Privacy policy

Duka is operated by [Registered company name], [Registered address, Nairobi, Kenya](“we”, “us”). We process personal data in line with the Data Protection Act, 2019 and its regulations.

We play two roles. For the people who sign up and run a shop on Duka, we are the data controller. For the records a shop keeps about its own customers, staff and suppliers, the shop is the controller and we are its data processor: we hold that data on the shop's behalf and use it only to provide the service.

• Account details— the owner's name, email address and phone number, and the names, roles and sign-in details of staff the owner adds. Passwords and PINs are stored only in hashed form.
• Shop details— the shop's name, address, KRA PIN and the M-Pesa and eTIMS settings the owner enters.
• Records the shop keeps— sales, stock, purchases, suppliers, customers and credit balances, as entered by the shop. This can include a customer's name and phone number.
• Payment data — for M-Pesa payments, the phone number, amount and transaction reference that Safaricom returns. We never see M-Pesa PINs.
• Technical data — the cookies that keep you signed in, and error reports (device, browser, the screen where something failed) so we can fix faults.

• To run the service: record sales, keep stock and balances, print receipts and sync a device that was offline.
• To take and confirm M-Pesa payments, and to file sales with KRA through eTIMS where the shop has turned it on.
• To bill for the subscription and to contact the owner about their account, a payment or a fault.
• To keep the service secure and working: detecting misuse, diagnosing errors and keeping backups.
• To meet our legal obligations, including tax and record-keeping.

The lawful bases are performance of our contract with the shop, our legitimate interest in a secure and working service, and compliance with the law. We do not sell personal data and we do not use a shop's records for advertising.

We share data only with the providers needed to run Duka, under agreements that limit them to that purpose:

• Supabase — database hosting and sign-in. Each shop's records are kept in a database of its own.
• Vercel — application hosting.
• Safaricom — M-Pesa payment processing.
• Kenya Revenue Authority — eTIMS filing, where the shop has enabled it.
• Our email provider — account and verification emails.
• Sentry — error monitoring.

Some of these providers store data outside Kenya. Where they do, we rely on the safeguards the Act requires for cross-border transfers. We will also disclose data when the law requires it.

A shop's records are kept for as long as its account is open, and for the period tax and accounting law requires after that. When an account closes, the owner can ask for an export first; the shop's database is then deleted, except for what we must retain by law. Error reports are kept for a limited period and then discarded.

Every shop's data lives in its own database, separate from every other shop's. Connections are encrypted, M-Pesa and KRA credentials are encrypted at rest, and staff access inside a shop is limited by role. No system is perfectly secure; if a breach affects your data, we will notify you and the Data Protection Commissioner as the Act requires.

Under the Act you may ask us to:

• tell you whether we hold your data, and give you a copy;
• correct data that is wrong or incomplete;
• delete data we no longer have a reason to keep;
• restrict or object to how we use it; and
• move it to another service in a usable format.

If you are a customer of a shop that uses Duka, the shop controls your records: please contact the shop first, and we will help them answer you. To exercise a right with us, email support@superduka.com. You may also complain to the Office of the Data Protection Commissioner.

When we change this policy we will update the date at the top, and tell shop owners by email before a significant change takes effect.