Privacy policy

1. Who we are

Marshal Business Suite (“the Suite”) is provided by Headway (Pty) Ltd, Ha Pita, Maseru, Lesotho (“Headway”, “we”). This policy covers the Suite at business.marshal.co.ls, its Fiscal API, its connections to accounting systems such as QuickBooks Online, Xero, Sage and Microsoft Business Central, and this website.

Questions about this policy or your information go to billing@headway.co.ls.

2. Our role

A business that uses the Suite decides what it records there about its own customers, suppliers and sales. For that information the business is responsible, and Headway processes it on the business's behalf and on its instructions.

For the people who hold Suite accounts, and for visitors to this website, Headway is responsible for the information described below.

3. What we collect

• Account details: name, email address, telephone number, the business you belong to and your role. Passwords are stored only as a one-way hash.
• Business records you enter or import: company details and TIN, shops, offices and branches, products, customers and their TINs, quotations, invoices, receipts, credit and debit notes, payments and cash records.
• Fiscal records: what is sent to and received from Revenue Services Lesotho (RSL) for each fiscal document, including RSL's references and verification codes.
• Information from accounting systems you connect: the company's details and its sales invoices and credit notes. The Suite only reads; it does not write anything back to QuickBooks Online.
• Files you upload, such as a sales export or a printed invoice for the fiscal portal, or an invoice for the free check on this website.
• Technical information: IP addresses, browser type, sign-in times and, when something fails, an error report.
• Website visits, counted without cookies and without following you to other sites.

4. Why we use it

We do not sell personal information, we do not use it for advertising, and we do not use your business records or data from connected accounting systems to train artificial intelligence.

• To provide the Suite: to run your tills, invoices, stock and reports, and to file fiscal documents with RSL, which Lesotho's VAT law and RSL's Lekuka e-invoicing rules require of registered businesses.
• To email documents and reports when you or your business switch that on, such as a fiscal invoice to a buyer.
• To bill for the service, to give support, and to keep the Suite secure, including investigating faults and misuse.
• To meet our own legal obligations.

5. Who we share it with

• Revenue Services Lesotho, for each fiscal document, as the law requires.
• The people your business chooses to send documents to, such as its customers.
• Accounting systems your business connects, only as far as that connection needs.
• Service providers who run parts of the Suite for us under contract: DigitalOcean, which hosts the Suite's servers; Sentry, which receives error reports (set not to send personal information by default); and, for the free invoice check on this website only, Anthropic, whose model reads an uploaded invoice once to check it. Business records in the Suite and data from QuickBooks are never sent to Anthropic.
• Authorities, when the law requires us to.

6. Where your information is kept

The Suite's servers and its database are in the United States, in DigitalOcean's New York data centre. Your information therefore leaves Lesotho. We protect it there as this policy describes.

7. QuickBooks Online

When a business connects QuickBooks Online, it signs in to Intuit and allows the Suite read-only access to its accounting data. The Suite asks Intuit for the accounting permission only, not for payments or personal identity.

The Suite reads the company's details, its invoices and its credit notes, so that each can be filed with RSL. The keys Intuit issues are encrypted in our database. Disconnecting QuickBooks in the Suite hands the access back to Intuit and deletes the keys at once. Invoices and credit notes already imported are kept as tax records.

8. How we protect it

• All connections to the Suite are encrypted (TLS 1.2 or 1.3), and browsers are told to use only secure connections.
• Keys for connected accounting systems and fiscal devices are encrypted in the database.
• Each business's records are kept apart from every other business's by the database itself, and staff see only what their role allows.
• Sensitive actions, such as money leaving a till and super-administrator access, need a second, one-time code.
• Changes to money and fiscal records are logged.
• The database is backed up every day, and each backup is kept for 30 days.

9. How long we keep it

• Account details: while the account is open.
• Fiscal and tax records: for as long as tax law requires, including after an account closes or a connection is removed.
• Keys for a connected accounting system: deleted as soon as it is disconnected.
• A file uploaded to the free invoice check: deleted as soon as it has been read, and within 24 hours at the latest; the rest of the check within 24 hours unless a free trial starts.
• Backups: 30 days.

10. Your rights

You may ask what information we hold about you, ask us to correct it, or ask us to delete it, by writing to billing@headway.co.ls. We will answer within 30 days. We cannot delete records that tax law requires to be kept. If you are a customer of a business that uses the Suite, ask that business first: it decides what it records about you, and we will help it answer you.

Lesotho's Data Protection Act, 2011 applies to the information we hold.

11. Cookies and browser storage

The Suite keeps you signed in using your browser's storage. We use no advertising cookies, and this website counts visits without cookies.

12. Children

The Suite is a business service and is not meant for children.

13. Changes to this policy

We will update this page when the way we handle information changes, and change the date at the top. If a change matters to how your information is used, we will tell account holders by email before it applies.