Legal
Privacy
What Luwawa collects, why, and what it will not do with it. Written to be read, not to be survived.
Who holds what
Your employer decides what goes in. We process it for them.
Luwawa is employment software sold to employers. Your employer decides what goes into it and who may see it, which makes them the controller of that data; we process it on their instructions.
If you are an employee asking why a particular record exists, your employer is the right first question, and we will help them answer it. Fickson Limited, Blantyre, Malawi, operates the service.
What we hold
Employment records, and what connected tools report back.
- Employment records
- Names, contact details, role, pay, leave balances, and documents your employer uploads.
- Bank details
- Held for payroll, encrypted at rest with a key that is not stored alongside them.
- Connected tools
- Where an employer connects Slack, GitHub or Linear: an account identifier, a display name, an email address for matching, and timestamps of activity in public places. Never message content, never private conversations, never code.
- Access tokens
- Encrypted at rest, and deleted when a connection is removed.
- Service logs
- Ordinary operational records: what was requested, when, and whether it worked.
What we do not do
Four things, and none of them have exceptions.
- No selling
- Your data is not sold, and not shared with advertisers.
- No reading messages
- The content of messages in a connected tool is never requested.
- No training
- Employment records are not used to train models.
- No spare permissions
- A connected tool is never asked for a permission the product does not use.
Deletion and access
Removing a connection stops the reading immediately.
An employer can remove a connection at any time, which deletes the stored tokens and stops all further reading. Ending a Luwawa account removes the workspace and everything in it, subject to any period your employer is legally required to keep records for.
Requests to see or correct your own record go to your employer first. Write to us and we will make sure they can act on it.
Incomplete: sub-processors, retention periods, international transfer and the effective date are not yet stated on this page, and it has had no legal review.