Terms of Service

These terms are an agreement between Bidbox Ltd, a company registered in Kenya with offices at Two Rivers Mall, Nairobi, Kenya (“Bidbox”, “we”), and the organisation that opens a Bidbox account (“you”, the “client”). The person who accepts them confirms they have authority to bind that organisation.

They cover the Bidbox dashboard, the Bidbox API and any related support (together, the “service”). A signed order form or master services agreement, where one exists, takes priority over these terms.

Bidbox provides one technical connection to government services it has been approved to reach, currently Citizen KYC identity checks, NTSA vehicle records and Business Registration Service records, sourced through Gava Connect.

• The agency stays the source. Every record belongs to and is maintained by the relevant agency. Bidbox passes on what the agency returns and does not edit, enrich or certify it.
• A check supports your decision; it isn’t the decision. You remain responsible for your own KYC, credit, employment or due-diligence outcome and for any regulatory duty that applies to you.
• Availability follows the agency. If an agency service is down or slow, the matching Bidbox check will be too. We report it and don’t bill failed calls.

Before live access, we verify your organisation (registration documents, KRA PIN, the people acting for you) and confirm with each agency which services and purposes you may use. We grant only what has been approved, and we may change or withdraw access if an agency changes its approval.

You must keep account details accurate, give each team member their own login, and remove people who no longer need access. You are responsible for everything done with your logins and API keys.

Every check must be for a specific, lawful purpose that matches your approval, and you must declare that purpose with the request. You agree not to:

• look anyone up without consent or another lawful basis under the Data Protection Act, 2019;
• run checks out of curiosity, for profiling unrelated to the declared purpose, or for marketing;
• resell, republish or build a database from results, or share them beyond the people who need them for the declared purpose;
• share API keys, get around rate limits or the IP allowlist, or probe, overload or reverse-engineer the service;
• use the service to harass, discriminate against or harm anyone.

We monitor usage for misuse. We may suspend access immediately where we reasonably suspect a breach, and we may be required to report misuse to the agency or the Office of the Data Protection Commissioner.

Keys are shown once, when created. Store them in a secret manager, restrict live keys with an IP allowlist, and revoke a key as soon as you suspect it has leaked. Tell us at info@bidbox.com within 24 hours of discovering any unauthorised use of your account.

• Prepaid. You top up a wallet (by M-Pesa or bank transfer) and each completed check is deducted at your agreed per-call rate. No balance, no check.
• What’s billed. A check is billed when the agency answers, including when it answers “no record found” or a serial mismatch. Requests that fail before reaching the agency, or that the agency fails to answer, are not billed.
• Prices. Standard rates are listed in the dashboard. We give at least 30 days’ notice of price changes, except where an agency changes its own fee, in which case we pass the change on with as much notice as we receive.
• Refunds. Unused wallet balance is refunded on request when the account closes, less any amounts owed. Billed checks are not refundable unless they were charged in error.
• Tax. Prices exclude VAT, which is added where it applies. Receipts and invoices will be available from the dashboard.

For the personal data in checks, you are the data controller and Bidbox acts as your data processor. We process it only to run the checks you ask for, as described in our Privacy Policy and the data processing agreement we sign with each live client. You are responsible for having a lawful basis for each check and for answering requests from the people you check.

We provide the service with reasonable skill and care. Because the records come from the agencies, we do not promise that they are complete, current or error-free, and we are not liable for decisions you make on them.

To the extent the law allows, neither party is liable for indirect or consequential loss, lost profit or lost data, and our total liability in any twelve months is limited to the amount you paid us for checks in that period. Nothing here limits liability that cannot be limited under Kenyan law, including for fraud.

You indemnify Bidbox against claims arising from checks you ran without a lawful basis or in breach of these terms.

You can close your account at any time by writing to us. We may suspend or end access with 30 days’ notice, or immediately for serious misuse, non-payment, or where an agency withdraws approval. On closing, we refund unused balance and keep request records only as long as the Privacy Policy says.

We’ll give at least 30 days’ notice of material changes to these terms by email and in the dashboard.

These terms are governed by the laws of Kenya. The parties will first try to settle any dispute by talking in good faith for 30 days; failing that, it goes to the courts of Kenya sitting in Nairobi.

Contact: info@bidbox.com · +254 728 314 988 · Two Rivers Mall, Nairobi, Kenya.