In short
- We collect what we need to deliver your order: your phone number, your address and what you ordered.
- Your shop and your rider see only what they need for your order.
- We never see your M-Pesa PIN.
- You can ask to see, correct or delete your data at any time.
1.Who we are
Pezta Ltd is the data controller. [ODPC registration number].
Contact privacy@pezta.co.ke.
2.What we collect
| What | Examples | From |
|---|---|---|
| Account | Name, phone number, email if you give it | You |
| Addresses | Estate, building, landmark, map pin | You |
| Orders | Shop, items, notes, times, delivery photo | You, the shop, the rider |
| Payments | M-Pesa receipt code, phone number, amount. Never your PIN | Safaricom |
| Location | Your location while choosing an address; riders’ location during shifts | Your phone, with your permission |
| Device | Phone model, app version, crash details | The app |
| Support | Calls, WhatsApp messages and emails with us | You |
3.Why we use it
| Why | The legal basis |
|---|---|
| Taking, delivering and supporting your order | Needed for our contract with you |
| Keeping tax and payment records | Required by law |
| Preventing fraud and keeping riders safe | Our legitimate interests |
| Offers and news | Your consent, which you can withdraw |
4.Who we share it with
The shop gets your name, order and notes. Your rider gets your first name, phone number, address and landmark for that delivery only.
Safaricom processes your M-Pesa payment. Our hosting, SMS and maps providers process data for us under contract. Authorities, only when Kenyan law requires it.
We never sell your data.
5.Riders’ location
We track a rider’s location only during their shift, to give orders and show customers where their order is.
6.Offers and messages
We send offers only if you agree, and you can stop them any time. Order messages are part of the service.
7.Children
Pezta is not for under-18s, and we don’t knowingly collect their data [advocate to confirm].
8.Data stored outside Kenya
Some of our providers store data outside Kenya. We use them only with the safeguards the Data Protection Act requires.
9.Keeping it safe
Access is limited to staff who need it. If a breach puts you at risk, we’ll tell the Data Commissioner within 72 hours and tell you without delay.
10.How long we keep it
| Record | How long |
|---|---|
| Account | While your account is open, then [period] |
| Orders and payments | [5 years], for tax law [advocate to confirm] |
| Riders’ shift locations | [period] |
| Support messages | [period] |
| Website analytics (if you accept) | [period] |
11.Your rights
To be told, to see, to correct, to delete, to object, and to complain to the ODPC. How to use them: Your data rights.
12.Changes
We’ll post changes here and tell you in the app if they matter.
Related documents
Questions about this document? Email privacy@pezta.co.ke or call 0700 000 000.