Privacy Notice

Tuku-Tuku Innovation Labs, based in Uganda, provides the BCP Pro 2. This notice explains what personal data we collect when you use the platform, why we use it, who we share it with, and the choices you have.

1. Who is responsible for your data

Tuku-Tuku Innovation Labs is the data controller for the personal data described here — we decide what data is collected and how it is used. You can reach us at info@tukutuku.org.

2. What we collect and why

• Account data — name, email address, profile photo (if you add one or sign in with Google), and login credentials. Used to create and secure your account and to identify you inside the platform. Legal basis: performance of our contract with you.
• Business information you enter — business name, location, sector, contact person and phone number, staff and role information, financial figures, suppliers, machines, customers and the notes you write. Used to provide the assessment, analysis and reports you asked for. Please only enter personal data about other people (for example staff or contacts) where you are permitted to do so. Legal basis: performance of our contract with you.
• Support messages — the content of emails and requests you send us. Used to answer you and improve the product. Legal basis: contract performance and our legitimate interests.
• Usage and technical data — pages used, actions taken, device and browser type, IP address and error logs. Used to keep the platform secure, prevent abuse and fraud, diagnose faults and improve the product. Legal basis: legitimate interests in a secure, working service.
• Purchase records — which plan or item you bought, when, and its status, so we know what your account may access. Legal basis: contract performance and legal obligation.
• Marketing communications — only where you have asked for them. Legal basis: consent, which you may withdraw at any time.

We do not sell your personal data, and we do not use your business data to train systems for other customers without your permission.

3. Who we share data with

• Service providers and subprocessors — hosting, database, authentication, email delivery, document storage and analysis providers who process data on our instructions under contract.
• Merchant of Record — Paddle.com acts as reseller and Merchant of Record for our orders and handles the sale, subscription management, payments, tax compliance, invoicing and refunds. Paddle processes the billing details you provide at checkout under its own privacy notice.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where we are required to disclose information by law, or to protect our rights, users or the security of the platform.
• Programme administrators — if your business was enrolled by a business growth programme, the advisors and administrators assigned to that programme can see the business records associated with it.

4. International transfers

Our providers may store or process data outside your country. Where data leaves the UK or EEA we rely on appropriate safeguards, such as Standard Contractual Clauses or an adequacy decision.

5. How long we keep data

We keep account and business data for as long as your account is active. If you close your account or ask us to delete your data, we delete or anonymise it within 90 days, except where we must keep records longer for legal, tax or accounting reasons (typically up to seven years for transaction records) or to resolve a dispute. Security and error logs are kept for a shorter period.

6. Your rights

Subject to the law that applies to you, you may request access to your data, correction of inaccurate data, deletion, restriction of processing, a portable copy, or object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Email info@tukutuku.org and we will respond within one month. If you are in the UK or EEA and are not satisfied with our response, you may complain to your local data protection supervisory authority.

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, encrypted storage, role-based access controls so advisors only see the businesses assigned to them, and row-level database rules that restrict access to your own records. No system is completely secure, so please use a strong, unique password and keep it private.

8. Cookies and similar technologies

We use strictly necessary cookies and local browser storage to keep you signed in, remember your interface preferences and protect the platform against abuse. These are required for the platform to work. If we later add analytics or marketing cookies, we will ask for your consent first and provide a way to manage your preferences.

9. Children

The platform is intended for business use by adults and is not directed at children.

10. Changes to this notice

We may update this notice as the platform develops. Where changes are material we will notify you by email or inside the platform. See also our Terms & Conditions and Refund Policy.