Privacy Policy

BMS - Business Management System · Last updated: 6 November 2026

This policy explains what information BMS – Business Management System ("BMS", "we", "us") collects, why, and what choices you have. We follow the principles of the Data Protection and Privacy Act, 2019 of Uganda.

1. Who is responsible

When a business uses BMS, the business owner decides what customer, supplier and employee information is entered into it. For that information the business is responsible, and BMS stores it for the business and protects it on the business’s behalf.

For the information we need to run accounts, subscriptions and support (for example the account holder’s name, phone and email), BMS is responsible.

2. Information we collect

Account details: name, phone number, email address and password (stored in protected form).
Business details: business and branch names, addresses, tax number, logo, settings and subscription records.
Business records entered by users: products, stock, sales, receipts, returns, expenses, customers, suppliers and employees (including names, phone numbers and roles).
Branch location: the location of a branch, captured once so the owner can confirm where the branch operates.
Technical information: device status, the number of items waiting to be sent, error information, and the activity log of who did what and when.
Messages: the content and delivery status of SMS messages sent through BMS, such as password-reset codes, credit reminders and receipts.

3. How we use information

To provide and maintain BMS and keep your records in sync across your devices.
To sign you in, reset passwords and protect accounts.
To send messages you or your business ask BMS to send.
To process subscriptions and keep payment records.
To give support and to find and fix problems.
To improve the service.

4. Who we share information with

We do not sell your information. We use trusted service providers who process it only to deliver BMS: cloud database and sign-in hosting (Supabase), SMS delivery (Africa’s Talking), email delivery, and mobile-money payment providers when subscriptions are paid. We may also disclose information when the law requires it.

5. Where information is stored

Your information is stored with our cloud database provider and may be processed outside Uganda. We take steps to make sure it stays protected wherever it is processed.

6. Security

We use sign-in protection, access rules that keep each business’s data separate, encrypted connections and regular backups. No online system is perfectly secure, so please keep your password private and sign out on shared devices.

7. How long we keep information

We keep information while your account is active and for as long as needed to meet legal duties, settle disputes and enforce agreements. When an account is deleted we delete or anonymise the data, except what the law requires us to keep. Backups are removed on their normal schedule.

8. Your rights

You may ask to see the personal information we hold about you, correct it, or ask us to delete it, and you may object to certain uses. If your information was entered by a business (for example you are a customer of a shop that uses BMS), please ask that business first. To make a request to us, see “Delete my data” or contact us below. You may also complain to the Personal Data Protection Office in Uganda.

9. Children

BMS is for businesses and is not meant for children. We do not knowingly collect information from children.

10. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change is important we will tell account holders in the app or by email.