Privacy notice

This notice covers how Juto Technologies Limited (“Juto”, “we”) collects and uses personal data through the marketing site at getjuto.com and, when you subscribe, through the Juto product. It is written to satisfy the Nigeria Data Protection Regulation (NDPR), the UK GDPR, and the EU GDPR.

Who we are

The data controller for the site, the waitlist, and your account details is Juto Technologies Limited. For the accounting records your organisation keeps in Juto, your organisation is the controller and we are its processor. You can reach us at [email protected] for any privacy question, including to exercise the rights described below.

What we collect

We collect personal data in three ways:

1. Waitlist form. When you submit the form at getjuto.com/waitlist, we collect your name, work email, company name, your role, and the country your team is based in. You provide all of this voluntarily.
2. Aggregated traffic analytics. Our analytics record anonymised, aggregated visit data: pages viewed, referrer, country at country level, browser type. They do not set cookies, do not fingerprint visitors, and do not collect anything that identifies you personally.
3. Your Juto account. When you create an organisation or are invited to one, we collect your name, email address, role, and sign-in details, and we log sign-ins and the actions taken in the app for security and audit. When you subscribe we collect billing details: the organisation’s name, address and tax number, the payment method’s type, last four digits and expiry, and a record of each payment. Full card numbers go straight to our payment processor and never reach Juto. The accounting data your organisation enters (contacts, invoices, bank transactions, payroll) may include personal data about your customers, suppliers and employees; we process it only on your organisation’s instructions.

Why we use it

Waitlist data is used to contact you about Juto’s launch, the Nigerian pilot, and product updates relevant to the role and country you told us about. Lawful bases: your consent (NDPR §2.2 · UK/EU GDPR Art. 6(1)(a)) and our legitimate interest in pre-launch outreach (Art. 6(1)(f)). You can withdraw consent at any time.

Analytics data is used to understand which content lands (for example, which markets are visiting) and to improve the site. The lawful basis is our legitimate interest in measuring marketing effectiveness; because the data is not personal in the GDPR sense, no consent is required.

Account and billing data is used to provide the service, take payment, send invoices, receipts and service notices, keep the service secure, and meet our own accounting and tax obligations. The lawful bases are performance of our contract with you (Art. 6(1)(b)), our legal obligations (Art. 6(1)(c)), and our legitimate interest in running the service securely (Art. 6(1)(f)). Product updates and marketing go only to people who have opted in, and every such email has an unsubscribe link.

Who we share it with

We share personal data only with the categories of provider needed to run the service. Providers that process it on our behalf are bound by contract to use it solely on our instructions; payment processors, as noted below, also act as controllers of the payment data they hold, under their own privacy terms. None of them sell or repurpose your data:

• Hosting and infrastructure providers: the servers, databases, backups, content delivery, security services and aggregated site analytics the site and the product run on.
• Payment processors take your payment, hold your card or bank details, and tell us whether a payment succeeded. A processor is a controller in its own right for the payment data it holds.
• Email delivery providers send waitlist confirmations, invoices, receipts and service notices; they process the email address and the content of the message.
• Bank connection providers retrieve transactions from your bank, with your consent, when your organisation links a bank account. You choose whether to connect a bank at all.
• AI model providers: where your organisation turns on JutoAI features, the text of the records being categorised or summarised is sent for processing and is not used to train the provider’s models.

We may also disclose data where the law requires it, for example to a tax authority or a court, and to professional advisers under a duty of confidence. We do not share personal data with advertisers or data brokers. We will name a specific provider on request at [email protected].

How long we keep it

Waitlist records are kept until either (a) you become a customer, at which point your data continues under this notice as account data, or (b) you ask us to delete it, or (c) two years pass with no contact between us, whichever happens first.

Aggregated analytics are kept for 12 months.

Account, billing and accounting data is kept for as long as your organisation has a subscription, and afterwards in read-only mode until you ask us to delete it, so that you can export it and so that your records remain available for the statutory retention periods that apply to accounts. We will not delete a cancelled organisation’s data without emailing its administrators at least thirty days beforehand. Invoices and payment records are kept for the period our own tax law requires, currently six years.

Your rights

Under NDPR and UK/EU GDPR you can ask us to:

• Confirm what personal data we hold about you and provide a copy (right of access);
• Correct inaccurate data (right to rectification);
• Delete your data (right to erasure / right to be forgotten);
• Pause processing while a dispute is resolved (restriction);
• Receive your data in a portable format (portability);
• Object to our processing on legitimate-interest grounds.

Email [email protected] from the address you signed up with and we will action requests within 30 days. Where the data is your organisation’s accounting records, we will refer the request to the organisation’s administrators, who control it. If you are unhappy with our response you can lodge a complaint with the Nigerian Data Protection Commission (NDPC), the UK Information Commissioner’s Office (ICO), or your local EU supervisory authority.

Security

All traffic to the site and the product travels over HTTPS. Bank connection credentials and other sensitive fields are encrypted in the database, access by Juto staff is restricted to what their role needs, every change to a record is audited, and every organisation’s data is separated from every other’s. Card details are handled entirely by our payment processor; Juto stores only the card type, last four digits and expiry.

International transfers

Some of our providers operate outside Nigeria, the UK and the EEA. For UK/EU residents, transfers outside the UK/EEA rely on the UK’s International Data Transfer Agreement and the EU Standard Contractual Clauses where applicable. For Nigerian residents, transfers comply with NDPR §2.11 (transfer to foreign country).

Changes to this notice

If we change anything material, we will email everyone on the waitlist and every organisation’s administrators before the change takes effect and update the date at the top of this page.

Questions? Email [email protected].