Data Protection

1. Purpose of this page

This page summarises how ThisCity Digital Ltd approaches data protection for the public — merchants, account holders, and visitors. It is not the full internal board policy. For detailed privacy practices, see our Privacy Policy. To request deletion, see Data Deletion.

ThisCity Digital Ltd does not claim registration with the Data Protection Authority on this page. Registration obligations are assessed separately under the Act where they apply.

2. Malawi Data Protection Act, 2024

Malawi’s Data Protection Act, 2024 sets rules for lawful, fair, and secure processing of personal data. The Data Protection Authority (in the MACRA context; see dpa.mw) oversees the framework. ThisCity designs its programmes to align with the Act: clear roles, purpose limitation, security, sub-processor discipline, data-subject rights, retention, and breach readiness.

3. Who is responsible

4. Controller vs processor (plain language)

ThisCity as controller

For its own operations, ThisCity (with Christopher John Scutt as named Data Controller) determines purposes and means for data such as:

• Accounts, organisation profiles, and login security;
• Billing and subscriptions payable to ThisCity;
• Support tickets and service notices;
• Staff / HR administration; and
• Merchant KYC / CDD held for ThisCity’s compliance.

ThisCity as processor

When a merchant uses ThisCity POS (or related ThisCity applications) to store information about their customers — contacts, sale-related details, delivery details in merchant workflows, and similar operational data — the merchant is the controller of that end-customer data. ThisCity processes it on the merchant’s instructions to deliver the contracted product. Merchants must keep that data accurate and have a lawful basis to collect it.

5. How merchants’ customer data is handled

• Processed to provide POS and related contracted features — not sold by ThisCity.
• Hosted with sub-processors necessary to run the platform (notably Firebase / Google Cloud) and, where payments are involved, payment service providers (generically; PayChangu may be in use; other PSPs may be planned and are not claimed live until they are).
• Protected with authentication, permission isolation, and encryption in transit to cloud services.
• Financial / AML-related archives may be retained offline for 7 years where required (see Privacy and Data Deletion).

6. How to exercise your rights

1. Use in-app settings where available to update or manage your account information.
2. Email info@thiscity.app for access, correction, or other rights requests; for deletion use subject Data Deletion Request and follow Data Deletion.
3. Escalate complex privacy matters to the Privacy Contact: trevor@urenergy-tz.com.
4. If you are an end customer of a merchant (not a ThisCity account holder), start with that merchant — they are usually the controller of your data in the POS. ThisCity will assist merchants and account holders as described in the Privacy Policy.

Verified account deletion requests are typically handled within about 30 days, subject to legal archive exceptions.

7. Related documents

• Privacy Policy
• Data Deletion
• Terms of Service

Governing law for ThisCity’s contracts with users is the law of Malawi. This summary is not legal advice.