DATA CONTROLLER
TumaBoda Limited is the data controller responsible for personal data processed through the TumaBoda platform.
Registered details
TumaBoda Limited
P.O. Box 78924 – 00620
Mobil Plaza, Nairobi, Kenya
Data Protection Officer
Email: privacy@tumaboda.co.ke
Phone: +254 710 636 002
SCOPE OF THIS POLICY
This Privacy Policy applies to all users of the TumaBoda platform, including:
- Riders
- Merchants
- End customers and recipients
- Website visitors
- Vendors, contractors, and business partners
Third-party services integrated with TumaBoda operate under their own privacy policies.
LEGAL BASIS FOR PROCESSING
We process personal data based on one or more of the following lawful bases:
- User consent
- Performance of a contract
- Compliance with legal obligations
- Legitimate interests such as fraud prevention, security, service improvement, and regulatory compliance
PERSONAL DATA WE COLLECT
We collect only data necessary to provide and operate our services.
Identity and contact data
Name
Phone number
Email address
Government identification where required by law
Account and business data
Account registration details
Merchant business information
KRA PIN where applicable
Rider-specific data
Driving licenses
Insurance and compliance documents
Transaction and delivery data
Order details
Delivery records
Timestamps and pricing
Location data
Pickup and drop-off locations
Route metadata during active deliveries
Device and technical data
IP address
Device identifiers
App version and diagnostic logs
Communications data
Customer support messages
Emails and call records
Third-party data
Information received from payment providers, identity verification partners, and insurers where permitted by law
PURPOSES OF PROCESSING
We process personal data to:
- Create and manage user accounts
- Match riders with delivery requests
- Provide tracking and delivery services
- Process payments and settlements
- Verify identities and compliance
- Prevent fraud and misuse
- Provide customer support
- Improve platform performance and reliability
- Comply with legal and regulatory requirements
DATA RETENTION
We retain personal data only for as long as necessary for the purposes outlined in this policy.
Retention periods
Financial and transaction records
Retained for up to 7 years for tax, audit, dispute resolution, and legal compliance.
Delivery records
Retained for up to 7 years where they form part of transaction or financial records.
Location data
Used during active deliveries. Historical location data is anonymized or aggregated after 12 months.
Customer support and communications data
Retained for up to 24 months.
Device and usage data
Retained for up to 12 months for security and diagnostics.
Account and profile data
Retained while the account is active. Deleted or anonymized within 30 days of a verified account deletion request, unless retention is required by law.
ACCOUNT DELETION
Users may request deletion of their account and associated personal data.
Deletion requests can be made at:
https://www.tumaboda.co.ke/delete-account
Upon account deletion:
- Personal profile data is deleted or anonymized
- Transaction and financial records are retained only where legally required
- Retained data is access-restricted and never used for marketing
DATA SECURITY
We implement appropriate technical and organizational measures to protect personal data, including:
- Encryption in transit using HTTPS and TLS
- Role-based access controls
- Secure authentication mechanisms
- Secure cloud infrastructure
- Regular security reviews and audits
Personal data breaches are reported to the Office of the Data Protection Commissioner where required by law.
USER RIGHTS
Users have the right to:
- Access their personal data
- Request correction of inaccurate data
- Request deletion of their account and personal data
- Restrict or object to certain processing
- Withdraw consent where applicable
- Request data portability
- Lodge a complaint with the Office of the Data Protection Commissioner
Requests are acknowledged promptly and fulfilled within statutory timelines. Account deletion requests are processed within 14 days.
POLICY UPDATES
This Privacy Policy may be updated from time to time to reflect legal, regulatory, or operational changes. Updates will be published on www.tumaboda.co.ke