Privacy Policy

About This Policy

This Privacy Policy explains how Kishea Technologies SMC Ltd, trading as HotPass ("we", "us", "our"), collects, uses, stores, and shares personal data when you use the HotPass platform, whether as an agent (reseller), a WiFi customer, or a visitor to our website at hotpass.app.

HotPass is a WiFi hotspot billing platform operating in Uganda. It enables agents to sell prepaid internet access to customers, collect payments via Mobile Money (MTN MoMo and Airtel Money), and manage connected devices on MikroTik routers.

This policy is issued under the Uganda Data Protection and Privacy Act 2019 (DPPA) and its associated regulations. By registering as an agent or purchasing WiFi through a HotPass-powered hotspot, you acknowledge that your personal data will be processed as described in this document.

Data Controller

The data controller responsible for your personal data is:

For all data protection matters, privacy requests, and complaints, please use the contact details above or those in Section 14.

Definitions

Data We Collect

The data we collect depends on your role and how you interact with the platform.

4.1 Agent & Account Data

When you register as a HotPass agent, we collect:

• Full name — for account identification and customer-facing branding.
• Phone number — your primary login credential and the number used to receive WhatsApp notifications and one-time passwords (OTPs).
• Email address — optional; used for account alerts and voucher notifications if you opt in.
• PIN — stored as a one-way cryptographic hash (BCrypt). We cannot read or recover your PIN.
• Mobile Money withdrawal number — the phone number to which your earnings are disbursed. May be different from your login number.
• Account balance and transaction history — earnings, commissions, platform fees, and withdrawal records.
• Login activity — timestamps of login attempts, failed attempts, and account lockout events for security purposes.

4.2 Customer / End-User Data

When someone buys WiFi through a HotPass-powered hotspot, we collect:

• Mobile Money phone number — provided by the customer to initiate the STK push payment. This number is stored with the payment record and may be used to send the voucher code via WhatsApp.
• Payment amount and status — the amount paid, the package purchased, and the outcome of the Mobile Money transaction.
• Voucher code — the code assigned to and used by the customer.
• Provider identity — we resolve the phone prefix to determine whether the number is MTN or Airtel (used for routing the payment).

4.3 Network & Session Data

When a customer's device connects to a HotPass hotspot, the MikroTik router reports the following session accounting data to our platform via RADIUS:

• MAC address — the hardware identifier of the connecting device, used to track session state and enforce access control.
• IP address — the private IP assigned to the device on the local hotspot network.
• Device hostname — the name broadcast by the device (e.g. "Galaxy-S24"), if available. This is device-reported and not verified.
• Session duration — cumulative seconds of connectivity.
• Data usage — cumulative megabytes uploaded and downloaded during the session.
• Session start and end timestamps.

4.4 Device Whitelist Data

Agents may whitelist specific devices (e.g. smart TVs or set-top boxes) that cannot authenticate through a captive portal. For these devices we store the MAC address, an agent-assigned label, and the subscription details (package, payment method, expiry date). This data is held under the agent's account and may include the MAC address of a device belonging to the agent's customer.

4.5 Technical & Usage Data

When you use the HotPass web dashboard or API, we may collect:

• Browser type and version (from HTTP User-Agent headers).
• IP address of the device used to access the dashboard.
• Actions performed in the dashboard (for audit logging and security).

We do not use third-party analytics tools (e.g. Google Analytics) on the dashboard.

How We Use Your Data

We process personal data only for the purposes listed below, on the lawful bases identified under the Uganda DPPA 2019.

Data Sharing & Third Parties

We share personal data with third parties only where necessary to deliver the service, as described below.

6.1 Payment Processor

All Mobile Money transactions (MTN MoMo and Airtel Money) are processed through a licensed payment aggregator operating in Uganda. When a customer initiates a payment, their phone number and payment amount are transmitted to the payment processor to initiate the STK push. The processor returns a transaction reference and final status. We share no data beyond what is required to complete the transaction. The payment processor's own privacy terms apply to their processing of this data. HotPass reserves the right to change payment processors at any time.

6.2 WhatsApp / Meta

Voucher codes and account notifications may be sent to agents and customers via WhatsApp. Message delivery is facilitated through an automated bot. When a message is sent, the recipient's phone number and the message content are transmitted to WhatsApp's servers (operated by Meta Platforms). Meta's Privacy Policy governs the handling of this data. We do not send marketing messages via WhatsApp without prior consent.

6.3 Microsoft Azure (Cloud Hosting)

The HotPass platform is hosted on Microsoft Azure virtual machines and SQL databases. All agent and customer data resides on these servers. Microsoft processes this data as a data processor on our behalf under a Data Processing Agreement that includes standard contractual clauses for international transfers. Azure's data centre regions used may be outside Uganda; see Section 12.

