Privacy policy

KaWifi Billing System (“Kawifi”, “we”) runs Wi-Fi hotspot billing for internet service providers (“ISPs”) in Uganda. This policy explains what information we collect, why, how we protect it, and your rights under the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.

1. Who is responsible

For ISP accounts and staff, Kawifi decides how information is used. For people who buy internet at a hotspot, the ISP that runs the hotspot is responsible for its customers’ information and Kawifi processes it on the ISP’s behalf, only to run the service.

2. Information we collect

ISP owners, staff and resellers

• Name, email address, phone number and business name and contacts.
• Your password (stored only as a one-way scrambled value), your Google account ID if you sign in with Google, and the authenticator-app setting used for two-step sign-in.
• Sign-in and security records, and the actions you take in your account.
• For resellers: sales made, amounts and commission.

People who buy and use hotspot internet

• Phone number, when you pay with mobile money or ask for your code by SMS.
• Purchase records: package, amount, time, order reference and the payment reference from the mobile money service. We never see or store your mobile money PIN.
• Connection records: your voucher code, your device’s MAC address and IP address on the hotspot, the router used, login and logout times and the amount of data used.

Login page campaigns

• Only counts of how many times each campaign was shown and tapped, per router and day. No personal information.

Our website

• Cookies needed to keep you signed in and protect forms, and your light or dark mode choice saved in your browser. We do not use advertising or tracking cookies.

What we do not collect

We do not record the websites you visit or the content of your communications, and we do not collect mobile money PINs, bank card numbers or national ID numbers.

3. Why we use it

• To sell and deliver internet vouchers, process mobile money payments and send your code by SMS.
• To let you connect, count your time and data, and stop access when a voucher ends.
• To run ISP accounts: billing, subscriptions, reports, reseller commission and support.
• To keep accounts and the service secure and to prevent fraud and misuse.
• To meet our legal obligations, such as keeping financial records.

We use information only for these purposes, on the basis of your consent, the contract to provide the service, or a legal duty.

4. We do not share or sell your information

We do not sell, rent or share your personal information with anyone for marketing or any other purpose. Information leaves Kawifi only in these limited cases, and only what is strictly needed:

• the mobile money service receives your phone number and the amount, so that it can ask you to approve the payment;
• the SMS service receives your phone number and message, so that your code reaches you;
• the ISP whose hotspot you use can see the purchases and connections made on its own hotspot;
• when Ugandan law requires it, for example a court order or a lawful request from an authority.

These services must keep the information confidential and use it only to deliver their part of the service.

5. How we protect it

Connections use encryption (HTTPS). Keys and secrets are stored encrypted, passwords are never stored in readable form, and platform admins and ISP owners must use two-step sign-in. Each person sees only the information their role needs, and every ISP sees only its own records.

6. How long we keep it

Purchase and payment records are kept for as long as the law requires financial records to be kept. Detailed connection records are kept only as long as needed for billing, support and security, then reduced to totals or deleted. When an ISP account closes, its information is deleted or anonymised unless the law requires us to keep it.

7. Your rights

Under the Data Protection and Privacy Act, 2019 you may ask to see the information we hold about you, have it corrected, have it deleted where we no longer need it, object to its use, or withdraw your consent. Write to info@kawifi.net; we will reply within 30 days. Hotspot customers can also contact the ISP that runs the hotspot. If you are not satisfied, you may complain to the Personal Data Protection Office under the National Information Technology Authority – Uganda (NITA-U).

8. Children

ISP accounts are for adults (18 years and over). Young people using a hotspot should do so with a parent’s or guardian’s permission.

9. Changes

We will post any change to this policy on this page with a new date, and tell ISP owners by email about important changes.

Last updated 8 November 2026. Questions: info@kawifi.net, Kampala, Uganda.