Terms and Conditions

Last updated: August 13, 2026

Effective: August 13, 2026 for organizations that register on or after this date. For organizations already using WilTrak on that date, these Terms take effect on September 12, 2026, or earlier if accepted in the dashboard.

These Terms are a binding agreement between WilTrak Ltd. (“WilTrak”, “we”, “us”) and the organization that registers for or uses WilTrak (the “Customer”, “you”). They govern the WilTrak website, dashboard, mobile app, APIs, and any related services (together, the “Service”).

Please read section 6 (What WilTrak is and is not), section 8 (Acceptable use and data integrity), section 17 (Disclaimers) and section 19 (Limitation of liability) carefully. They limit our obligations and allocate risk to you.

---

1. Acceptance and structure of this agreement

1.1 You accept these Terms by any of the following: creating a WilTrak account, clicking an “accept”, “sign up”, or “subscribe” control, paying a WilTrak invoice, or using the Service. If you do not agree, do not use the Service.

1.2 These Terms incorporate by reference:

• the Privacy Policy;
• the Data Processing Terms in Annex A below;
• the plan, price, entitlement and limit descriptions shown in the dashboard at the time of purchase; and
• any order form, quotation, enterprise agreement or statement of work signed by both parties.

1.3 Order of precedence. If there is a conflict, the following order applies, highest first: (a) a signed enterprise agreement or order form; (b) Annex A (Data Processing Terms); (c) these Terms; (d) the Privacy Policy; (e) dashboard and website content. Purchase-order terms, vendor-portal terms, and similar documents issued by you have no effect, even if we acknowledge or invoice against them.

1.4 If you use the Service on behalf of an organization, you represent that you are authorized to bind that organization, and “you” means that organization. If you have no such authority, you must not accept these Terms.

2. Definitions

• Account — a login identity for an individual user.
• Organization — the tenant workspace holding your records. All records are scoped to one Organization.
• Authorized User — an individual you permit to access your Organization (employees, contractors, field agents, auditors).
• Customer Data — everything you or your Authorized Users submit to, or generate in, the Service: producers, products, batches, pickups, collectors, facilities, shipments, recovery transfers, photos, GPS coordinates, documents, payouts, levy records, and related metadata.
• WilTrak Materials — the Service software, models, classifiers, report templates, barcode logic, documentation, and branding.
• Output — reports, certificates, dashboards, analytics, classifications, anomaly flags, and PDFs the Service generates from Customer Data.
• Personal Data, Data Subject, Data Controller, Data Processor, Processing — as defined in the Kenya Data Protection Act, 2019 (“KDPA”) and, where applicable, the EU/UK GDPR.
• Subscription — your paid or trial right to use a plan for a term.

3. Eligibility, authority and account ownership

3.1 You must be at least 18 years old and legally capable of entering contracts. The Service is not offered to consumers for personal use; it is a business-to-business service.

3.2 The Organization owns the Account, not the individual. The Organization named at registration is the customer of record and owns the Organization and all Customer Data in it. An individual Authorized User — including the person who happened to register first — acquires no personal right to the Organization, its data, or its subscription.

3.3 Ownership disputes. If we receive competing claims to control an Organization (for example, after a founder, director or administrator leaves), we may, at our discretion: (a) freeze administrative changes to that Organization; (b) require documentary proof of authority such as a certificate of incorporation, CR12, board resolution, or letter on letterhead from a director; and (c) act on the instructions of the party that we reasonably determine to be authorized. We are not obliged to adjudicate such disputes and are not liable for acting reasonably and in good faith on the evidence provided.

3.4 We may refuse registration, or close an Account, where we reasonably believe registration details are false, the applicant is a competitor evaluating the Service under false pretences, or the applicant is subject to sanctions or has previously been terminated for cause.

4. Accounts, access and security

4.1 You are responsible for all activity under your Organization, including activity by Authorized Users and by anyone using their credentials, whether or not authorized by you.

4.2 You must:

• keep credentials, passkeys, one-time codes and step-up factors confidential and not share them between individuals;
• create a separate Account for each individual — Account sharing is prohibited;
• promptly deactivate Accounts for people who leave your organization or change role;
• configure the security controls available on your plan (multi-factor authentication, passkeys, IP allowlisting, single sign-on) as appropriate to your risk; and
• notify us at support@wiltrak.tech without undue delay, and in any event within 24 hours, of any suspected compromise of an Account, device, API credential, webhook secret or SSO connection.

4.3 Different authentication factors give different levels of assurance. Hardware-backed passkeys (WebAuthn) in the dashboard provide the strongest confirmation for sensitive actions. Device biometrics and emailed one-time codes on the mobile app are convenience alternatives and are weaker. You choose which controls to enable and accept the residual risk of the ones you choose.

