Privacy Policy

Effective date: 16 July 2026
Last updated: 16 July 2026

PataDeals Technologies Ltd ("PataDeals", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use and share it, and the rights you have under the Data Protection Act, 2019 (the "DPA") of the Republic of Kenya.

This Policy applies to the PataDeals mobile application, the website at https://patadeals.com, our business web portals (kiosk, logistics, manufacturer, deal-partner and admin portals), and all related services (together, the "Platform").

Data Controller: PataDeals Technologies Ltd, Nairobi, Kenya. PataDeals Technologies Ltd is registered with the Office of the Data Protection Commissioner (ODPC) as a data controller/processor as required by the DPA and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

1. The data we collect

1.1 Data you give us

• Identity and contact data: name, mobile phone number, email address, and (for business roles) business name, registration details and contact persons.
• Account security data: credentials such as your PIN and password (never stored in readable form) and your security settings.
• Transaction data: orders, parcel bookings, sender and recipient names and phone numbers, delivery addresses and location pins, payment references, wallet movements, points and redemptions, referral activity.
• Parcel data: the parcel details, declarations, descriptions and photographs you provide when booking.
• Business onboarding data: for business roles: the verification and payout information we reasonably request during onboarding.
• Communications: support tickets, chat and call records with our support team, and survey responses.

1.2 Data collected automatically

• Location data: GPS coordinates when you use location features (for example finding nearby kiosks, deliveries, or business onboarding), and location captured at key delivery events as proof of delivery. You can control the app's location permission in your device settings, but some services (delivery, nearby search) will not work without it.
• Device and usage data: device type, operating system, app version, IP address, log data and diagnostic events.
• Cookies (website): see Section 9.

1.3 Data from third parties

• Payment confirmations from payment service providers (e.g. M-Pesa transaction confirmations).
• Delivery status events from our logistics partners and agents.
• SMS/email delivery reports from our messaging providers.

We do not knowingly collect data from persons under 18; the Platform is for adults only. We do not collect biometric data.

2. Why we process your data (purposes and lawful bases)

Under section 30 of the DPA, we process personal data on these bases:

We do not use your personal data for automated decision-making that produces legal effects on you without human involvement, and we do not sell your personal data.

3. Who we share data with

We share personal data only as needed to run the Platform:

• Delivery participants. When you send or receive a parcel or place an order, the participants who fulfil it (such as the kiosk, the delivery agent and the delivery company) see only the details they need to complete the transaction: for example names, phone numbers, delivery location, parcel description/photo, and handling warnings.
• Payment service providers: regulated payment processors and mobile-money providers, to process payments and payouts.
• Communications providers: SMS, email and messaging delivery providers, to send you OTPs, notifications and messages you have opted into.
• Insurance underwriters: where a parcel is covered, the details needed to administer cover and claims (see our Parcel Insurance policy).
• Professional advisers and authorities: auditors, lawyers, and regulators or law enforcement where the law requires (for example under the Computer Misuse and Cybercrimes Act, 2018 or a court order).
• Registered delivery partner companies: the licensed parcel delivery companies that carry parcels on our network receive the operational data needed for carriage (as described under "Delivery participants" above).
• Business transfers: if PataDeals Technologies Ltd is merged or acquired, data may transfer to the successor subject to this Policy.

All processors acting on our behalf are bound by written contracts imposing confidentiality and security obligations consistent with the DPA.

4. International transfers

Your data is primarily stored and processed in Kenya. Some of our service providers (for example cloud hosting, email or messaging providers) may process data outside Kenya. Where that happens we comply with sections 48–49 of the DPA: we transfer only to jurisdictions or under contractual safeguards that ensure an adequate level of protection, and we can provide details of those safeguards on request.

5. How long we keep data

We keep personal data only as long as needed for the purposes above:

• Account data: for the life of your account, then deleted or anonymised within 90 days of account deletion, except as below.
• Transaction, payment and tax records: retained as required by the Tax Procedures Act and other financial laws (generally up to 7 years).
• Parcel records (including photos): up to 24 months after delivery, to support claims, disputes and insurance.
• Support records: up to 24 months after closure of the ticket.
• Fraud and security records: as long as reasonably necessary to protect the Platform and comply with law.

6. Your rights under the Data Protection Act, 2019

You have the right to:

• be informed about how your data is used (this Policy);
• access a copy of the personal data we hold about you;
• rectification: correct inaccurate or incomplete data (most contact data you can edit directly in the app);
• erasure: request deletion of data we have no lawful basis to retain. You can delete your account in the app under Settings → Account; accounts with active business roles must first contact support to settle obligations;
• object to or restrict processing, including opting out of marketing at any time (Settings → Notifications, or reply STOP to promotional SMS);
• data portability: receive data you provided in a structured, commonly used, machine-readable format; and
• withdraw consent where processing is based on consent, without affecting prior processing.

To exercise any right, contact us via the channels in Section 11. We respond within the timelines required by the DPA (generally within 7–30 days depending on the request). If you are dissatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner: https://www.odpc.go.ke, P.O. Box 30920-00100, Nairobi.

7. How we protect your data

We apply appropriate technical and organisational security measures as required by section 41 of the DPA, including:

• credentials are never stored in readable form, and data in transit is encrypted;
• sensitive account actions require additional verification;
• staff access to personal data is restricted to what their role requires, and is logged and audited; and
• payment card data is handled by our regulated payment providers; PataDeals does not store full card numbers.

No system is perfectly secure. If a breach occurs that risks your rights and freedoms, we will notify the ODPC within 72 hours and affected users without undue delay, as required by section 43 of the DPA.

8. Marketing choices

We send promotional SMS, email and push notifications only in accordance with your preferences. You can opt out at any time in Settings → Notifications in the app or by contacting support. Service messages that are part of operating your account (OTPs, delivery updates, payment receipts, security alerts) are sent regardless of marketing preferences.

9. Cookies and website analytics

The patadeals.com website uses:

• Strictly necessary cookies: session and security cookies needed for the site to function; and
• Analytics cookies: aggregate statistics about site usage, only with your consent via the cookie banner.

You can manage cookies in your browser settings. Disabling necessary cookies may break parts of the site, such as parcel tracking.

10. Children

The Platform is not directed at children and account holders must be 18 or over. If you believe a minor has registered, contact us and we will close the account and delete the data.

11. Contact us

For privacy questions, requests or complaints, contact our Data Protection Officer:

• Email: help@patadeals.com (subject line: "Data Protection")
• WhatsApp: +254 700 000 636
• In-app: Me → Help & Support

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified in-app or by SMS/email before they take effect, and the "Last updated" date above will change. The current version is always available at /privacy/.

© 2026 PataDeals Technologies Ltd. All rights reserved.