Privacy policy

Duka (“Duka”, “we”, “us”) runs duka.africa: online shops at a duka.africa address or a seller's own domain, the seller dashboard, the Duka Seller app and the Duka rider app. We are based in Nairobi, Kenya, and handle personal data under the Data Protection Act, 2019 (“the Act”).

• Sellers, their team members and riders. Duka is the data controller for your account and for how we run the platform.
• Shoppers. Every shop on Duka is run by an independent seller. When you buy from a shop, that shop is the data controller for your order: your name, phone number, delivery details and what you bought. Duka is the shop's data processor: we handle that data on the shop's behalf to run checkout, payments, delivery, receipts and messages. Duka is the controller for your Duka shopper sign-in (which works across Duka shops) and for the payment and financial records we must keep ourselves.

If you have a question about how a shop uses your data, ask the shop first. If you can't reach them, write to us at [email protected] and we'll help.

• Account: your name, email address, phone number, password (stored only as a one-way hash, never in readable form), your role and when you sign in.
• Store: your store's name, contact details, location, logo, photos, design, policies, domain and settings.
• Identity verification (needed before your first payout): your legal name, ID type and number, photos of the front and back of your ID, a selfie holding your ID, your KRA PIN and, for a registered business, its registration certificate.
• Payments: your payout M-Pesa number and payout history. If you take payments to your own M-Pesa till or paybill, its number and the Safaricom API credentials you give us. If you issue KRA eTIMS invoices, your eTIMS details.
• Team: the name, email, phone number and role of each team member you invite.
• Content: product photos, videos, descriptions and prices, messages with your customers, replies to reviews, and the campaigns and posts you create.
• Connected channels: when you connect WhatsApp, Facebook, Instagram or TikTok, the account details and access tokens for that connection, and the messages and posts that go through it.
• Devices: a push notification token for each phone signed in to the Duka Seller app. The app keeps your sign-in in your phone's secure storage and a copy of your shop data on the phone so it works offline.
• App permissions: the app asks for the camera (product photos and videos, barcode scanning and verification photos), your photo library, the microphone (sound for product videos), Bluetooth (receipt printers) and notifications. It asks only when you use the feature, and you can say no.
• Security records: a log of important actions in your store (who did what and when, with the IP address) so you and we can see what happened.

• Contact details: your name, phone number and, if you give it, your email address.
• Delivery details: the recipient's name and phone number, county, town, area, building or landmark and delivery notes, or the pickup point you choose.
• Orders: what you bought and from which shop, amounts, delivery progress, returns, refunds and any case you open.
• M-Pesa payments: the phone number that paid, the amount and the M-Pesa receipt number Safaricom sends us. You enter your M-Pesa PIN on your own phone: Duka and the shops never see it.
• Messages: your conversations with a shop on its website chat, WhatsApp, Instagram, Facebook Messenger or SMS.
• Reviews and questions you post. Reviews show your first name and initial.
• Loyalty and extras: points, referrals, gift cards, Lipa Pole Pole (layaway) plans and wishlists.
• Marketing choices: whether you agreed to offers by SMS from a shop. Reply STOP to any offer to opt out.
• Tax invoices: if a shop issues KRA eTIMS invoices and you give your KRA PIN, your name and PIN go on the invoice.

If you deliver for Duka or for a shop, we collect your name, phone number, national ID number, driving licence, vehicle details, photo and documents, your payout number and earnings, and your location while you are online or on a delivery, so deliveries can be assigned and shoppers can follow their parcel.

Duka doesn't run advertising trackers and doesn't sell personal data. Our cookies and the data saved in your browser are for:

• keeping you signed in, your bag, wishlist, language and chosen pickup point;
• referrals: the invite code you followed and a random device code that stops people referring themselves;
• visit statistics for the shop: a random visitor code (not your name) with the pages you view, where you came from and the type of device. Detailed visit records are kept for 30 days; after that only daily totals remain.
• Duka's own marketing: when you reach duka.africa from one of our ads or links, which campaign brought you (the link's tags, not who you are), kept for 90 days. If you open a shop, it is saved with the shop along with your answer to “How did you hear about Duka?”.

A seller can add their own Google Analytics or Meta Pixel to their shop. If they do, Google or Meta receive information about your visit to that shop, under the seller's responsibility and those companies' own policies. Duka doesn't add them to duka.africa, the seller dashboard or the apps.

• To provide Duka (performing our contract with sellers, and with shoppers for sign-in): shops, checkout, payments, delivery, receipts, messages, payouts and support.
• To keep accounts and money safe (our legitimate interests and legal obligations): identity checks before payouts, SMS codes for sign-in and withdrawals, fraud checks and security logs.
• To meet the law: tax and financial records, eTIMS invoices and lawful requests from authorities.
• To keep you informed: order updates by SMS, WhatsApp or email, and account and security messages.
• Marketing only with your consent. You can withdraw it any time.
• To improve Duka using usage statistics.