4.4 Devices. The mobile app stores session tokens and a queue of unsent records on the device, so field work continues offline. You are responsible for the physical and logical security of the devices your Authorized Users use, including screen locks, OS updates, and remote wipe when a device or worker leaves your control.

4.5 You must not attempt to access another Organization’s data, another user’s Account, or any part of the Service you are not authorized to use.

5. Licence to use the Service

5.1 Subject to these Terms and payment of fees, we grant you a non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Service during your Subscription, for your own internal business and compliance purposes, within the limits of your plan.

5.2 We reserve all rights not expressly granted. No rights are granted by implication or estoppel.

6. What WilTrak is — and what it is not

This section is fundamental to the pricing and allocation of risk in this agreement.

6.1 WilTrak is a record-keeping, tracking and reporting tool. It records what you and your Authorized Users tell it, applies rules and models to that input, and produces Output.

6.2 WilTrak is not a regulator, certifier or auditor. We are not NEMA, ODPC, KRA, any Producer Responsibility Organisation, or any other authority, and we are not affiliated with, endorsed by, or acting under delegated authority from any of them. Certificates, compliance reports, statutory reports and verification pages produced by the Service are records of data you submitted. They are not an independent verification, audit, attestation, accreditation, or certification by WilTrak that the underlying activity occurred, that the data is accurate, or that you are compliant with any law.

6.3 WilTrak does not provide legal, regulatory, tax, accounting or environmental-engineering advice. Recovery targets, levy rates, fee calculations, VAT rates, reporting deadlines and jurisdictional rules shown in the Service are provided for convenience, are derived from published sources that change, and may be incomplete or out of date. You remain solely responsible for determining and meeting your own obligations, including under the Sustainable Waste Management Act, 2022, the Extended Producer Responsibility Regulations, and any successor or equivalent instrument in your jurisdiction. Verify anything material with the regulator or your own advisers before relying on it.

6.4 You are solely responsible for your regulatory filings. Any submission you make to a regulator, PRO, auditor, customer or counterparty — whether or not it uses WilTrak Output — is your submission. You must review it before filing. We are not a party to it and accept no responsibility for it.

6.5 WilTrak is not a payment institution, money transmitter, or escrow agent. Collector payouts, levy payments and similar entries in the Service are book records that you create. We do not hold, transmit, disburse, remit or reconcile those funds, and we do not verify that any payout or levy was actually made. The only money that moves through our payment providers is your own subscription and service fees payable to us.

6.6 AI and automated features are probabilistic aids, not determinations.

• Material classification predicts a likely material class from an image, with a confidence score. It can be wrong. It is not a laboratory analysis and is not evidence of the chemical or physical composition of any item.
• Anomaly flags are heuristic signals for human review. A flag is not an allegation of wrongdoing against any person, and an absence of a flag is not confirmation that a record is genuine.
• Geo-verification performs advisory plausibility checks. Absent or mismatched location data does not prove a record is false, and matching location data does not prove it is true.
• The data assistant generates natural-language answers about your own data and may be incomplete or incorrect.

You must apply human review before relying on any of these for a compliance, financial, disciplinary, contractual or legal purpose. You must not make a decision that produces legal or similarly significant effects on an individual based solely on automated processing in the Service.

6.7 The Service is not designed or licensed for use where failure could lead to death, personal injury, or severe environmental damage, and must not be used as a safety-critical control system.

7. Customer Data and your responsibilities

7.1 As between you and us, you own Customer Data. You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, display, adapt and process Customer Data solely to: (a) provide, secure, maintain and support the Service; (b) generate Output for you; (c) prevent fraud, abuse and data falsification; and (d) comply with law. This licence ends when the Customer Data is deleted, except for backups pending expiry and records we must retain by law.

7.2 You warrant that, for all Customer Data you submit:

• it is accurate, complete and not misleading, and records events that actually occurred as described;
• you have all rights, consents, notices and lawful bases needed to submit it and to have us process it, including under the KDPA and any equivalent law;
• submitting it does not infringe any third party’s rights or breach any duty of confidence; and
• it contains no malware and no unlawful content.

7.3 Third-party Personal Data. The Service is designed to hold Personal Data about people who are not our users and have no relationship with us — in particular collectors (names, phone numbers, national ID numbers), producer and recycler contacts, and your own field workers. You are the Data Controller for that Personal Data and we act as your Data Processor (see Annex A). You are responsible for giving those individuals the notices, and where required obtaining the consents, that the law requires — including for the collection of national identification numbers, for SMS messaging to collectors, and for the recording of location and photographs during their work.

