Privacy Policy

KUCO ("we", "us") provides business operations and supplier compliance software to South African businesses at www.kuco.co.za. This policy explains what personal information we collect, why we collect it, and how we protect it. It applies to business owners and their staff who use KUCO, to job applicants who apply through our recruitment pages, and to corporate portal users.

Questions or requests about your personal information can be sent to our Information Officer at hello@kuco.co.za.

• Account information: name, email address, phone number and login credentials.
• Business information you enter: store details, staff records, payroll inputs, supplier and customer records, compliance answers and uploaded documents.
• Job applicant information submitted through public application pages: CVs, contact details and answers to screening questions.
• Technical information needed to run the service: session tokens and basic usage logs.

We do not sell personal information, and we do not use it for advertising.

• To provide the service you signed up for: running your operations, payroll, recruitment and supplier compliance.
• To share supplier compliance information with a corporate customer, but only where your business has approved that specific relationship and, for documents, explicitly shared the document.
• To bill for your subscription (payments are processed by Ozow; we do not store card or bank login details).
• To send service messages such as invitations, expiry reminders and billing notices.
• To meet our own legal obligations.

Your data is stored in a managed PostgreSQL database hosted by Supabase, with files in managed object storage, and the application is served by Vercel. Data is encrypted in transit (TLS) and at rest (AES-256). Every business's data is isolated from every other business's through database-level row security, and access within your business is controlled by roles you assign. More detail is on our Security page.

Compliance answers, your business profile and vault documents are visible only to your own team by default. A corporate customer can see them only after your business accepts that corporate's invitation, and can see a document only after you explicitly share it with them. You can withdraw a document share at any time.

We keep personal information for as long as your account is active, and thereafter only as long as we are required to for legal, tax or audit purposes. Job applicant information is kept for the recruitment process and reasonable follow-up, after which it can be deleted on request.

• Ask what personal information we hold about you.
• Ask us to correct or delete personal information.
• Object to processing, subject to our legal and contractual obligations.
• Complain to the Information Regulator (South Africa) at inforegulator.org.za.

To exercise any of these rights, email hello@kuco.co.za and we will respond within a reasonable time, and in any event within the periods POPIA requires.

If we make material changes we will update the date at the top of this page and notify account owners in the app or by email.