Privacy Policy

Casa Management Solutions ("Casa," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and process your personal data when you use the Casa app, the Casa business management platform, our websites, and related services (together, the "Services").

Casa is a multi-tenant business management and commerce platform. Businesses use it to manage products, inventory, orders, customers, staff, payments, wallets, and subscriptions. Customers use it to discover businesses, place orders, and pay. To deliver these features, we collect and process personal data about both business users and their customers, as described below.

This Privacy Policy also describes your privacy rights. More information about your rights, and how to exercise them, is set out in Section 4 ("Rights and Choices").

Collection of Personal Data
Uses of Personal Data
How We Disclose Personal Data
Rights and Choices
Data Transfers
Data Retention and Security Controls
Your Content and Data
Children
Changes to Our Privacy Policy
Contact Information
Legal Bases for Processing

1 Collection of Personal Data

We collect the following categories of personal data:

Personal data you provide to us directly

Identity and Contact Data: Your name, phone number, and email address when you create a Casa account. We may also generate internal identifiers for your account, business, and records.
Business Information: Details about your business that you add to the platform â€” business name, type, locations, staff and their roles, products, services, pricing, inventory, suppliers, and similar operational data.
Customer Information: Where you are a business user, the customer details you record (such as a customer's name and phone number) to fulfil orders, manage memberships, and run loyalty or billing features.
Payment Information: Mobile money details (phone number, transaction references) and card payment details when you make or receive payments, top up a wallet, pay a subscription, or request a withdrawal. Payments are processed through our payment partners (such as Yo! Uganda, OlyCash, Flutterwave, and Pesapal); we do not store your mobile money PIN or full card numbers.
Transaction and Order Data: The orders, invoices, receipts, payments, wallet movements, and other records you create while using the Services.
Files and Content: Images, documents, and other files you upload â€” for example product photos, business logos, or attachments. Your content remains yours (see Section 7).
Feedback: Ideas, suggestions, and ratings you provide about the Services or about businesses you transact with.
Communication Information: If you contact us through support channels, we collect your name, contact information, and the contents of your message.

Personal data we receive automatically from your use of the Services

When you use the Services, we receive certain technical data automatically ("Technical Information"):

Device and Connection Information: Device type, operating system, app version, browser information, IP address (and approximate location derived from it), time zone, and connection information.
Usage Information: Dates and times of access, features used, and actions taken within the Services.
Log and Troubleshooting Information: Error logs, performance data, and diagnostic information when issues occur.
Cookies & Similar Technologies: On our websites we use cookies and similar technologies to keep you signed in, recognize you, and analyze usage to make the Services safer and more useful. We do not use advertising cookies or serve ads.

2 Uses of Personal Data

We use your personal data for the following purposes:

To provide, maintain, and operate the Services, including managing your business, orders, products, inventory, and customer records;
To create and administer your Casa account and the businesses and staff associated with it;
To process payments, wallet transactions, subscriptions, and withdrawals, and to keep accurate financial records;
To deliver notifications, reminders, and (where applicable) SMS and email messages related to your account, orders, appointments, and subscriptions;
To communicate with you about the Services, including service announcements and support;
To prevent and investigate fraud, abuse, and violations of our Terms of Service;
To investigate and resolve disputes and security issues;
To debug and repair errors and maintain reliable service;
To improve the Services through aggregated, de-identified usage analytics; and
To comply with our legal and regulatory obligations.

What we do NOT do with your data

We do not sell your personal data.
We do not serve advertisements. Your data is never used for ad targeting or shared with advertisers.
We do not use your business or customer records for any purpose beyond operating the Services and the purposes described in this Policy.

3 How We Disclose Personal Data

Casa discloses personal data to the following categories of third parties:

Payment processors: Payment information is shared with our payment partners to process mobile money and card transactions, wallet top-ups, and withdrawals. These providers process your data under their own privacy policies.
Messaging and notification providers: We use SMS and email providers (such as Africa's Talking and our email delivery provider) and push-notification infrastructure to send you account, order, and subscription messages.
Infrastructure providers: We use cloud hosting, database, and file-storage services (including our cloud storage provider) that process data on our behalf as service providers.
Within your business: Information added to a business is visible to the owners, managers, and staff you authorize on that business, according to their roles and permissions.
Between you and businesses you transact with: When you place an order or make a payment, the relevant business receives the information needed to fulfil it.

Casa may also disclose personal data in the following circumstances:

As part of a significant corporate event: If Casa is involved in a merger, acquisition, or other transfer of business assets, your personal data may be transferred as part of that transaction.
Pursuant to legal requirements: We may disclose personal data to governmental authorities as required by law, in response to legal process, to protect the health and safety of any person, to protect against fraud, or to enforce our legal rights.
With your consent: We will disclose personal data when you give us permission to do so.