7.4 Worker monitoring. The Service records the identity of the Authorized User who creates each record, the time, the GPS coordinates captured at the point of capture, photographs, and performance metrics (including collector KPI targets and evaluations). This is workforce data. You must tell your workers, before they use the Service, what is recorded and why, and you must comply with applicable employment, data protection and collective agreement obligations. The mobile app does not perform continuous or background location tracking; coordinates are captured at the moment a record is created.

7.5 Special categories. You must not submit special-category or sensitive Personal Data (health, biometric identifiers, genetic data, sex life, race or ethnic origin, political or religious belief, trade union membership) into free-text fields, photographs, notes or uploaded documents unless you have a lawful basis and have told us in writing beforehand so that we can assess whether we can support it.

7.6 Backups are your responsibility too. We maintain backups for our own continuity purposes. They are not a substitute for your own records retention. Export your data regularly using the export and reporting features.

8. Acceptable use and data integrity

8.1 Data integrity is the core obligation of this agreement. Because WilTrak Output can feed regulatory filings, levy calculations and certificates, falsifying data in WilTrak is not merely a breach of contract — it may constitute an offence. You must not, and must not permit any Authorized User or third party to:

• record a pickup, shipment, recovery transfer, batch, payout or levy payment that did not occur, or that did not occur as recorded;
• misstate weights, quantities, materials, dates, locations, counterparties or recipients;
• reuse, stage, edit, or synthetically generate evidence photographs, or submit a photograph of anything other than the actual material collected;
• falsify, spoof, simulate or suppress GPS coordinates or device time, including through mock-location or time-shifting software;
• repeatedly recapture or manipulate an image for the purpose of obtaining a more favourable classification, or otherwise attempt to defeat, bias or reverse-engineer the classification, anomaly-detection or geo-verification logic;
• create fictitious producers, collectors, facilities, recovery partners or Organizations, or duplicate real ones, to inflate volumes or evade limits;
• backdate, alter or delete records to conceal an event, an anomaly, or a prior state;
• procure a false confirmation of a recovery transfer, or confirm or dispute a transfer you are not authorized to act on;
• forge, alter, reuse or misrepresent a certificate, verification code, barcode, batch code or invoice reference, or present any Output as an independent verification by WilTrak or by a regulator; or
• represent to any regulator, PRO, auditor, financier or customer that WilTrak has verified, audited or certified anything.

8.2 You must not:

• circumvent or attempt to circumvent plan limits, entitlements, rate limits, seat counts or paywalls, including by creating multiple Organizations or Accounts to split volume, obtain repeated free trials, evade a suspension, or evade detection;
• share, resell, rent, lease, sublicense, time-share or operate the Service as a service bureau for third parties, unless expressly agreed in writing;
• access the Service by automated means other than through documented interfaces, or scrape, crawl, harvest or bulk-extract data or content;
• reverse engineer, decompile or disassemble any part of the Service, or attempt to derive source code, model weights, thresholds, training data or algorithms, except to the extent this restriction is unenforceable under applicable law;
• use the Service, its Output, its classifications, its images or its labels to develop, train, fine-tune, evaluate or benchmark a competing product, model or dataset;
• probe, scan or test the vulnerability of the Service, or breach or circumvent any security or authentication measure, except under a written authorization from us (see 8.4);
• interfere with the integrity or performance of the Service, or impose an unreasonable or disproportionate load on it;
• upload malware, or use the Service to store or transmit unlawful, defamatory, harassing, or infringing content;
• use the Service in violation of any applicable law, including anti-bribery, anti-money-laundering, sanctions, export control, data protection and environmental law; or
• offer, promise or give anything of value to any public official, regulator or their agent in connection with a WilTrak record, report or certificate.

8.3 Consequences. If we reasonably believe this section has been breached, we may, with or without notice and in addition to any other remedy: restrict or suspend affected Accounts, features or the whole Organization; quarantine, preserve or reverse affected records; refuse to issue or revalidate Output; terminate for cause under section 12; and retain evidence. Where we reasonably believe data has been falsified in a way that affects a regulatory filing, a levy, a certificate, or a third party’s rights, we may notify the affected regulator, PRO, or counterparty, and provide them with relevant records. You waive any claim against us arising from a disclosure made reasonably and in good faith under this clause.

8.4 Responsible disclosure. We welcome good-faith security research. If you believe you have found a vulnerability, email support@wiltrak.tech with details, do not access, modify or exfiltrate data belonging to anyone else, do not degrade the Service, and give us a reasonable period to remediate before any disclosure. We will not pursue action against research that follows this clause in good faith.

