Last updated: January 1, 2026 · Compliant with the Kenya Data Protection Act (2019)
DukaMoja Limited ("DukaMoja", "we", "us") is a company incorporated in Kenya operating the DukaMoja multi-vendor e-commerce platform at dukamoja.co.ke. As a data controller under the Kenya Data Protection Act (2019), we are responsible for how your personal data is collected, used, and protected.
We collect: (a) Identity data — name, email address, phone number, national ID or passport number; (b) KYC data (vendors only) — KRA PIN, business registration number, proof of address; (c) Transaction data — orders, payments, delivery addresses, M-Pesa transaction references; (d) Technical data — IP address, device type, browser, cookies, session data; (e) Usage data — pages visited, clicks, search queries; (f) Communications — support tickets, chat messages, emails you send us.
We use your data to: (a) create and manage your account; (b) process orders and payments; (c) verify vendor identities (KYC); (d) send order confirmations, delivery updates, and support communications; (e) detect fraud and ensure platform security; (f) improve the Platform through analytics; (g) comply with legal obligations under Kenyan law; and (h) send marketing communications (with your consent, which you may withdraw at any time).
We process your data under the following legal bases: (a) Contract performance — processing necessary to fulfil your orders and our obligations to you; (b) Legal obligation — compliance with the Kenya Data Protection Act, tax laws, and financial regulations; (c) Legitimate interests — fraud prevention, platform security, and improving our services; (d) Consent — for marketing communications and optional cookies.
We share your data with: (a) Vendors — only the data necessary to fulfil your order (name, delivery address, phone); (b) Safaricom Daraja for M-Pesa payment processing; (c) SasaPay for Wallet as a Service account infrastructure; (d) Logistics partners — for delivery and tracking; (e) Blnk — for ledger and financial record-keeping; (f) Legal authorities — when required by Kenyan law, court order, or to prevent fraud. We do not sell your personal data to any third party.
We retain personal data for as long as necessary for the purposes it was collected: (a) Account data — for the duration of your account plus 3 years; (b) Transaction data — 7 years (required by Kenyan tax and financial regulations); (c) KYC documents — 5 years post-account closure; (d) Marketing data — until you withdraw consent. You may request deletion of your data subject to legal retention obligations.
Under the Kenya Data Protection Act (2019), you have the right to: (a) access your personal data; (b) correct inaccurate data; (c) delete your data (subject to legal obligations); (d) object to processing; (e) data portability; (f) withdraw consent for marketing at any time. To exercise these rights, email [email protected]. We will respond within 30 days.
We use cookies to: (a) keep you signed in (essential session cookie); (b) remember cart items; (c) analyze Platform usage (analytics). You can control non-essential cookies via your browser settings. Refusing analytics cookies will not affect your ability to use the Platform.
We implement industry-standard security measures including: 256-bit TLS encryption for data in transit; encrypted storage of sensitive data; access controls limiting staff access to personal data on a need-to-know basis; regular security audits. In the event of a data breach affecting your rights, we will notify you and the Office of the Data Protection Commissioner within 72 hours.
DukaMoja is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or Platform notification at least 14 days before they take effect. Continued use of the Platform after changes constitutes acceptance of the updated Policy.
For privacy queries, contact our Data Protection Officer: [email protected]. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).