Privacy Policy

1. Who we are

KukuStores is operated by Kukustores Enterprise, a business name registered with the Business Registration Service of Kenya. For the personal information described in this policy, we are the data controller.

You can reach us about privacy at [email protected] or +254 798 228 032.

2. When we decide, and when your business does

We decide how personal information is used for the people who run and work in businesses on KukuStores - owners, staff and the contacts of distributors and suppliers. This policy covers that information.

Businesses can also record information about their own customers in KukuStores - for example a name or phone number on a sale. For that information, the business is the data controller and we process it only on its instructions to provide the service. If you are a customer of a shop and have a question about your information, contact the shop first; we will help it respond.

3. What we collect

• Account details: your name, email address, phone number, business name, whether you run a shop or a distribution business, and where the business is (county, constituency, ward and any address you add).
• Google sign-in: if you sign in with Google, the name, email address and account identifier Google shares with us.
• Staff details: names, phone numbers, email addresses, roles and branches of people you add, and their PINs, which we store only in a scrambled (hashed) form we cannot read.
• Identity verification: for shops that apply for verification, a photo of the owner's national ID, a selfie and the name on the ID; for distributors, the business details and documents we ask for. ID photos and selfies are sensitive personal data and we handle them with extra care.
• Sales and business records: products, prices, stock, sales, purchases, suppliers and receipts you record.
• Marketplace delivery: the counties sellers deliver to and the delivery prices they set, and for each order the branch it is delivered to.
• Payments: M-Pesa transaction codes, amounts, dates and the paying phone number for subscription payments and marketplace orders, and payout details for sellers.
• Credit, where offered: applications, the trading history used to assess them, decisions and repayments.
• Devices and technical information: the names and identifiers of devices you pair as tills, app version, IP address, sign-in and security events, and error reports when something goes wrong.
• Messages: support requests, chat messages, WhatsApp messages and attachments you send to our support number, and emails with us.
• Plan prompts: if you manage billing for your business, when you open a prompt about a paid feature or the plans page from it, and whether a plan was bought from it.

We collect this from you, from the people you add to your account, from your devices as you use the app, and from Safaricom and Google when you use M-Pesa or Google sign-in.

4. Why we use it, and on what basis

• To provide the Services you signed up for - running your account, tills and staff, syncing records, processing payments, the marketplace and support. We rely on our contract with you.
• To verify identity before offering credit or marketplace trading, and to prevent fraud. We rely on your explicit consent for ID photos and selfies, given when you submit them, and on our legitimate interest in keeping the platform safe.
• To assess and manage credit, where offered. We rely on our contract with you and your consent.
• To keep the Services secure and working - detecting misuse, fixing errors and keeping audit records. We rely on our legitimate interests.
• To send you service messages such as sign-in codes, receipts, billing reminders and important changes. We rely on our contract with you.
• To meet legal obligations, such as keeping tax and financial records and responding to lawful requests from authorities.
• To stop people who were removed from the marketplace for fraud or similar serious problems from returning under a new account. We keep a protected record of the owner's national ID number and phone number, stored only in a scrambled (hashed) form we cannot turn back into the number, and check new verification requests against it. We rely on our legitimate interest in preventing fraud.
• To understand which paid features businesses look for, using the plan prompt records above, so we can improve our plans. We rely on our legitimate interests.

We do not sell personal information, and we do not use advertising trackers or third-party analytics on the website or in the app. Plan prompt records are kept by us only.

5. Automated decisions

Where we offer credit, part of the assessment of whether to offer it and how much may be made automatically from your verified identity and trading history in KukuStores. You have the right to ask for a person to review any such decision, to have it explained, and to give your point of view. Contact us to do this.

6. Who we share it with

We share personal information only as needed to provide the Services, with:

• Safaricom, to process M-Pesa payments;
• Meta Platforms, which runs WhatsApp, when you message our support number;
• Google, when you use Google sign-in;
• our email delivery provider, which sends sign-in codes and service emails;
• our hosting, storage, network and error-monitoring providers, which run our servers, store files such as product photos and verification images, protect the site from attacks and alert us to faults;
• other businesses on the marketplace, only what an order needs - such as business name, location and contact details;
• authorities, where the law requires it or to protect people from harm or fraud;
• a buyer or successor, if our business is sold or reorganised, under the same protections.

Our providers may use the information only to provide their service to us, under contract.

7. Information stored outside Kenya

Our servers are hosted in Germany, and some of our providers process information in other countries. When personal information leaves Kenya, we make sure it is protected as the Data Protection Act, 2019 and its regulations require - for example, through contracts that require the recipient to protect it to that standard.

8. How long we keep it

• Account, staff and business records: while your account is open. When we close an account at your request, or a free account no one has signed in to for a year after emailing the owner at least 60 days before, it is locked straight away and archived 30 days later. On archiving we remove sign-in details and delete identity photos, and keep the records the law requires, as below. If you ask us to delete particular information, we do so within 30 days unless the law requires us to keep it.
• Sales, payment and billing records: at least five years, as the Tax Procedures Act requires for financial records. Five full years after the year an account is archived, we delete its business records and staff details. We keep only what other accounts or our own books rely on, such as marketplace orders and our invoices, with personal details such as phone and ID numbers removed.
• ID photos and selfies: while your account is open, to show that verification was done properly; deleted when the account is archived after closing. The verification outcome and ID number are kept with your business records while the law requires.
• Protected fraud-prevention records (hashed ID and phone numbers): until we lift the restriction they relate to.
• Support messages: up to two years after the conversation ends.
• Security and error logs: up to 12 months.

Backup copies of our database are replaced on a rolling basis, so deleted information disappears from backups within 14 days.

9. How we protect it

We encrypt information in transit, store PINs and device secrets only in hashed form, keep each business's records separated from every other business's at the database level, limit which staff can access personal information, keep audit records of sensitive actions, and back up our database regularly. No system is perfectly secure; if a breach puts your information at risk, we will tell you and the Data Commissioner as the law requires.

10. Your rights

Under the Data Protection Act, 2019, you have the right to:

• be told how your personal information is used - which is what this policy does;
• get a copy of the personal information we hold about you;
• have wrong or misleading information corrected;
• have information deleted when we no longer have a lawful reason to keep it;
• object to our use of it, or ask us to restrict it;
• receive information you gave us in a format you can take to another service;
• withdraw consent you gave, such as for verification images - this does not affect what was done before, but may mean we can no longer offer the features that depend on it.

To use any of these rights, contact us at [email protected] or +254 798 228 032. We may need to confirm who you are first, and we will respond within the time the law sets.

If you are not happy with how we handle your information, you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke). We would appreciate the chance to put things right first.

11. Cookies and storage on your device

The website and app store small amounts of information on your device to work: your language choice, your signed-in session, and - in the app - your records while offline, so you can keep selling without a connection. We do not use advertising or tracking cookies.

12. Children

KukuStores is for businesses and is not meant for anyone under 18. We do not knowingly collect information about children. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We will update this policy when our practices or the law change. For an important change, we will tell you in the app or by email before it takes effect. The date at the top shows the version in force.

This policy is published in English and Swahili. If the two differ, the English version applies.

14. Contact us

• Data controller: Kukustores Enterprise
• Phone and WhatsApp: +254 798 228 032
• Email: [email protected]
• Address: Nairobi, Kenya