8.5 No obligation to monitor. We have no obligation to review, verify or monitor Customer Data, but we may do so where necessary to operate, secure or protect the Service, to enforce these Terms, or to comply with law.

9. Plans, trials, fees and payment

9.1 Plans and prices. Plans, prices, entitlements and limits are those shown in the dashboard at the time of purchase. Prices are stated exclusive of VAT and other taxes unless expressly stated otherwise.

9.2 Free trial. Where offered, a free trial runs for the period shown at checkout and is available once per Organization and once per corporate group. Registering additional Organizations, or using different email addresses or payment instruments, to obtain further trials is a breach of section 8.2. We may withdraw, shorten or refuse a trial at any time, and we may end a trial immediately on any indication of abuse. At the end of a trial, unless you have an active paid Subscription, access to the Service stops. Data from the trial is retained and then deleted in line with section 13.4.

9.3 Payment authorization and automatic renewal. By subscribing, you authorize us and our payment providers to store your payment authorization and to charge it automatically, without further action by you, at the start of each renewal term (monthly, quarterly or annually as selected), at the then-current price for your plan and add-ons, plus applicable taxes. A Subscription renews automatically until cancelled. You may cancel at any time in the dashboard, or by emailing sales@wiltrak.tech from an Account with billing authority.

9.4 Cancellation. Cancellation stops future renewals and takes effect as described in the dashboard at the point of cancellation. Fees already paid are non-refundable, and we do not provide partial or pro-rata refunds for an unused portion of a paid term, for periods of non-use, or for features you chose not to use, except where a refund is required by law or expressly agreed in writing.

9.5 Upgrades, downgrades and add-ons. Upgrades take effect immediately, and any proration shown at checkout is applied as a credit against the new charge. Credits have no cash value, are not refundable, and expire on termination. Downgrades and add-on removals take effect as shown at the time of the change; removing an add-on or downgrading mid-term does not generate a refund, and you may immediately lose access to data, features or capacity that exceed the lower plan’s entitlements.

9.6 Taxes and billing details. You are responsible for the accuracy of the billing country, tax status, tax identifiers and invoicing details you provide. VAT is applied on the basis of the country you declare. If you declare a country or tax status that is incorrect and this results in under-collected tax, you must reimburse us for that tax, together with any interest and penalties. All amounts payable to us are net of withholding taxes; if you are required to withhold, you must gross up so that we receive the full invoiced amount, and provide withholding certificates promptly.

9.7 Failed payments and delinquency. If a charge fails, we may retry it. If an invoice remains unpaid after its due date, we may charge interest at 2% per month or the maximum permitted by law (whichever is lower), suspend or downgrade the Service, and recover reasonable costs of collection, including legal fees. Suspension for non-payment does not relieve you of accrued fees.

9.8 Chargebacks. If you initiate a chargeback or payment dispute for a charge that is validly due under these Terms, we may suspend the Organization immediately until it is resolved, and recover the disputed amount together with any fees imposed on us by the payment provider. Please contact sales@wiltrak.tech before disputing a charge.

9.9 Service invoices. Services that require physical attendance — such as on-site audits, inspections and site visits — are billed separately as one-off service invoices and are not covered by your Subscription. Those invoices are payable on the terms stated on the invoice. Where a scheduled visit is cancelled at short notice or our personnel cannot gain access, we may charge for the visit.

9.10 Price changes. We may change prices, plans, entitlements and limits. For an existing Subscription, a price increase takes effect at the start of the next renewal term following at least 30 days’ notice by email or in-dashboard notification. If you do not accept the increase, you may cancel before it takes effect; continuing past that date is acceptance.

9.11 Enterprise and manually activated subscriptions. Where a Subscription is activated manually or under a negotiated enterprise agreement, the commercial terms of that agreement prevail over this section 9 to the extent of any conflict.

10. Usage limits, fair use and the API

10.1 Your plan includes limits on collectors, monthly pickups, facilities, request rates and other resources, as shown in the dashboard. We may enforce these by blocking, throttling or queuing requests, or by requiring an upgrade.

10.2 Even where a limit is not stated numerically, use must be reasonable and consistent with normal use of the Service by a single organization of your size. Automated, disproportionate or abusive request volumes may be throttled or suspended, including where they materially increase our infrastructure costs.

10.3 Webhooks and outbound integrations. If you configure webhooks, single sign-on, or any other integration, you are responsible for the endpoint, the identity provider, and everything sent to or received from them. Data delivered to a URL you configure leaves our control at that point. Keep signing secrets confidential, verify signatures, and use TLS endpoints. We are not responsible for data exposed, lost or misused as a result of an endpoint or IdP you configured, or for the security or availability of any third-party service.

