Privacy notice

Who we are

TapTip is run by TAPTIP INVESTMENT LTD. We decide how the personal data described here is used, so under Zambia's Data Protection Act, 2021 we are its data controller.

Company

TAPTIP INVESTMENT LTD, a private company registered in Zambia

Registration (PACRA)

to be added

Registered address

to be added

Phone

to be added

Email

hello@taptipzm.com

Data protection officer

hello@taptipzm.com

Data Protection Commissioner registration

to be added

If you tip or pay

You don't need an account. For each tip or payment we keep:

• the amount, currency, exchange rate and fee, and whether you chose to cover the fee;
• which badge, staff member or business it was for, and when;
• the reference our payment partner gives the payment, and its status;
• a reference you type yourself on a business's payment page, if you choose to (for example an invoice number);
• a first name and a note for the person you tipped, if you choose to add them. They see both in their TapTip app and in the SMS telling them about the tip. Leave them out if you'd rather;
• if you pay by mobile money: your mobile money number and network, so our payment partner can ask you to approve the payment, and so we can refund you or answer a question about the payment. The person or business you paid doesn't see your number.

We do not see or keep your card number, your name on the card, your mobile money PIN or your email. If you pay by card, we don't keep your phone number. If you ask for your receipt by email, we use the address once to send it and don't save it; we only note that a receipt was emailed. You pay on our licensed payment partner's page, or with Apple Pay or Google Pay, and they handle your payment details under their own privacy policy. The receipt page shows only the payment's own details and your note.

Why: to process and record the payment, to pay the person or business you chose, to prevent fraud, and to keep the financial records the law requires.

If you receive tips (guides and staff)

• your name, phone number, workplace and role, and a photo if you add one;
• your mobile money number and network for payouts, and any change to them;
• the tips you receive, their holds and payouts;
• your trust level and limits, the business teams you belong to, whether you want SMS updates, and when you last signed in;
• when you agreed to our terms and this notice, and which version.

Guests who scan your badge see your first name, your photo, your role and your workplace, so they know they are tipping the right person. Your full name, phone and payout number are never shown to them. A business you work for sees the tips its team receives.

Why: to give you a badge, pay you, show your history and statements, keep tips safe from fraud, and keep the records the law requires. We rely on our agreement with you (the terms) and on the law. Sign-in is by a code sent to your phone; the code is not stored after it is used.

If you run a business on TapTip

• the business's name, type, town, logo, PACRA number and TPIN;
• the names, phones and roles of its owner, managers and staff;
• its payout details: a mobile money number, or a bank account;
• its payments, payment links, statements and tips;
• verification documents: the PACRA certificate, the TPIN certificate, and the owner's NRC (front and back).

Verification documents

An NRC shows a person's photo and sex, which the Data Protection Act treats as sensitive. We ask for the owner's explicit consent before it is uploaded, use it only to check that the business and its owner are real (as our payment partners and anti-money-laundering rules require), and keep it encrypted, on servers in Zambia only. Only TapTip's verification team can open it, and every time they do is recorded. We never ask for documents by WhatsApp or email.

If you join the waitlist

• your name, phone number, whether it is on WhatsApp, and your email if you give it;
• where you are based, and for businesses its name, type and team size, or for staff your role, workplace and network;
• any message you send, how you found us (for example a campaign link), and when you gave consent.

Why: only to tell you when TapTip opens in your area and to plan where to start. We rely on your consent, which you can withdraw at any time.

Everyone who visits taptipzm.com

Our web server records each request (the address, your IP address, your browser and the time) to run and protect the site; these records are deleted after 14 days. Two necessary cookies keep you signed in and protect forms; we use no analytics, advertising or tracking cookies.

Who we share it with

• Licensed payment partners, who take payments and send payouts: what each payment or payout needs, and a business's verification details where they must check them.
• Service providers that run TapTip for us (hosting, email and text-message delivery), only to do that work, under agreements that require them to protect it.
• Authorities such as the Financial Intelligence Centre, the Bank of Zambia, the Zambia Revenue Authority or the police, only where the law requires it or a court orders it.

We tell you before we share your data with anyone else, and ask for your consent. We never sell it.

Where it is kept

The Data Protection Act asks for personal data to be kept on servers in Zambia. Today our servers are in Germany, on a server rented from Hostinger. Verification documents are only accepted once we can keep them in Zambia. Card payments are processed by our payment partner and the card networks, which can involve their systems outside Zambia.

How long we keep it

Fraud checks

To keep tips safe, every tip waits a short time before it is paid out, and a tip that looks unusual can be held for longer. A hold is decided automatically, but it never takes money away: a person on our team reviews any tip that stays held, and you can ask for that review and explain.

How we protect it

Sign-in by a one-time code to your phone; encrypted documents; access to personal data only for team members who need it, with access recorded; changes to a payout number confirmed by code and announced to the old number, with a 24-hour wait. If personal data is ever exposed, we tell the Data Protection Commissioner within 24 hours and tell you as soon as we can.

Your rights

Under the Data Protection Act, 2021 you can:

• ask whether we hold data about you, and get a copy of it (the first copy is free);
• have it corrected, or completed;
• have it deleted, unless the law requires us to keep it (for example tip and payment records);
• object to how we use it, or ask us to pause using it;
• take it to another service, in a common format;
• withdraw your consent at any time, without affecting what was done before;
• ask for a person to review any automatic decision, such as a fraud hold.

If you have an account, Settings › Your data in the TapTip app lets you download your data or close your account. For anything else, email hello@taptipzm.com. We reply within 30 days. You can also complain to the Office of the Data Protection Commissioner.

Children

TapTip accounts are for people aged 18 and over. We don't knowingly keep data about children; if you think we have, email us and we will delete it.

Changes

If we change how we use personal data, we will update this page and its date. If a change needs your agreement, the app will ask you before it applies.

See also our terms and our refunds and complaints policy.