protection Contact: legal@usekume.com

KUME Cookie Policy

1. Overview

This Cookie Policy explains how We Design Nice Things Limited ("WDNT," "Kume," "we") uses local storage technologies in connection with the Kume application.

2. We Do Not Use Tracking Cookies

Kume is built as a Flutter application. On mobile and desktop, it does not use browser cookies at all. If you access a Kume web deployment, Kume uses your browser's Local Storage rather than traditional HTTP tracking cookies.

We have not installed, and do not currently use, any third-party marketing, advertising, or analytics trackers, including but not limited to Google Analytics or the Meta/Facebook Pixel.

3. What We Do Use, and Why

All of the above fall under the "Strictly Necessary" category recognized under Nigerian and international data protection frameworks — meaning the Service cannot function without them, and as such, no separate cookie-consent banner is required for these technologies alone.

4. Future Changes

If we introduce analytics or marketing technologies in the future, we will update this Cookie Policy, implement an appropriate consent mechanism where required by law (including the NDPA or GDPR, as applicable), and notify users in advance in accordance with Section 15 of our Terms of Service.

5. Contact Us

We Design Nice Things Limited
KANIZ ESTATE, KARSANA, ABUJA.
Email: legal@usekume.com