10.4 We may change, deprecate or version APIs and integration surfaces. We will give reasonable notice of breaking changes where practicable.

11. Intellectual property

11.1 We and our licensors own all right, title and interest in the WilTrak Materials, including all models, thresholds, report templates, barcode and code-generation logic, documentation and branding, and all improvements to them.

11.2 You own Customer Data. As between the parties, you may use Output for your own internal, compliance and regulatory purposes, and may share Output with your regulators, auditors, PROs, financiers and counterparties. You may not sell Output as a standalone data product or use it as described in section 8.2.

11.3 Aggregated and de-identified data. We may generate and use statistical, aggregated and de-identified data derived from use of the Service — including for improving classification and anomaly models, benchmarking, capacity planning and publishing industry-level insights — provided that it does not identify you, any Authorized User, any Data Subject, or any individual Organization, and is not reversible. We will not publish or sell your identifiable Customer Data. If you have an enterprise agreement that excludes model improvement, that exclusion prevails.

11.4 Feedback. If you send us suggestions, feature requests or feedback, you grant us a perpetual, irrevocable, worldwide, royalty-free licence to use it without restriction or compensation. You are not obliged to give feedback.

11.5 Trademarks. Neither party may use the other’s name, logo or marks without prior written consent, except that we may identify you as a customer in a factual list of customers, and you may state that you use WilTrak. Consent to a case study, quote or press release must be given separately in writing.

12. Term, suspension and termination

12.1 These Terms apply from your first use of the Service until all Subscriptions have ended and your Account is closed.

12.2 Suspension. We may suspend all or part of the Service, immediately and without liability, where: (a) fees are overdue; (b) we reasonably believe there is a security risk, a compromised Account, or an active attack; (c) we reasonably believe there is a breach of section 8; (d) continued provision would breach law or expose us or a third party to liability; or (e) a competent authority or payment provider requires it. Where practicable we will give notice and limit the suspension to what is necessary, and we will restore the Service promptly once the cause is resolved.

12.3 Termination for convenience. You may terminate by cancelling all Subscriptions and closing your Account. We may terminate a free, trial or unpaid Account at any time on notice, and a paid Subscription at the end of its then-current term on 30 days’ notice.

12.4 Termination for cause. Either party may terminate immediately on written notice if the other commits a material breach that is not remedied within 15 days of notice (or, for a breach of section 8.1 or of confidentiality, immediately and without a cure period), or becomes insolvent, enters administration or liquidation, or ceases business.

12.5 Effect of termination. All licences end. You must stop using the Service. Accrued fees remain payable, and the balance of any committed term becomes immediately due where we terminated for cause.

12.6 Data export window. Unless prohibited by law or by a preservation obligation, we will keep Customer Data available for export for 30 days after termination or expiry, provided any overdue fees have been paid. After that window, we will delete or irreversibly anonymize Customer Data in accordance with the Privacy Policy and Annex A, subject to backup expiry cycles and to records we must retain by law (including tax, financial, audit and fraud records). Export your data before the window closes — we are not obliged to restore data after deletion.

12.7 Sections 6, 7.2, 8, 9 (for accrued amounts), 11, 13, 15–21, Annex A and any provision which by its nature should survive, survive termination.

13. Availability, support, changes and beta features

13.1 No uptime commitment by default. We aim for high availability but the Service is provided without a guaranteed service level unless your plan or signed agreement expressly includes one. Where an SLA applies, service credits are your sole and exclusive remedy for failure to meet it.

13.2 Maintenance. We may take the Service down for planned maintenance, and will try to schedule it outside East Africa Time business hours and to give advance notice. Emergency maintenance may occur without notice.

13.3 Changes to the Service. We may add, change, deprecate or remove features. We will not materially degrade the core functionality of a paid plan during a paid term without notice. If we make a change that materially and adversely affects your use, notify us within 30 days and, if we cannot reasonably remedy it, you may terminate the affected Subscription and receive a pro-rata refund of prepaid fees for the unused remainder of the term. This is your sole remedy for such a change.

13.4 Beta, preview and experimental features (including anything labelled beta, preview, experimental or early access, and the data assistant) are provided as is, may be changed or withdrawn at any time, are excluded from any SLA and from section 13.3, and should not be relied on for production compliance work.

13.5 Support is provided through the channels and at the response targets stated for your plan. Support requests must come from an Authorized User. We may access your Organization to provide support — see section 14.

14. Our access to your Organization

14.1 Our personnel may access your Organization only where necessary to: provide support you have requested; investigate or resolve a technical, security, billing or abuse issue; comply with law or a lawful request; or protect the rights, property or safety of WilTrak, you, or a third party.

