Last updated: August 2026
Buni acts as a data processor for the businesses that use it, and a data controller for the account and platform data needed to operate the service. The business you work with remains the controller of the transaction and customer data they process through Buni.
Buni processes account information (name, email, phone), business registration details, KRA PINs, invoice and financial records, customer information, and integration configuration. We process only what is necessary to provide the service.
When a business uses Buni to manage invoicing and eTIMS submission, Buni processes data on the business's behalf and according to the business's instructions, under a data processing arrangement. The exact controller/processor arrangement is validated legally before production use.
When a business submits an invoice through eTIMS, the required invoice and taxpayer data is transmitted to KRA in line with the applicable eTIMS rules. This happens only after the business configures eTIMS and instructs Buni to submit.
Data is retained for as long as your account is active and for as long as required for legal, tax, audit and compliance obligations, after which it is deleted or anonymised.
You can request access to, correction of, or deletion of your personal data, or exercise any applicable data protection right, by contacting us through the contact page. Buni follows privacy-by-design principles and applicable ODPC guidance on controller and processor obligations.