Privacy policy

Kilwa Technologies (“Kilwa”, “we”, “us”) provides investment intelligence for frontier markets. This policy explains what personal information we collect through kilwa.io, why we collect it, who we share it with, and the rights you have over it.

This site is intended for business and institutional users. It is not directed to children, and we do not knowingly collect personal information from anyone under 18.

What we collect

• Identifiers and professional information you give us. When you request a demo, contact us, subscribe to one of our newsletters, request a report or scope an engagement, we collect your name, organisation, work email address, institution type, the markets you tell us you follow, and any message you write.
• Technical information. Our hosting infrastructure processes standard server logs, including IP address, user agent and request metadata, for security, abuse prevention and reliability.

We do not collect special category data, government identifiers, or financial account information through this website, and you should not send them to us through it.

Why we use it

• To respond to your enquiry, demo request or engagement enquiry and to administer a subscription.
• To send you research and updates where you have asked us to.
• To operate, secure and improve the website and the platform.
• To meet legal, regulatory, contractual and recordkeeping obligations.

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects about you.

Legal bases (UK and EU)

Where the UK GDPR or EU GDPR applies, we rely on your consent for marketing communications, which you may withdraw at any time; on our legitimate interests in responding to business enquiries, securing our systems and marketing to business contacts; on performance of a contract where you are a subscriber; and on legal obligation where applicable.

How we prove consent

Africa Signal Check uses double opt-in. Submitting the form does not subscribe you: we email a confirmation link, and only when you click it do we add you to the list. If you never confirm, your address is never stored — an unconfirmed entry leaves no trace with us at all.

When you confirm, we retain the evidence UK and EU GDPR require us to be able to produce: your address, the date and time you confirmed, the IP address the confirmation came from, and the exact wording you agreed to. We keep that record while you are subscribed and for two years afterwards, so we can answer a question about how you came to be on the list.

Purchases

When you buy a report, Payhip runs the checkout and sends us your name, your email address, what you bought and the amount, so that we can deliver the file, answer a support question and keep the accounting record. Buyers are kept on a separate list from the newsletter. We use it to tell you about a correction to a report you hold and, unless you untick the box at checkout or unsubscribe later, about related research. A correction notice is sent regardless, because it concerns what you paid for.

Sub-processors

We use a small number of providers to run this site, each under a data processing agreement:

• Vercel — website hosting, server logs and cookieless page-view measurement.
• beehiiv — the newsletter: delivery of Africa Signal Check, the subscriber list and paid subscriptions.
• Resend — transactional email, the opt-in confirmation, the consent register and the buyer list.
• Payhip — checkout, VAT handling and delivery of purchased reports. Kilwa never receives or stores your card details.
• Stripe — payment processing where it is used for research purchases. Kilwa never receives or stores your card details.
• Google Workspace — the mailboxes our team reads and replies from.
• Google Calendar — the booking page for calls with our founder, embedded on the book-time page. What you enter there is processed by Google under its own privacy policy; we receive the booking and use it only to hold the call.

Sharing

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose it only to service providers who process it on our behalf under contract — hosting, email delivery and, where applicable, our customer relationship system — and where required by law, regulation or legal process, or to protect our rights.

Retention

We keep personal information only as long as we have a reason to:

• Newsletter subscription — until you unsubscribe. We then keep your address, and nothing else, on a suppression list indefinitely, so that a later import cannot add you back.
• Consent records — for as long as you are subscribed, and two years afterwards.
• Enquiries, demo requests and engagement enquiries — 24 months from our last contact with you, then deleted.
• Purchase and transaction records — seven years, because tax and accounting law requires it. This obligation survives a deletion request, and we will tell you so if you make one.
• Buyer list — until you unsubscribe or ask us to remove you. The transaction record itself stays for the seven years above.
• Server logs — a short period set by our hosting provider, for security.

Security

Data transmitted to and stored by Kilwa is secured with AES-256 encryption in transit and at rest. Access is controlled on a role basis and logged. No system is perfectly secure, and we encourage you to report any suspected vulnerability to info@kilwa.io.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict the processing of your personal information, to object to processing, and to withdraw consent. Residents of California have rights under the CCPA as amended, including the right to know, the right to delete, the right to correct, and the right not to be discriminated against for exercising them. Because we do not sell or share personal information as those terms are defined, there is nothing to opt out of.

To exercise any right, write to info@kilwa.io. We will verify your request against the information we hold and respond within the period required by applicable law. You may also lodge a complaint with your local supervisory authority.

Cookies

This website uses only cookies strictly necessary for it to function. We count page views and a small number of on-site actions, such as opening a checkout, with our hosting provider's measurement, which sets no cookie, stores nothing on your device and does not identify you. We do not use advertising cookies or cross-site tracking, and we do not respond to Do Not Track signals because there is no tracking to disable. If this changes, we will update this policy and obtain consent where required.

International transfers

Kilwa is headquartered in Chicago, Illinois, United States, and information you provide is processed there. Where personal information is transferred from the UK, the EEA or another jurisdiction with transfer restrictions, we rely on appropriate safeguards, including standard contractual clauses where required.

Our representatives in the UK and EU

Kilwa is established in the United States. Where we offer services to people in the United Kingdom or the European Economic Area, Article 27 of the UK and EU GDPR requires us to designate a representative in each territory who can be contacted on data protection matters, by you or by a supervisory authority.

• European Economic Area: appointment in progress — see below.
• United Kingdom: appointment in progress — see below.

Until those appointments are named here, address any data protection question directly to privacy@kilwa.io and we will respond within the period the law allows.

You may also complain to your local supervisory authority — in the UK, the Information Commissioner's Office; in the EEA, the authority for the country where you live or work. We would rather you raised it with us first.

Changes

We may update this policy. The date above reflects the most recent revision, and material changes will be signalled on this page.

Contact

Kilwa Technologies, Chicago, Illinois, United States. info@kilwa.io.