Data Protection Policy

Nduky Express Data Protection Policy

Effective Date: 1st August 2025

1. Introduction

Nduky Express ("Nduky," "we," "our," or "us") is committed to protecting the privacy and personal data of our clients, riders, employees, and partners. This Data Protection Policy outlines our practices concerning the collection, use, storage, and disclosure of personal data in compliance with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 of Kenya.

2. Scope

This policy applies to all personal data processed by Nduky in relation to our services, including data collected through our mobile applications, websites, customer support channels, and other interactions with clients and riders.

3. Definitions

• Personal Data: Information relating to an identified or identifiable natural person.
• Data Subject: An individual whose personal data is processed.
• Data Controller: A person or entity that determines the purpose and means of processing personal data.
• Data Processor: A person or entity that processes personal data on behalf of the data controller.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

4. Data Collection

We collect personal data necessary for providing our services, including:

• Clients: Name, contact information, delivery addresses, payment details, and order history.
• Riders: Name, contact information, identification documents, vehicle details, and location data.
• Employees and Partners: Personal and professional information as required for employment or partnership agreements.

Data is collected directly from data subjects or through authorized third parties, ensuring transparency and consent where required.

5. Purpose of Data Processing

Nduky processes personal data for the following purposes:

• Facilitating delivery services between clients and riders.
• Managing user accounts and providing customer support.
• Processing payments and preventing fraudulent activities.
• Complying with legal obligations and regulatory requirements.
• Improving our services and conducting market research.

6. Legal Basis for Processing

Our processing of personal data is based on:

• Consent: Obtained from data subjects for specific purposes.
• Contractual Necessity: Processing required to fulfill our contractual obligations.
• Legal Obligation: Compliance with applicable laws and regulations.
• Legitimate Interests: Processing necessary for our legitimate business interests, balanced against data subjects' rights and freedoms.

7. Data Subject Rights

Under the Data Protection Act, data subjects have the following rights:

• Right to Access: Obtain confirmation and access to their personal data.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of personal data under certain conditions.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Data Portability: Receive personal data in a structured, commonly used format.
• Right to Restrict Processing: Request limitation of data processing under certain circumstances.

Requests to exercise these rights can be made by contacting us at info@nduky.com

8. Data Sharing and Disclosure

We may share personal data with:

• Riders: To facilitate delivery services.
• Service Providers: For payment processing, IT services, and customer support.
• Regulatory Authorities: To comply with legal obligations.
• Business Partners: With consent, for joint marketing or promotional activities.

All third parties are required to adhere to data protection standards consistent with this policy.

9. Data Security

Nduky implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or destruction. These measures include encryption, access controls, regular security assessments, and staff training.

10. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes outlined in this policy or as required by law. Upon expiry of the retention period, data is securely deleted or anonymized.

11. International Data Transfers

If personal data is transferred outside Kenya, we ensure that appropriate safeguards are in place, such as:

• Transfers to countries with adequate data protection laws.
• Use of standard contractual clauses approved by the Data Commissioner.
• Obtaining explicit consent from data subjects.

12. Data Breach Notification

In the event of a data breach that poses a risk to data subjects, Nduky will notify the Office of the Data Protection Commissioner within 72 hours and affected individuals without undue delay, as required by law.

13. Changes to This Policy

We may update this Data Protection Policy from time to time to reflect changes in our practices or legal requirements. We will notify data subjects of significant changes through our platform or other appropriate means.

14. Contact Information

For questions or concerns regarding this policy or our data protection practices, please contact:

Data Protection Officer
Nduky Express
E: info@nduky.com
T: 0712 226227

---

By using Nduky's services, you acknowledge that you have read and understood this Data Protection Policy and agree to the collection and use of your personal data as described herein.