14.2 Some support and platform actions are performed by authorized WilTrak personnel entering your Organization under an internal “act as” mechanism, which reproduces an administrator’s view of your workspace. Such access is restricted to designated roles, requires a step-up authentication ceremony, is recorded in an audit log, and — for sensitive platform actions — requires a second authorization from a designated approver.

14.3 We do not use this access to view, extract or use Customer Data for any purpose other than those in 14.1. Details of what is logged and how long it is kept are in the Privacy Policy.

15. Confidentiality

15.1 Each party may receive the other’s confidential information. Ours includes non-public aspects of the Service, security details, pricing not publicly listed, and roadmaps; yours includes Customer Data.

15.2 The receiving party must use the same degree of care it uses for its own confidential information (and no less than reasonable care), use it only to perform this agreement, and disclose it only to personnel, affiliates and professional advisers who need it and are bound by equivalent duties.

15.3 The obligation does not apply to information that is or becomes public without breach, was known without duty of confidence, is independently developed, or is lawfully received from a third party. A party may disclose where legally compelled, giving prompt notice where lawful so the other party can seek protection.

15.4 Confidentiality survives for 5 years after termination, and indefinitely for Personal Data and trade secrets.

16. Compliance with laws, sanctions and anti-corruption

16.1 Each party will comply with all laws applicable to its performance, including anti-bribery and anti-corruption law, anti-money-laundering law, sanctions and export controls, and data protection law.

16.2 You represent that neither you, nor any person who owns or controls you, is subject to sanctions or located in a sanctioned territory, and that you will not make the Service available to any such person.

16.3 Neither party will offer or accept any improper payment or advantage in connection with this agreement or with any record, report or certificate produced through the Service.

17. Warranties and disclaimers

17.1 Each party warrants that it has the authority to enter into this agreement.

17.2 We warrant that we will provide the Service with reasonable skill and care and in a manner materially consistent with its documentation.

17.3 Except as expressly stated in 17.2, and to the maximum extent permitted by law, the Service and all Output are provided “as is” and “as available”, and we disclaim all other warranties, conditions and representations, express, implied or statutory, including merchantability, satisfactory quality, fitness for a particular purpose, non-infringement, accuracy, and any warranty arising from course of dealing or usage of trade.

17.4 Without limiting 17.3, we do not warrant that: the Service will be uninterrupted, timely, secure or error-free; defects will be corrected; the Service or any file is free of harmful components; any classification, anomaly flag, geo-check, assistant answer, target, rate, fee or deadline is accurate or complete; Output will be accepted by any regulator, PRO, auditor or counterparty; or that use of the Service will result in, or is sufficient for, compliance with any law.

17.5 Data supplied to the Service by third parties, including regulatory feeds, market prices, exchange rates and public rules, is provided without verification and may be inaccurate or out of date.

18. Indemnities

18.1 You will indemnify, defend and hold harmless WilTrak, its affiliates, and their directors, officers, employees and agents from and against all claims, demands, proceedings, losses, damages, fines, penalties, and reasonable costs and legal fees arising out of or in connection with: (a) Customer Data, including any claim that it infringes a third party’s rights or was submitted without a lawful basis or required consent; (b) your breach of section 7 (Customer Data), section 8 (Acceptable use and data integrity), or Annex A; (c) any regulatory filing, certificate, levy calculation, declaration or representation you make or that is made on your behalf; (d) any claim by an Authorized User, worker, collector, producer or other Data Subject relating to your instructions, your notices, or your processing; and (e) your use of the Service in breach of law.

18.2 We will indemnify, defend and hold harmless you from a third-party claim alleging that the Service, as provided by us and used in accordance with these Terms, infringes that third party’s intellectual property rights, and will pay damages finally awarded or agreed in settlement. This does not apply to claims arising from Customer Data, from modifications not made by us, from combination with anything not supplied by us where the claim would not have arisen otherwise, or from use in breach of these Terms. If the Service becomes, or we believe it may become, the subject of such a claim, we may procure the right to continue using it, modify or replace it, or terminate the affected Subscription and refund prepaid unused fees. This is your sole and exclusive remedy for intellectual property infringement.

18.3 The indemnified party must give prompt notice, give the indemnifying party control of the defence and settlement (a settlement that admits liability or imposes an obligation on the indemnified party requires its consent, not to be unreasonably withheld), and provide reasonable cooperation.

19. Limitation of liability

19.1 Nothing in these Terms limits or excludes either party’s liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; or any liability that cannot lawfully be limited or excluded.