6.4 Anthropic (AI Intent Classification)

The HotPass WhatsApp bot uses the Anthropic API to classify customer message intent (e.g. "buy WiFi", "check balance"). Only the text of the customer's WhatsApp message — with no personally identifiable context — is sent to the API. Phone numbers and account details are not included in API requests. Anthropic processes this data under its own privacy policy.

6.5 Law Enforcement & Regulators

We may disclose personal data to competent Ugandan authorities (including the Uganda Communications Commission, Uganda Revenue Authority, and law enforcement agencies) when legally compelled to do so by court order, regulatory requirement, or other legal process. We will notify affected users where we are legally permitted to do so.

6.6 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity. We will notify affected users and require the successor to honour this Privacy Policy.

Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law.

After the applicable retention period, data is either permanently deleted or anonymised so that it can no longer be linked to any individual.

Your Rights Under the Uganda DPPA 2019

The Uganda Data Protection and Privacy Act 2019 grants you the following rights in relation to your personal data. You may exercise any of these rights by contacting us as described in Section 14.

We will respond to all verified requests within 30 days. For complex requests we may take up to 60 days, in which case we will notify you of the extension. We will not charge a fee for exercising your rights unless the request is manifestly unfounded or excessive.

Security

We implement technical and organisational measures proportionate to the risk of processing your personal data, including:

• Password / PIN hashing — PINs are hashed using BCrypt with a cost factor of 11. We cannot recover or read your PIN.
• Encrypted transit — All data transmitted between your browser, the HotPass servers, and third parties is encrypted using TLS 1.2 or higher (HTTPS).
• Authentication controls — Login is protected by PIN + OTP. Accounts are locked after repeated failed attempts.
• Role-based access control — Agents can only access data belonging to their own account. Platform administrators have audited and logged access.
• Infrastructure hardening — The production server runs on Microsoft Azure with firewall rules, encrypted storage, and restricted SSH access via key authentication only.
• API authentication — Internal API endpoints (bot ↔ platform) are protected by a shared secret key. Payment callbacks are validated by signature.

Despite these measures, no system is completely immune to breach. In the event of a data breach that is likely to result in high risk to your rights and freedoms, we will notify the Personal Data Protection Office of Uganda within 72 hours and affected individuals without undue delay, as required by the DPPA.

Cookies & Session Storage

The HotPass web dashboard uses the following browser storage mechanisms:

We do not use advertising cookies, third-party tracking cookies, or analytics cookies. The public landing page (hotpass.app) does not set any cookies on visitors who are not logged in.

Children's Privacy

HotPass is intended for use by adults aged 18 and over. Our Terms of Service require agents to be at least 18 years of age. We do not knowingly collect personal data from children under the age of 18.

If you are a parent or guardian and believe that a child under 18 has provided personal data to us, please contact us immediately at [email protected]. We will promptly investigate and delete any such data.

We note that end-user customers (WiFi buyers) interact only through a payment prompt and receive a voucher code. They do not create accounts. While we cannot verify the age of every customer, agents are contractually responsible for ensuring their hotspot services comply with applicable age restrictions at their premises.

Cross-Border Data Transfers

Your personal data may be stored on or processed by servers located outside Uganda, specifically:

• Microsoft Azure — cloud infrastructure may be hosted in European or US data centres depending on service region selection. Microsoft provides appropriate safeguards through its Data Processing Agreement and Standard Contractual Clauses.
• Anthropic (API) — message text sent for intent classification is processed on servers in the United States. No personally identifiable data is included in these requests.
• WhatsApp / Meta — message notifications are delivered through Meta's global infrastructure.

Where personal data is transferred internationally, we ensure that appropriate safeguards are in place consistent with the requirements of the Uganda DPPA 2019, including contractual protections and, where applicable, adequacy assessments.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or legal requirements. When we make material changes, we will:

• Update the "Effective Date" at the top of this page.
• Notify registered agents via WhatsApp or email (if opted in) at least 14 days before the changes take effect.
• Display a notice on the agent dashboard.

Your continued use of HotPass after the effective date of revised terms constitutes acceptance of the updated policy. If you do not agree with the changes, you may close your account before the effective date.

Contact & Complaints

For all privacy-related questions, access requests, corrections, or complaints, please contact us:

Right to Lodge a Complaint

If you are not satisfied with our response to a privacy request or complaint, you have the right to lodge a complaint with the Personal Data Protection Office of Uganda (PDPO), the national supervisory authority established under the Uganda DPPA 2019:

• Office: Personal Data Protection Office, Ministry of ICT & National Guidance, Kampala, Uganda
• Website: pdpo.go.ug

For disputes involving Mobile Money transactions, you may also contact the Uganda Communications Commission (UCC) or the relevant Mobile Money provider (MTN Uganda, Airtel Uganda).