Privacy Policy

1. Introduction

ThisCity Digital Ltd (“ThisCity”, “we”, “our”, or “us”), company number COY-VB6FMKGD, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect personal data in connection with ThisCity POS and related applications and websites operated by ThisCity Digital Ltd.

Processing is guided by the Malawi Data Protection Act, 2024 and by our internal data protection programme. This page is a public summary for users and merchants; it is not a claim of registration with the Data Protection Authority.

2. Who we are

3. Information we collect

Depending on how you use ThisCity POS and related ThisCity applications and websites, we may process:

• Account information — identity and authentication details (email, phone number, display name) via Firebase Authentication.
• Organisation & user data — business profiles, employee roles, and preferences stored in Firestore.
• Operational data — sales transactions, inventory records, delivery-related details where those features are used, and similar product data.
• Customer data entered by merchants — information about a merchant’s own clients that the merchant stores in the platform for their business.
• Billing & support data — subscription status, invoices, payment references handled through payment service providers, and support correspondence.
• Device & usage information — device model, OS, app version, and usage patterns for compatibility, health, and security.

4. How we use information

• To operate and maintain ThisCity POS and related applications and websites.
• To provide accounts, organisation features, security controls (such as PIN verification), and customer support.
• To process subscriptions and fees payable to ThisCity, and to keep accounting and tax records.
• To deliver product features you use (for example sales recording, receipts workflows, online sales or delivery tracking add-ons, or Attendance where subscribed).
• To protect the platform (security, fraud prevention) and improve reliability.
• To meet legal obligations, including record-keeping aligned with tax and AML-related requirements where applicable.

We do not sell personal or business data to third parties.

5. Controller and processor roles

Data Controller:Christopher John Scutt (natural person), CEO & Director of ThisCity Digital Ltd, determines the purposes and means of ThisCity’s own controller processing.

ThisCity acts as controller for, among other things:

• Account holders and organisation profiles;
• Billing, subscriptions, and fees payable to ThisCity;
• Support and service communications;
• Staff / HR data; and
• Merchant KYC / CDD held for ThisCity’s own compliance purposes.

ThisCity acts as processor for merchant end-customer and POS operational data that merchants enter about their customers. In that case the merchant is the controller and is responsible for accuracy and for having a lawful basis to collect and instruct ThisCity to process that data. ThisCity processes such data to provide the contracted services, not for unrelated commercial profiling or sale.

See also our Data Protection summary.

6. Sharing and sub-processors

We share personal data only as needed to run the services, including with:

• Firebase / Google Cloud — authentication, database, hosting and infrastructure.
• Payment service providers — to process payments and related references (for example PayChangu may be used; other licensed PSPs such as KhusaPay may be introduced; we do not claim any planned PSP is live until it is).

Where a product feature lets you publish or share information via unique links, you control who receives those links. We do not sell personal data. We may disclose archived or other records to competent authorities only where required by valid legal process.

7. Security

We use practical security measures including Firebase Authentication and permission models, encryption in transit (TLS) to cloud services, and reliance on Google Cloud / Firebase security baselines. Access to administrative tools is limited. No method of transmission or storage is perfectly secure; we improve controls as the company scales.

8. Your rights

Under the Malawi Data Protection Act, 2024, you may have rights to access, correct, or delete personal data, and other rights subject to legal exceptions. You can manage some information in-app where settings exist, or contact us as below.

• To request deletion of your account data, follow Data Deletion (email info@thiscity.app with subject Data Deletion Request).
• Verified requests are typically processed within about 30 days.
• For complex privacy escalations, contact the Privacy Contact: trevor@urenergy-tz.com.
• If your request concerns a merchant’s customers and ThisCity is only the processor, we may need to coordinate with or direct you to that merchant (the controller).

9. Retention

Account and operational data are kept for the life of the account and then handled under our deletion workflow, except where law requires longer retention. Deactivated financial and related operational records (such as invoices and transaction logs) may be retained in an offline archive for seven (7) years for legal, tax, and AML-related record-keeping. Archived records are not public and may be disclosed to authorities only with valid lawful process.

10. International transfers

Primary hosting and authentication use Firebase / Google Cloud, which may process or store data outside Malawi. Payment partners may process data in their operating jurisdictions. We transfer or process internationally only as needed for the services and prefer providers with published security and privacy commitments. We do not claim specific adequacy decisions beyond what has been confirmed for Malawi.

11. Children

ThisCity’s products target businesses and adult users. We do not knowingly target or market to children. If we learn that a child has provided personal data inappropriately, we will delete or restrict it promptly, subject to legal retention exceptions.

12. Changes

We may update this Privacy Policy from time to time. The “Last Updated” date at the top will change when we do. Continued use of the services after an update constitutes acceptance of the revised policy where permitted by law.

13. Contact

This page is public information for users and merchants. It is not legal advice and does not claim Data Protection Authority registration.