Privacy Policy

1.1 This Privacy Policy explains how Tuma Boda Limited, a limited liability company incorporated in the Republic of Kenya with its registered office at 14th Floor, Hazina Towers, Utalii Street, P.O. Box 78924 – 00620, Nairobi, Kenya ("TumaBoda", "we", "us" or "our"), collects, uses, shares and protects personal data in connection with the TumaBoda delivery platform, our mobile applications, our website at www.tumaboda.co.ke and our related services (together, the "Platform").

1.2 TumaBoda is a data controller for the purposes of the Data Protection Act, 2019 (the "Act") and is registered with the Office of the Data Protection Commissioner ("ODPC") under registration number 225-596B-3FA2. In relation to certain data which business clients provide to us about their own customers, we act as a data processor on the client’s instructions, as described in clause 5.

1.3 This Policy forms part of our Platform Terms and Conditions. By registering for or using the Platform you acknowledge that you have read and understood this Policy. Where the Act requires consent for a particular kind of processing, we will ask for it in the manner the Act requires, and you may withdraw it at any time as described in clause 11.

1.4 In this Policy, "personal data" means any information relating to an identified or identifiable natural person, and "process" and "processing" have the meanings given in the Act.

2.1 This Policy applies to the following categories of people:

• (a) "Business Clients" — the owners, representatives and staff of businesses and other persons who register an account to send deliveries;
• (b) "Riders" — the independent contractors who apply to perform, or perform, deliveries through the Platform;
• (c) "Recipients" — the persons to whom consignments are addressed and delivered, whose details are given to us by Business Clients;
• (d) visitors to our website and users of our applications; and
• (e) persons who contact us, apply to work with us, or otherwise interact with the Platform.

3.2 Data we collect automatically. When you use the Platform we collect transaction data (orders, pick-up and delivery points, timestamps, fees and payment status), proof-of-delivery records (which may include recipient names, codes, signatures and photographs), device and technical data (device type, operating system, application version, IP address and identifiers), and location data as described in clause 6. Calls with our support team may be recorded for quality and dispute resolution, with notice given at the time.

3.3 Data from third parties. We may receive personal data from identity and background verification providers, government registries and agencies, credit reference bureaus, telecommunications and payment service providers (including Mobile Money providers), and from Business Clients who provide us with Recipients’ details.

3.4 We do not intentionally collect sensitive personal data within the meaning of the Act, such as health data or biometric data, except where a photograph or verification document necessarily contains it, and we process any such data only for verification and security purposes in accordance with the Act.

4.1 We process personal data for the following purposes and on the following legal bases under the Act:

4.2 Where we rely on legitimate interests, we balance those interests against your rights and freedoms and do not process your personal data where our interests are overridden by them.

5.1 Business Clients provide us with Recipients’ names, telephone numbers, delivery addresses and, for pay-on-delivery orders, the amounts payable. We process this data only to perform, record and prove the delivery concerned, to contact the Recipient about it, and to trigger the pay-on-delivery payment prompt where applicable.

5.2 Each Business Client is the data controller of the Recipient data it provides and warrants to us that it has a lawful basis to disclose that data for the delivery. To the extent we process Recipient data on a Business Client’s instructions, we do so as a data processor under the Act, and this clause, together with our Terms and Conditions, records those instructions. If you are a Recipient and have questions about how your data came to us, you should contact the sender, though you may also exercise your rights against us under clause 11.

6.1 The Platform collects the precise location of a Rider’s device while the Rider is logged in, in order to dispatch orders, track consignments, show delivery status to Business Clients and Recipients, verify completion, and protect the safety of Riders and consignments. Riders consent to this collection as a condition of registration, and location is not collected when a Rider is logged out.

6.2 We collect pick-up and delivery addresses, and approximate device location where enabled, from Business Clients and Recipients to facilitate accurate collection and delivery.

7.1 We share personal data only as follows:

• (a) between users, on a need-to-know basis — a Rider assigned to a delivery sees the pick-up and delivery details and contact telephone numbers needed to perform it, and a Business Client and Recipient see the assigned Rider’s first name, photograph, telephone contact and location for that delivery;
• (b) with service providers — payment and Mobile Money providers, identity and background verification providers, cloud hosting, software, analytics, SMS and communications providers, who process data on our behalf under contracts requiring confidentiality and security consistent with the Act;
• (c) with professional advisers — auditors, insurers, debt collection agents and legal advisers, where necessary for our legitimate interests or legal claims;
• (d) with authorities — the ODPC, the Kenya Revenue Authority, law enforcement and other public bodies where disclosure is required or permitted by law, pursuant to a lawful order or process; and
• (e) on a business transfer — a purchaser or investor in connection with a merger, acquisition, financing or sale of assets, subject to appropriate confidentiality protections.