19.2 Excluded losses. Subject to 19.1, neither party is liable for any indirect, incidental, special, consequential, exemplary or punitive loss, nor for loss of profit, revenue, anticipated savings, business, goodwill, opportunity, contracts, or reputation, nor for regulatory fines or penalties imposed on the other party, nor for loss or corruption of data (beyond our obligation to maintain backups in the ordinary course), in each case however arising and whether or not the possibility was foreseeable or notified.

19.3 Aggregate cap. Subject to 19.1 and 19.4, each party’s total aggregate liability arising out of or in connection with this agreement, whether in contract, tort (including negligence), breach of statutory duty, restitution or otherwise, is limited to the greater of (a) the fees paid or payable by you to us under this agreement in the 12 months immediately preceding the first event giving rise to the liability, or (b) KES 50,000.

19.4 Exclusions from the cap. The cap in 19.3 does not apply to: your obligation to pay fees, taxes and interest properly due; your indemnity obligations under 18.1; your breach of section 8.1 (data integrity) or section 8.2 (prohibited uses); or either party’s breach of confidentiality obligations in respect of the other’s trade secrets.

19.5 Time limit. No claim may be brought more than 12 months after the claimant first became aware, or ought reasonably to have become aware, of the facts giving rise to it, except for claims for non-payment.

19.6 Allocation of risk. You acknowledge that the fees reflect this allocation of risk, that the disclaimers and limits in sections 6, 17 and 19 are an essential basis of the bargain, and that we would not provide the Service on these prices without them.

20. Changes to these Terms

20.1 We may update these Terms. For changes that are material and adverse to you, we will give at least 30 days’ notice by email to your Organization’s administrators or by in-dashboard notification before they take effect. Other changes (clarifications, contact details, non-material updates) take effect when posted.

20.2 If you do not accept a material change, you may terminate the affected Subscription before it takes effect and receive a pro-rata refund of prepaid fees for the unused remainder of the term. Continuing to use the Service after the effective date is acceptance.

20.3 We will keep the “Last updated” date current. Superseded versions are available on request.

21. Disputes and governing law

21.1 Governing law. These Terms and any dispute arising out of or in connection with them (including non-contractual disputes) are governed by the laws of Kenya, without regard to conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

21.2 Notice and good-faith resolution. Before commencing proceedings, the complaining party must send a written notice describing the dispute to the other party (to info@wiltrak.tech for us), and the parties’ senior representatives will attempt in good faith to resolve it within 30 days.

21.3 Forum. If not resolved, the dispute is subject to the exclusive jurisdiction of the courts of Kenya sitting at Nairobi. The parties may instead agree in writing to refer the dispute to arbitration by a single arbitrator in Nairobi under the Arbitration Act, 1995, in English.

21.4 Injunctive relief. Nothing prevents either party from seeking urgent injunctive or equitable relief in any court of competent jurisdiction to protect confidential information or intellectual property, or to prevent ongoing data falsification.

21.5 No class actions. To the extent permitted by law, disputes will be resolved on an individual basis and not as a class, consolidated or representative action.

22. General

22.1 Assignment. You may not assign or transfer this agreement without our prior written consent, except to a successor of substantially all of your business or assets that is not our competitor, on written notice. We may assign to an affiliate or in connection with a merger, acquisition or sale of assets. Any other purported assignment is void.

22.2 Subcontracting. We may use subcontractors and sub-processors to provide the Service and remain responsible for their performance. Sub-processors are governed by Annex A.

22.3 Notices. Notices to us: info@wiltrak.tech (legal and contractual), support@wiltrak.tech (operational and security), sales@wiltrak.tech (billing). Notices to you: the email addresses of your Organization’s administrators and in-dashboard notifications. It is your responsibility to keep those addresses current and monitored. Email notice is deemed received on the next business day.

22.4 Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control, including natural disaster, epidemic, war, civil unrest, industrial action, government action, failure of utilities, internet or telecommunications, or failure of a third-party infrastructure provider. This does not excuse payment obligations.

22.5 No partnership. Nothing creates a partnership, joint venture, agency or employment relationship.

22.6 No third-party rights. Except for indemnified persons under section 18, no third party may enforce these Terms.

22.7 Severability. If a provision is held invalid or unenforceable, it will be modified to the minimum extent necessary, or severed, and the rest remains in force.

22.8 No waiver. Failure or delay in enforcing a right is not a waiver of it.

22.9 Entire agreement. These Terms, together with the documents in 1.2, are the entire agreement between the parties on this subject and supersede all prior discussions, proposals and representations, save for fraud.

