Peleka Privacy Policy

1.1 Peleka (“Peleka”, “we”, “us” or “our”) operates a technology-enabled delivery platform that helps businesses coordinate and manage deliveries, from everyday orders to scheduled deliveries, within Kenya. This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you use the Peleka platform, website, mobile application or services (together, the “Services”).

1.2 This Policy is issued in accordance with the Data Protection Act, 2019 (Kenya) and the Data Protection (General) Regulations, 2021. By using the Services, you acknowledge the practices described in this Policy.

2.1 Peleka is the data controller responsible for your personal data. Company details: Peleka Ltd, Company Registration No. [number], registered in Kenya, with its registered office at Karen Shopping Plaza, Nairobi, Kenya, 00502.

2.2 Data protection contact: [email protected]. This is the contact for all data protection queries, requests and breach reports.

3.1 We may collect the following categories of personal data:

• Business account information — business name, industry, physical address; and the name, job title, phone number and email address of the person registering or administering the account;
• Delivery information — pickup and delivery addresses, recipient names, recipient phone numbers, delivery instructions, order details and any special handling notes you provide;
• Payment information — billing details and payment confirmation records (card or mobile money transactions are processed by our licensed payment service providers; we do not store full card details);
• Technical and usage data — device type, operating system, IP address, log-in records, pages visited, app activity and crash reports, collected through cookies and similar technologies; and
• Communications — records of your communications with us, including support requests, feedback and correspondence.

4.1 We use personal data for the following purposes, with the corresponding legal bases under the Data Protection Act, 2019:

4.2 We will not send you marketing communications without your consent, which you may withdraw at any time.

5.1 We may disclose personal data to:

• Riders, drivers, dispatch and delivery personnel — limited to the information needed to complete a delivery (e.g., pickup/drop locations, recipient contact, delivery notes);
• Service providers acting on our instructions — hosting, cloud storage, payment processing (M-Pesa/mobile money and card processors), analytics and customer support providers, bound by confidentiality and data protection obligations;
• Professional advisers — auditors, lawyers and insurers, where necessary;
• Regulators, law enforcement or courts — where required by Kenyan law, a court order, or to protect our legal rights; and
• A successor entity — in connection with a merger, acquisition or reorganisation, subject to this Policy.

5.2 We do not sell personal data to third parties.

6.1 We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law: delivery and transaction records for the duration of our relationship plus the period required for accounting, tax and legal claims (generally up to 7 years for financial records); support and communication records for up to 3 years; and technical logs for up to 12 months, unless a longer period is required by law or for the establishment of legal claims.

7.1 We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure, including access controls, encryption in transit, staff confidentiality obligations and vendor due diligence. No method of transmission or storage is 100% secure, but we continually review and improve our safeguards.

8.1 Under the Data Protection Act, 2019, you have the right to:

• Be informed of how your personal data is used (this Policy);
• Access the personal data we hold about you;
• Request correction or completion of inaccurate or incomplete data;
• Request deletion of your personal data, subject to legal retention requirements;
• Object to or restrict certain processing, including direct marketing;
• Withdraw consent where processing is based on consent; and
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

8.2 To exercise any right, contact our data protection contact in Section 2.2. We will respond within a reasonable period and in any event within the timelines required by law. We may need to verify your identity before acting on a request.

9.1 The platform uses cookies and similar technologies for essential functionality (log-in sessions, security), performance analytics and, with consent, to improve your experience. You can control cookies through your browser or device settings; disabling essential cookies may affect platform functionality.

10.1 The platform may contain links to third-party websites or integrate third-party services (e.g., payment processors, maps). We are not responsible for the privacy practices of third parties, and we encourage you to read their privacy policies.

11.1 The Services are intended for businesses and persons aged 18 years and above. We do not knowingly collect personal data from children under 18. If you believe a child’s data has been provided to us, contact us and we will delete it.

12.1 We may update this Policy from time to time. The “last updated” date above reflects the latest version. For material changes, we will notify you via the platform, email or other reasonable means before the change takes effect.

13.1 Questions, requests or complaints regarding this Policy or your personal data: Peleka — Email: [email protected] | Phone: +254782952923 | Address: Karen Shopping Plaza, Nairobi, Kenya, 00502

13.2 You may also lodge a complaint with the Office of the Data Protection Commissioner, Kenya (www.odpc.go.ke).