SuloBaseWho we are
Sulocorp Technologies Limited ("we"), a company incorporated in Zambia, runs SuloBase: databases, sign-in, file storage and APIs that businesses use to build their own applications. We are based in Lusaka. Write to us at tech@sulocorp.com.
We are registered with the Data Protection Commissioner as a data controller and data processor (section 19), certificate DPC-DP000897, valid to 31 March 2027.
Send anything about this policy to tech@sulocorp.com.
We have two roles:
- Controller for information about you as a customer, or as someone who signs up on our website.
- Processor for the data your application stores in SuloBase, including your users' data. There, you are the controller and we act only on your instructions (section 52).
Your rights
Under Part IX of the Act you can:
- ask whether we hold data about you, and get a copy; the first copy is free s.58
- have it corrected or completed s.59
- have it erased s.60
- object to our use of it, including for marketing s.61
- not be subject to decisions made purely by automated means s.62
- restrict how we use it s.63
- receive it in a machine-readable format, or have it sent to another provider s.65
- withdraw your consent at any time s.15(6)
- complain to the Data Protection Commissioner s.68, and appeal the Commissioner's decision to the High Court s.69
Email tech@sulocorp.com. We reply within 21 days. If your request is about data inside a customer's application built on SuloBase, please contact that customer, who controls it; we will help them respond.
What we collect
When you sign up on sulobase.com
Your name, email address and WhatsApp number; your company and project details; the plan and timeline you choose; and any optional answers you give, for example the system you use today. We also record how you found us (the link or campaign you came from) and your approximate city, worked out from your connection. We do not store your IP address for this. Your name, email and WhatsApp number are needed to respond to you; everything else is optional (section 64(e)).
When you have an account
Your name, email and company; billing records (plan, amount, date, payment reference and the phone number used to pay); and messages you send us.
When you use the platform
Technical logs needed to run and secure the service: request volumes, error logs and sign-in events. We do not read the content of your requests.
Your application data
Whatever you or your users store in your project. We access it only to provide the service (for example, to back it up or restore it at your request), to investigate a security incident, or where Zambian law requires.
We do not collect sensitive personal data about you, as the Act defines it.
Why we use it, and on what basis
| Purpose | Basis under the Act |
|---|---|
| Respond to your sign-up and arrange your onboarding call | Your consent (s.15), given when you submit the form; steps you asked for before a contract (s.13(b)(i)) |
| Provide the service, sign you in, back up your projects, support you | Our contract with you (s.13(b)(i)) |
| Take payment and keep tax records | Contract; legal obligation (s.13(b)(i) and (ii)) |
| Tell you about new features and offers | Your consent. You can object at any time (s.61(3)), and every message says how |
| Understand which channels bring us customers | Your consent, given on the sign-up form |
We do not sell your data or use it for advertising.
Where your data is kept
In Zambia. Your projects (databases, sign-in data and files) and your account and billing records are processed and stored on our server in Lusaka (section 70).
Outside Zambia, today (section 64(d)):
- Backups. Backups of paying projects are made and encrypted with AES-256 in Lusaka. The off-site copy is held by Cloudflare R2, outside Zambia; the key stays in Zambia.
- Requests on their way in pass through Cloudflare's network, where the secure connection is set up at the site nearest the user.
- Our website and its sign-up form run on Vercel. Emails are sent through Resend, visits are measured with Google Analytics, and we talk to leads on WhatsApp. Company email and documents, including notes from calls, are kept in Google Workspace.
- Payments by mobile money go through Lenco.
The full list, with what each service handles and where, is on our subprocessors page.
Who we share it with
Only:
- the services on our subprocessors page, each allowed to use the data only to provide their service to us;
- authorities, where Zambian law requires it (section 53(4));
- a buyer of our business, if Sulocorp is ever sold, with notice to you first;
- anyone you ask us to share it with.
Before any other disclosure, we will ask for your consent and tell you who will receive it, why, how it will be protected, and how to complain (section 53(2) and (3)).
How long we keep it
The Act requires personal data to be kept for as long as it is used for its purpose and for at least one year afterwards (section 51). Within that rule:
| Data | Kept for |
|---|---|
| Website sign-ups that do not become customers | 24 months from our last contact, then deleted |
| Your account data | While your account is open, then 12 months, then deleted |
| A project you delete | Its database and files are deleted straight away. Encrypted backup copies are deleted on request |
| Backups of paying projects | Made nightly and kept for your plan's period: Pro 60 days, Business 180, Enterprise 365. Hobby projects are not backed up |
| Billing records | 7 years, as tax law requires |
Security
- Encryption in transit (TLS) on every connection.
- Each customer project runs in its own database, separated from other customers. Every change to the platform is automatically tested to confirm that one customer's keys cannot reach another's project.
- Backups are test-restored and encrypted with AES-256.
- Access to production systems is limited to named people.
We review these measures periodically (section 47(3)). The details are on our security page.
If a breach affects your personal data, we will notify the Data Protection Commissioner within 24 hours of becoming aware of it (section 49(1)), and tell you as soon as practicable (section 49(3)): what happened, what data was affected, and what we are doing about it.
Children
SuloBase accounts are for people aged 18 and over. We do not knowingly collect data about children.
Cookies
See our cookie policy.
Changes
We will email account holders at least 14 days before a material change takes effect.