4 Rights and Choices

Depending on where you live and applicable laws, you may have the following rights regarding your personal data. We may decline a request if we have a lawful reason for doing so.

To exercise your rights, email us at privacy@getcasaapp.com. We may verify your identity before processing your request. Casa will not discriminate against you for exercising your privacy rights.

Right to know: The right to know what personal data we process about you, the sources, purposes, and third parties we share it with.
Access & data portability: The right to request a copy of your personal data, and in certain cases, to port your information.
Deletion: The right to request deletion of your personal data and to close your account. Note that some records (such as financial and transaction records) may be retained where required by law.
Correction: The right to request correction of inaccurate personal data.
Objection: The right to object to processing of your personal data on grounds of legitimate interest.
Restriction: The right to restrict our processing of your personal data in certain circumstances.
Withdrawal of consent: Where processing is based on consent, you have the right to withdraw it at any time.
Marketing choices: You can opt out of promotional communications at any time through your account settings or by following the unsubscribe instructions in the message.

Casa does not engage in automated decision-making that produces legal effects or similarly significant effects on you.

5 Data Transfers

When you use the Services, your data may be transferred to and processed on servers located outside your home country, including those of our infrastructure, payment, and messaging providers. Where required by applicable law, we use appropriate legal frameworks, such as standard contractual clauses, to safeguard international transfers.

6 Data Retention and Security Controls

Casa retains your personal data for as long as reasonably necessary to provide the Services and for the purposes outlined in this Privacy Policy. When data is no longer needed, we delete, destroy, or anonymize it as required by applicable law. Some financial and transaction records may be retained for longer periods to comply with legal and accounting obligations.

Aggregated or De-Identified Information

We may process data in aggregated or de-identified form to analyze service effectiveness and improve the user experience. For example, we analyze aggregated usage patterns and error rates to improve the Services. This information does not identify individual users.

Security Controls

We implement appropriate technical and organizational security measures designed to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction. These include encryption in transit, access controls, and role-based permissions within businesses. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7 Your Content and Data

Your data belongs to you. The business records, customer data, files, and other content you create through the Services are yours. Casa does not claim ownership of your content and does not use it beyond what is necessary to operate the Services and the purposes described in this Policy.

You may export, modify, or delete your content at any time, subject to legal retention requirements.

8 Children

The Services are not directed to, and are not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children under 18. If you are under 18, please do not use the Services or provide us with any personal data. If you believe a child under 18 has provided us with personal data, email us at privacy@getcasaapp.com and we will take reasonable steps to investigate and delete that information.

9 Changes to Our Privacy Policy

Casa may update this Privacy Policy from time to time. We will notify you of material changes and update the date at the top of this page. You can request a summary of changes by contacting us.

10 Contact Information

If you have questions about this Privacy Policy or your personal data, contact us:

Casa Management Solutions
Sir Apollo Kaggwa Road, Kampala, Uganda
Email: privacy@getcasaapp.com
Website: getcasaapp.com
Hours: Mon. â€“ Fri. 8AM â€“ 6PM

Under many countries' laws, you have the right to lodge a complaint with the supervisory authority in the place in which you live or work.

11 Legal Bases for Processing

Where required by law, we rely on the following legal bases to process your personal data:

Purpose	Type of Data	Legal Basis
To provide and operate the Services	Identity and Contact Data, Business Information, Transaction and Order Data, Files	Contract
To create and administer your account and businesses	Identity and Contact Data, Business Information	Contract
To process payments, wallets, and subscriptions	Identity and Contact Data, Payment Information, Transaction Data	Contract, Legal obligation
To send notifications, reminders, and service messages	Identity and Contact Data, Technical Information	Contract. Consent where required.
To prevent fraud, abuse, and Terms violations	Identity and Contact Data, Transaction Data, Technical Information	Legitimate interests, Legal obligation: Protecting our business, users, and systems from harmful activity.
To investigate and resolve disputes	Identity and Contact Data, Transaction Data, Feedback	Legitimate interests, Legal obligation: Resolving complaints and meeting legal obligations.
To investigate and resolve security issues	Identity and Contact Data, Technical Information	Legal obligation, Legitimate interests: Protecting user data and system integrity.
To debug and repair errors	Technical Information, Feedback	Legitimate interests: Maintaining reliable service operation.
To improve the Services through aggregated analytics	Technical Information, de-identified usage data	Legitimate interests: Understanding usage patterns to improve service quality.
To enforce our Terms of Service	Identity and Contact Data, Transaction Data, Technical Information	Contract, Legitimate interests: Maintaining a safe and functional platform.

Table of Contents