Draft for review by a Kenyan advocate before publication. Operator details, provider arrangements and retention periods marked in [BRACKETS] must be completed before this becomes the published policy.
Who is responsible for your data
ErrandGo is a service under Trinity with independent day-to-day operations. The legal entity responsible for personal data is [COMPANY LEGAL NAME], of [REGISTERED ADDRESS]. [CONFIRM REGISTRATION DETAILS, PUBLIC PRIVACY CONTACT AND ANY REQUIRED ODPC REGISTRATION BEFORE PUBLICATION]. This draft does not claim that ODPC registration has been completed.
This policy explains what we collect, why, and the rights you have under the Data Protection Act, 2019.
What we collect
- Account details: your name, email address, phone number when supplied, password hash, role, account preferences and referral details. Google sign-in, when enabled, supplies a Google account identifier and verified email information; we do not receive your Google password.
- Runner verification: national ID details, a photo, vehicle type and, where relevant, driving licence details.
- Errands: pickup and dropoff addresses, notes, timing, budget, chat messages, receipt photos and ratings.
- Payments: transaction references, payment status, amounts, wallet entries, refunds and payout details. Enabled providers may include Safaricom M-Pesa and Paystack for hosted card checkout. We do not receive your M-Pesa PIN or full card number through hosted checkout.
- Location: pickup and dropoff addresses and coordinates; a customer's location when they choose to use it to fill an address; a runner's availability coordinates and location updates during active assignments. Native background tracking requires device permission and an active assignment.
- Device and access information: push notification tokens when enabled, platform, sessions and access logs needed for security and troubleshooting.
- Browser and device storage: essential session and CSRF cookies, saved appearance and device settings, and temporary app caches. These support sign-in, security and preferences. Blocking essential cookies prevents browser sign-in.
- Support: messages you send us and our replies.
Customer tracking is restricted to the runner assigned to their active errand. Availability and tracking depend on runner status, permissions, network access and device background restrictions. A runner can stop background updates by ending the active assignment or revoking location permission, which may affect service delivery.
Why we use it, and on what basis
- To provide the service you asked for: matching errands to runners, tracking, payment and delivery confirmation. Lawful basis: performance of a contract.
- To keep the platform safe: verifying runners, preventing fraud, and investigating disputes and safety reports. Lawful basis: legitimate interests and, where applicable, legal obligation.
- To meet legal duties: keeping payment and tax records and responding to lawful requests from authorities. Lawful basis: legal obligation.
- To send service messages: verification and password reset emails, booking, payment and support updates. Optional marketing must respect your preferences and any consent required by law.
- To maintain the service: diagnose errors, protect accounts and review operational performance. [CONFIRM AND DOCUMENT THE LAWFUL BASIS FOR EACH PROCESSING PURPOSE BEFORE PUBLICATION].
Who we share it with
- The customer and assigned runner receive the names, contact details, addresses, instructions, chat and receipts needed for their errand. Live runner location is shared during the active assignment.
- Enabled payment, email, SMS, Google sign-in, Firebase push and mapping providers receive information required for their particular service. Features may be unavailable until the relevant provider is configured.
- Hosting providers store our data under contracts that require them to protect it.
- Authorities, where the law requires us to.
We do not sell personal data. [CONFIRM ACTUAL PROVIDERS, PROCESSING COUNTRIES, CONTRACTS AND INTERNATIONAL TRANSFER SAFEGUARDS BEFORE PUBLICATION]. Trinity affiliation does not give unrelated Trinity staff unrestricted access to ErrandGo customer or runner records.
How long we keep it
- Account data: while your account is open, and up to [PERIOD] after it is closed.
- Errand records, chat and receipts: [PERIOD] after the errand, so disputes can be resolved.
- Payment records: as long as tax law requires, currently [PERIOD].
- Runner location and access logs: [APPROVED PERIOD AND DELETION PROCESS].
Account deletion starts an account removal process; it does not automatically erase every transaction, dispute, backup or legally required record. This draft does not promise an automatic retention purge. [APPROVE AND IMPLEMENT THE RETENTION SCHEDULE AND BACKUP EXPIRY PROCESS BEFORE PUBLICATION].
Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed about how your data is used;
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, subject to records we must keep by law;
- object to processing, including for direct marketing;
- receive your data in a portable, machine-readable format;
- not be subject to a decision based solely on automated processing that significantly affects you.
To use these rights, open Help in the app or the website, use the support contact displayed there, or use Delete account in Settings. [ADD VERIFIED PUBLIC PRIVACY EMAIL AND POSTAL CONTACT]. We may verify your identity before acting. Requests are reviewed against applicable law and record-keeping duties.
Security
Passwords and verification codes are hashed. Sign-in attempts are rate limited and sensitive actions require authentication. Receipt access is restricted to the errand participants and authorised staff. Use a private device and sign out after using a shared computer.
Complaints
Contact ErrandGo support about a concern. You may also complain to the Office of the Data Protection Commissioner. Contacting us first does not remove that right.
Changes
We will update this policy when our practices change and tell you in the app about significant changes.