22.10 Language. These Terms are in English. Any translation is for convenience; the English version prevails.

---

Annex A — Data Processing Terms

These Data Processing Terms apply where we process Personal Data on your behalf as your Data Processor. Terms used here have the meanings given in the KDPA and, where applicable, the GDPR.

A1. Roles. You are the Data Controller and we are the Data Processor in respect of Customer Data. We are an independent Data Controller in respect of: Account registration and administration data, billing and payment records, support communications, security, fraud and abuse monitoring, audit logs, and our own marketing to your administrators — as described in the Privacy Policy.

A2. Instructions. We will process Customer Data only on your documented instructions, which comprise these Terms, your configuration of the Service, and your use of its features, unless we are required to process by law — in which case we will tell you first, unless the law forbids it. We will tell you if, in our opinion, an instruction infringes data protection law.

A3. Subject matter and details of processing.

A4. Confidentiality. We ensure that personnel authorized to process Customer Data are bound by confidentiality obligations and are trained appropriately, and we limit access to those who need it.

A5. Security. We implement appropriate technical and organizational measures, taking account of the state of the art, costs, and the nature and risk of the processing. These include: encryption in transit; encryption at rest for our managed database and object storage; role- and scope-based access control with tenant isolation; multi-factor and passkey authentication for privileged access; dual authorization for sensitive platform actions; audit logging; rate limiting; optional IP allowlisting; least-privilege administrative access; and regular backups. We may update these measures provided the overall level of protection is not reduced.

A6. Sub-processors. You give general authorization for us to engage sub-processors. The current list, with the purpose and location of each, is published in the Privacy Policy. We impose data protection obligations on each sub-processor no less protective than these Terms, and remain liable for their performance. We will give at least 30 days’ notice of a new or replacement sub-processor by updating the Privacy Policy and notifying Organization administrators. You may object on reasonable data protection grounds within that period; if we cannot offer a reasonable alternative, you may terminate the affected Subscription and receive a pro-rata refund of prepaid unused fees.

A7. Assistance with Data Subject rights. Taking account of the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise Data Subject rights. If we receive such a request directly, we will not respond to it substantively; we will refer the Data Subject to you and inform you without undue delay.

A8. Assistance with obligations. We will provide reasonable assistance with your data protection impact assessments and prior consultations with a supervisory authority, taking into account the nature of the processing and the information available to us. We may charge a reasonable fee for assistance that goes beyond what is proportionate.

A9. Personal data breach. We will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting Customer Data, and provide the information reasonably available to us to enable you to meet your own notification obligations. We will take reasonable steps to contain and remediate. Our notification is not an acknowledgement of fault or liability.

A10. Return and deletion. On termination, we will delete or return Customer Data in accordance with clause 12.6, except where retention is required by law. Backups are deleted on their ordinary expiry cycle.

A11. Audit. We will make available the information reasonably necessary to demonstrate compliance with these Annex A obligations, and will contribute to audits conducted by you or an independent auditor appointed by you and reasonably acceptable to us: on at least 30 days’ written notice, no more than once in any 12 months (unless required by a supervisory authority or following a breach), during business hours, without unreasonable disruption, subject to confidentiality, and at your cost. Where available, current third-party reports and questionnaires will be provided first and will satisfy this obligation where they reasonably address your questions.

A12. International transfers. Customer Data may be processed outside the country where it was collected, as described in the Privacy Policy. Where we transfer Personal Data across borders we will implement an appropriate transfer mechanism and safeguards required by the KDPA, the Data Protection (General) Regulations, 2021, and, where applicable, Chapter V of the GDPR — including contractual data protection terms with each recipient, encryption, and limitation of transfers to what is operationally necessary. You are responsible for confirming that this arrangement is compatible with any in-country data residency obligation that applies to you, before you upload data. Contact info@wiltrak.tech before onboarding if you have residency requirements.

A13. Your obligations as Controller. You warrant that you have a lawful basis for the processing you instruct, that you have given all required notices to Data Subjects (including your workers, collectors and contacts), that you have obtained any consent required (including for SMS messaging and for collecting national identification numbers), that your instructions comply with law, and that Customer Data is accurate and kept up to date.

A14. Precedence. In the event of conflict between these Annex A terms and the rest of these Terms in respect of the processing of Personal Data, Annex A prevails. If we and you enter a separate data processing agreement, that agreement prevails over Annex A to the extent of any conflict.

---

Contact

WilTrak Ltd., Nairobi, Kenya

• Legal and contractual: info@wiltrak.tech
• Support, security and privacy requests: support@wiltrak.tech
• Billing and subscriptions: sales@wiltrak.tech

See also: Privacy Policy · Request account deletion