Some features use AI from Anthropic (Claude) or OpenAI. They work only when the shop or seller uses them, and we send only what the feature needs. We never send ID documents, passwords or M-Pesa credentials.

• Shop assistant: answers shoppers on a shop's website chat and, if the seller turns it on, on WhatsApp, Instagram, Facebook and SMS. It receives the recent messages in the conversation, the page you're on and what's in your bag, the shop's products and policies, and an order's status if you ask about one. Sellers can turn it off, and you can ask for a person at any time.
• Seller tools such as Write with AI, Design with AI, the shop builder, reply suggestions and conversation summaries: they receive the product photos, product and store text, and the conversation the seller is working on.
• Photo backgrounds: when a seller removes a product photo's background, the photo is sent to remove.bg.

AI can make mistakes. Shops are responsible for what they confirm to shoppers.

We share personal data only as needed to run Duka, with:

• The shop you buy from and its team.
• Safaricom (M-Pesa): payment requests and confirmations, and payouts to sellers and riders. Shops that use their own till or paybill are paid by Safaricom directly.
• Delivery: Duka riders, a shop's own riders, pickup points and couriers such as G4S Courier and Fargo Courier get what they need to deliver: the recipient's name, phone number and address. Labels don't list items or prices.
• Messages: Africa's Talking (SMS, including sign-in codes), Meta (WhatsApp, Facebook and Instagram, when a shop uses them), Amazon SES (email) and Expo (push notifications to the Duka apps, delivered through Apple and Google).
• Social posting: Meta and TikTok receive the posts, videos and captions a seller chooses to publish after connecting their account.
• AI providers: Anthropic or OpenAI, and remove.bg, as described above.
• Kenya Revenue Authority: invoice details for shops that issue eTIMS invoices.
• Hosting and network: Amazon Web Services (servers, database, file storage) and Cloudflare (network, security and custom domains).
• Authorities and advisers when the law requires it or to protect people, and a buyer of Duka's business if that ever happens, under the same protections.

We don't sell personal data, and we don't share it for other companies' advertising.

Duka's servers and database are with Amazon Web Services in Frankfurt, Germany. Some other providers above (including Anthropic, OpenAI, Meta, TikTok, Cloudflare, Expo and remove.bg) also process data outside Kenya. We transfer data abroad only as the Act allows: to providers with appropriate data protection safeguards, under contract, and only what each service needs.

• Orders, receipts, invoices, payments, payouts and ledger records: as long as Kenyan tax and financial law requires (currently at least five years), even after an account is deleted.
• Identity verification: while your store is open, then only as long as the law requires.
• Everything else: while your account is open. When an account is deleted, we delete or anonymise its data, except records the law makes us keep.
• Visit statistics: detailed records for 30 days, then daily totals only.

• Everything travels over HTTPS.
• Passwords are stored as one-way hashes.
• ID numbers, ID document photos, access tokens and payment credentials are encrypted at rest (AES-256).
• ID documents sit in private storage that only authorised Duka staff can open.
• Withdrawals and payout number changes need an SMS code, and Duka staff need two-factor sign-in to approve payouts.
• Money is recorded in a ledger that can't be edited after the fact.

No system is perfectly secure. If something goes wrong, we'll tell the Data Protection Commissioner and the people affected as the Act requires.

Under the Act you have the right to:

• be told how your data is used (this policy);
• get a copy of your personal data;
• have wrong or incomplete data corrected;
• have data deleted when we no longer need it or have no right to keep it;
• object to, or ask us to restrict, how we use it, including for marketing;
• receive your data in a format you can take elsewhere;
• withdraw consent you gave, without affecting what was done before.

Write to [email protected]. We may need to confirm who you are first. For order data held for a shop, we'll pass your request to the shop or help them answer it.

If you're unhappy with our answer, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.

• Sellers and team members: in the Duka Seller app go to Settings › Account › Delete account, or email [email protected] from the address on your account.
• If you're the last owner, deleting your account closes your store. Withdraw your balance first and finish any open orders, refunds or cases.
• Shoppers: email [email protected] with the phone number you use on Duka.

We delete or anonymise your data, apart from the order, payment and tax records the law requires us and the shops to keep.

Duka isn't meant for children. You must be 18 or older to open a store or join a store's team. We don't knowingly collect data from children; if you think a child has given us personal data, write to [email protected] and we'll remove it.

When we change this policy we'll update this page and its date. If a change matters, we'll tell sellers by email or in the app before it takes effect.

Duka, Nairobi, Kenya. Email [email protected]. See also our terms of service and support page.