7.2 We do not sell personal data, and we do not share it with third parties for their own marketing.

8.1 Our website and applications use cookies and similar technologies to keep you signed in, remember your preferences, measure how the Platform is used and improve it. Some cookies are essential to the operation of the Platform; others, including analytics cookies, are used with your consent where the law requires. You may manage cookies through your browser or device settings, though disabling essential cookies may impair the Platform.

9.1 We keep personal data only for as long as it is needed for the purposes described in this Policy, and thereafter for the periods required by law or reasonably necessary to establish, exercise or defend legal claims. In general:

• (a) account and transaction records are kept for the life of the account and for seven years thereafter, consistent with statutory record-keeping and limitation periods;
• (b) verification documents of Riders are kept for the duration of the Rider’s registration and for a reasonable period after deactivation;
• (c) Recipient data is kept for as long as needed to record and prove the delivery concerned and to resolve any claim arising from it; and
• (d) location data is kept in identifiable form only for as long as operationally necessary, after which it is deleted or anonymised.

9.2 When personal data is no longer required, we delete it securely or anonymise it so that it no longer identifies anyone.

10.1 We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls limiting personal data to staff and service providers who need it, logging and monitoring, and staff confidentiality obligations. Pay-on-delivery amounts are masked from Riders by design.

10.2 No system is completely secure, and transmission over the internet carries inherent risk. You are responsible for keeping your account credentials confidential and for notifying us promptly of any suspected unauthorised use of your account.

11.1 Subject to the Act, you have the right to be informed about how your personal data is used; to access the personal data we hold about you; to have inaccurate or misleading data corrected; to have data deleted where we are no longer entitled to retain it; to object to or restrict processing in certain circumstances; to withdraw any consent you have given, without affecting processing already carried out; and, where applicable, to receive your data in a structured, commonly used and machine-readable format.

11.2 You may exercise these rights by writing to us at the contact address in clause 18. We may need to verify your identity before acting on a request. We will respond within the time required by the Act, and where the law allows us to refuse or limit a request, we will explain why.

11.3 These rights are not absolute. In particular, we may retain data which we are required or entitled by law to keep, including records needed for tax, fraud prevention, dispute resolution and the establishment or defence of legal claims.

12.1 The Platform uses automated processes to match orders to available Riders, to calculate delivery fees, and to flag transactions indicating possible fraud or misuse. No decision producing legal or similarly significant effects on you is made solely by automated means without human involvement: account suspensions, deactivations and claim outcomes are reviewed by our staff, and you may contest any such decision and request human review by contacting us under clause 18.

13.1 Some of our service providers, including cloud hosting and communications providers, store or process data on servers located outside Kenya. Where personal data is transferred outside Kenya, we do so in accordance with sections 48 and 49 of the Act, ensuring that appropriate safeguards are in place, including transfer to jurisdictions with adequate data protection safeguards or under contractual commitments binding the recipient to standards consistent with the Act, and, where required, with your consent.

14.1 The Platform is intended for persons aged eighteen years and above, and we do not knowingly collect personal data from children. A Recipient’s details may lawfully be provided to us by a Business Client where a delivery is addressed to a household; we process such details only as described in clause 5. If you believe a child has provided us personal data, please contact us and we will delete it.

15.1 We send direct marketing only where permitted by law and, where consent is required, only with your consent. Every marketing message we send includes a simple means of opting out, and you may opt out at any time through the Platform or by contacting us, without affecting service and transactional messages, which we will continue to send.

16.1 We maintain procedures for identifying, containing and remedying personal data breaches. Where a breach occurs which presents a real risk of harm to a data subject, we will notify the ODPC and, where required, the affected data subjects, within the periods prescribed by the Act.

17.1 We may update this Policy from time to time. The current version will always be posted on the Platform with its date of last update, and material changes will be notified through the Platform or by email before they take effect. Your continued use of the Platform after an update takes effect constitutes acknowledgement of the updated Policy.

18.1 Questions, requests and complaints concerning this Policy or our handling of personal data should be addressed to our data protection contact at privacy@tumaboda.co.ke or by post to our registered office stated in clause 1.1. We take complaints seriously and will investigate and respond to them.

18.2 If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner, whose details are available at www.odpc.go.ke.