Privacy Policy

1.1 Who we are. Africa Tax Terminal is owned and operated by Tarra Agility Africa, a tax practice established in Kenya ("Tarra Agility Africa", "we", "us" or "our"). For the purposes of the Data Protection Act, 2019, Tarra Agility Africa is the data controller in respect of the personal data described in this Policy, except where we act as a data processor on behalf of a client as described in clause 1.4. Tarra Agility Africa is registered with the Office of the Data Protection Commissioner as a data controller.

1.2 Purpose. This Policy informs data subjects of the manner in which their personal data is processed, the lawful basis for that processing, the safeguards applied to it and the rights available to them under the Act.

1.3 To whom this Policy applies. This Policy applies to visitors to our website, to registered users of the Platform, and to the personnel of our clients whose personal data may be contained in records submitted to the Platform for analysis. It should be read together with our Terms of Use and, where a formal advisory engagement exists, with the engagement letter governing that engagement, which prevails in the event of any inconsistency concerning client records.

1.4 Our dual role. Where we process personal data that is contained within a client's own tax or accounting records (for example, a purchase ledger or payroll extract uploaded for review), we do so as a data processor acting on the documented instructions of that client, who remains the data controller of those records. Where we process the personal data of our account holders and website visitors for our own purposes, we act as the data controller. This Policy addresses both roles.

In this Policy, the following terms have the meanings assigned to them:

3.1 Information you provide to us. When you register for or are granted access to the Platform, or correspond with us, we collect your name, job title, the name of your employer, your business email address, your business telephone number and your login credentials. Where a demonstration or advisory matter is arranged, we may also collect the information contained in any correspondence between us.

3.2 Information generated through your use of the Platform. We collect the questions you put to the AI chat function, the records and documents you upload for analysis, the reports generated for you, and a log of your activity on the Platform. Records uploaded for analysis may contain personal data relating to third parties (for example, employees named in a payroll schedule); such data is processed as described in clause 1.4.

3.3 Information collected automatically. When you visit our website we automatically collect limited technical information, including your internet protocol (IP) address, browser type, device identifiers and pages viewed, by means of cookies and similar technologies. Clause 11 explains our use of cookies.

3.4 Sensitive personal data. We do not request sensitive personal data in the ordinary course of providing the service. You should not upload sensitive personal data to the Platform unless it is strictly necessary for the matter at hand. Where a record submitted for analysis incidentally contains sensitive personal data, we process it only to the extent necessary to perform the service and in accordance with the heightened requirements of the Act.

We process personal data only where the Act permits. The table below sets out the principal purposes for which we process personal data, and the corresponding lawful basis under section 30 of the Act.

Where we rely on your consent, you may withdraw it at any time as described in clause 10. Where we rely on our legitimate interests, we do so only after satisfying ourselves that those interests are not overridden by your interests, rights and freedoms.

6.1 Where your data is hosted. The Platform is hosted on the secure cloud infrastructure of Amazon Web Services in its Cape Town (South Africa) region. Accordingly, personal data processed through the Platform is stored and processed outside Kenya. Certain of our service providers may also process limited personal data outside Kenya.

6.2 The safeguards we apply. We transfer personal data outside Kenya only in accordance with sections 48 and 49 of the Act. Before any such transfer we satisfy ourselves that the data will be afforded an appropriate level of protection, which we secure through a combination of: binding contractual commitments with the receiving party; the data protection law applicable in the receiving jurisdiction; and technical measures including encryption of data in transit and at rest. Where the Act requires your consent for a particular transfer, we will obtain it.

6.3 Further information. You may contact us using the details in clause 15 for further information on the safeguards applied to transfers of your personal data.

In accordance with section 41 of the Act, we apply appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include encryption, access controls that limit access to authorised personnel on a need-to-know basis, network protection, logging and monitoring, and staff confidentiality obligations. No system can be guaranteed to be entirely secure; where we are nonetheless required to, and where the law so provides, we will notify the ODPC of a personal data breach without undue delay and, where feasible, within seventy-two hours of becoming aware of it, and will communicate the breach to affected data subjects where it is likely to result in a real risk of harm to them.

We retain personal data only for as long as is necessary for the purposes for which it was collected, including to satisfy our legal, tax, accounting and regulatory obligations and to resolve disputes. Records connected with an advisory engagement, and the account records of our users, are generally retained for the period required by applicable law – which, for tax records, is ordinarily five years from the end of the relevant reporting period under the Tax Procedures Act, 2015 – and are thereafter securely deleted or anonymised. Records processed on behalf of a client are retained and returned or deleted in accordance with our arrangement with that client.

The Platform uses automated techniques, including artificial intelligence, to analyse records and to assist in preparing tax findings. These techniques support, but do not replace, professional judgement: no finding is issued to a client on a solely automated basis, and every output is reviewed and certified by a named practitioner before release. The Platform does not make decisions producing legal effects concerning you, or similarly significantly affecting you, by solely automated means.

To exercise any of these rights, please contact us using the details in clause 15. We will respond within the period prescribed by the Act. We may ask you to verify your identity before acting on a request. If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (www.odpc.go.ke).

Our website uses cookies and similar technologies to enable the site to function, to remember your preferences and to understand how the site is used so that we can improve it. You can set your browser to refuse some or all cookies, or to alert you when a site sets them; however, some parts of the site may not function properly if you do so. Where required by law, we seek your consent before placing non-essential cookies.

The Platform is a professional service intended for use by businesses and their advisers. It is not directed at children, and we do not knowingly collect the personal data of persons under the age of eighteen. If we become aware that we have inadvertently done so, we will take steps to delete it.

The Platform may contain links to third-party websites, including the websites of revenue authorities and legal publishers. We are not responsible for the privacy practices or content of those websites, and we encourage you to read their privacy notices.

We may update this Policy from time to time to reflect changes in our practices or in the law. The current version will always be available on the Platform, and the effective date is shown at the top of this document. Where a change is material, we will take reasonable steps to bring it to your attention.