1. Who is behind Shahidi Box
Shahidi Box is a product of Receipters Technologies Limited (“Receipters”). Receipters Technologies Limited is the data controller for Shahidi Box under the Kenya Data Protection Act, 2019, and the company you contract with under our Terms and conditions.
General contact: receipters@receipters.com.
2. How seriously we take data compliance
A receipt shows what you bought, where and when. That is personal. So we treat data compliance as part of how Shahidi Box is built, not as a notice added at the end. This is what we hold ourselves to.
| We commit to | What that means |
|---|---|
| Follow the law. | Receipters Technologies Limited is the data controller under the Kenya Data Protection Act, 2019. We follow the Act and the regulations made under it, including the Data Protection (General) Regulations, 2021. |
| Register with the regulator. | We will register with the Office of the Data Protection Commissioner (ODPC) before Shahidi Box opens to the public, and keep that registration up to date. |
| Collect the least. | We keep only what we need to run your box. We never sell, rent or trade data, and this website uses only essential cookies, with no advertising or analytics. |
| Seal your receipts. | Receipts are sealed with a key that belongs to you, so Receipters cannot read them. Matching a receipt to you uses one-way fingerprints of phone numbers, email addresses and KRA PINs, not the details themselves. |
| Answer your requests on time. | You can see, correct, export or delete your data, or withdraw consent. The Data Protection (General) Regulations, 2021 give 7 days to give you access to your data and 14 days to correct or delete it, and we work to those limits. See your rights. |
| Report a breach quickly. | If a breach puts your data at real risk, we will tell the ODPC within 72 hours of becoming aware of it, and tell the people affected as soon as is reasonably practical. |
| Mind where data goes. | The website is hosted on Amazon Web Services in the United States (North Virginia). The Act sets conditions for sending personal data outside Kenya, and we will meet them before launch. |
| Treat requests from authorities with care. | We answer only valid, narrow requests, and tell the person concerned unless the law forbids it. See requests from authorities. |
| Keep these notices honest. | These pages are a pre-launch version. We will review them and bring them up to date before we open to the public, and we will say what changed. |
Questions about your data? Write to receipters@receipters.com with the subject “Data request”. A person reads every message. If you are not happy with our answer, you may complain to the ODPC at www.odpc.go.ke.
3. Offices that deal with data compliance
These are the Kenyan offices that have a say in how personal data is protected, kept secure and recorded. The first is our regulator. The others matter to us, or to you, in the ways shown.
| Office | What it does about data | How it touches Shahidi Box |
|---|---|---|
| Office of the Data Protection Commissioner (ODPC) www.odpc.go.ke | Set up by the Data Protection Act, 2019. Keeps the register of data controllers and processors, receives and investigates complaints and breach notices, issues enforcement and penalty notices, can order compensation, and publishes guidance. | Our data protection regulator. We will register here, report breaches here, and you can complain here. |
| Cabinet Secretary for ICT (Ministry of Information, Communications and the Digital Economy) | Makes regulations and guidelines under the Data Protection Act, working with the Data Commissioner. | Sets rules we must follow, such as the Data Protection (General) Regulations, 2021. |
| Communications Authority of Kenya (CA) www.ca.go.ke | Regulates communications under the Kenya Information and Communications Act, 1998, and builds the national cybersecurity framework. Runs the National KE-CIRT/CC, the national point of contact for cybersecurity, which works around the clock. | Where a cyber incident that affects Kenya can be reported. |
| National Computer and Cybercrimes Coordination Committee (NC4) | Created by the Computer Misuse and Cybercrimes Act, 2018. Coordinates the national effort to detect, prevent, respond to, investigate and prosecute cybercrime. The ODPC and the Communications Authority sit on it. | The Act makes it a crime to get into, change or intercept someone else’s computer data without permission. That covers anyone who tries to break into a box. |
| Office of the Director of Public Prosecutions (ODPP) and the National Police Service www.odpp.go.ke | The police investigate, and the ODPP prosecutes, offences under the Computer Misuse and Cybercrimes Act and the Data Protection Act. | Where a crime against your box or your data is reported and taken to court. |
| Central Bank of Kenya (CBK) www.centralbank.go.ke | Supervises banks, payment service providers and digital lenders, and sits on the NC4. | Shahidi Box does not take or move money. If that ever changes, the rules for payments will apply to us too. |
| Kenya Revenue Authority (KRA) www.kra.go.ke | Runs eTIMS, the system that signs receipts, and holds the official tax record. | Not our regulator, and not connected to us. The official record stays with the seller and KRA. Shahidi Box keeps a faithful copy. See KRA and eTIMS. |
This list covers the offices that matter to Shahidi Box today. If we add a feature that falls under another regulator, we will add that office here. If you live outside Kenya, the data protection authority in your own country can also help you.
4. KRA and eTIMS
Shahidi Box is an independent product. It is not affiliated with, endorsed by, or acting for the Kenya Revenue Authority. eTIMS is a system of the Kenya Revenue Authority. The signed receipt issued by the till, and the record held by the seller and KRA, stay the official record. Shahidi Box keeps a faithful copy, and is not tax or legal advice.
5. Our documents
| Document | What it covers |
|---|---|
| Privacy notice | What we hold, what we cannot see, how long we keep it, and your rights. |
| Terms and conditions | Using the website and early access, and the main terms of the service. |
| Cookie notice | The cookies this website sets, why, and how long they last. |
| Security | How receipts are sealed and masked, and how to report an issue. |
| Service Terms | The full agreement for the service. Shown to you for agreement when you open your box. |
6. Trademarks and copyright
- “Shahidi Box”, the Shahidi Box seal logo and the wordmark are marks of Receipters Technologies Limited. Please do not use them in a way that suggests we endorse you without our written permission.
- All other names, logos and product names belong to their owners, and are used only to identify them.
- © 2026 Receipters Technologies Limited. All rights reserved. The website’s text, design and code may not be copied or reused without our permission, except as the law allows.
7. Third-party software
- The Source Serif 4, Inter and Outfit typefaces are used under the SIL Open Font License 1.1, and are served from our own pages. Each is copyright its authors.
- The website is hosted on Amazon Web Services.
8. Requests from authorities
We answer lawful orders from Kenyan courts and authorities. We check that each request is valid and narrow, give only what the law requires, and tell the person concerned unless the law forbids it. Because receipts are sealed with your key, we cannot hand over their contents. We can provide only the limited records listed in our Privacy notice. Authorities should write to receipters@receipters.com with the subject “Legal request”.
9. Accessibility
We want everyone to be able to use this website. It is designed for keyboard use, screen readers and small screens, and uses clear text and strong contrast. If something is hard for you to use, tell us at receipters@receipters.com and we will fix it.
10. Who to write to, and for what
| Subject line | Use it for |
|---|---|
| Data request | Seeing, correcting, exporting or deleting your data, or withdrawing consent |
| Security report | Reporting a weakness or a suspected incident |
| Legal request | Court orders, notices and requests from authorities |
| Shahidi Box for my POS | Shops and POS vendors who want to connect |
| Accessibility | Problems using the website |
All of these go to receipters@receipters.com.