E: info@nduky.com T: 0712 226 227 W: www.nduky.com
Baluchi Complex First Floor Makadara Road Opposite Central Police Station Above Tarbush Restaurant
Nduky Express Data Protection Policy
Effective Date: 1st August 2025
1. Introduction
Nduky Express ("Nduky," "we," "our," or "us") is committed to protecting the privacy and personal data of our clients, riders, employees, and partners. This Data Protection Policy outlines our practices concerning the collection, use, storage, and disclosure of personal data in compliance with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 of Kenya.
2. Scope
This policy applies to all personal data processed by Nduky in relation to our services, including data collected through our mobile applications, websites, customer support channels, and other interactions with clients and riders.
3. Definitions
- Personal Data: Information relating to an identified or identifiable natural person.
- Data Subject: An individual whose personal data is processed.
- Data Controller: A person or entity that determines the purpose and means of processing personal data.
- Data Processor: A person or entity that processes personal data on behalf of the data controller.
- Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
4. Data Collection
We collect personal data necessary for providing our services, including:
- Clients: Name, contact information, delivery addresses, payment details, and order history.
- Riders: Name, contact information, identification documents, vehicle details, and location data.
- Employees and Partners: Personal and professional information as required for employment or partnership agreements.
Data is collected directly from data subjects or through authorized third parties, ensuring transparency and consent where required.
5. Purpose of Data Processing
Nduky processes personal data for the following purposes:
- Facilitating delivery services between clients and riders.
- Managing user accounts and providing customer support.
- Processing payments and preventing fraudulent activities.
- Complying with legal obligations and regulatory requirements.
- Improving our services and conducting market research.
6. Legal Basis for Processing
Our processing of personal data is based on:
- Consent: Obtained from data subjects for specific purposes.
- Contractual Necessity: Processing required to fulfill our contractual obligations.
- Legal Obligation: Compliance with applicable laws and regulations.
- Legitimate Interests: Processing necessary for our legitimate business interests, balanced against data subjects' rights and freedoms.
7. Data Subject Rights
Under the Data Protection Act, data subjects have the following rights:
- Right to Access: Obtain confirmation and access to their personal data.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure: Request deletion of personal data under certain conditions.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Data Portability: Receive personal data in a structured, commonly used format.
- Right to Restrict Processing: Request limitation of data processing under certain circumstances.
Requests to exercise these rights can be made by contacting us at info@nduky.com
8. Data Sharing and Disclosure
We may share personal data with:
- Riders: To facilitate delivery services.
- Service Providers: For payment processing, IT services, and customer support.
- Regulatory Authorities: To comply with legal obligations.
- Business Partners: With consent, for joint marketing or promotional activities.
All third parties are required to adhere to data protection standards consistent with this policy.
9. Data Security
Nduky implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or destruction. These measures include encryption, access controls, regular security assessments, and staff training.
10. Data Retention
Personal data is retained only for as long as necessary to fulfill the purposes outlined in this policy or as required by law. Upon expiry of the retention period, data is securely deleted or anonymized.
11. International Data Transfers
If personal data is transferred outside Kenya, we ensure that appropriate safeguards are in place, such as:
- Transfers to countries with adequate data protection laws.
- Use of standard contractual clauses approved by the Data Commissioner.
- Obtaining explicit consent from data subjects.
12. Data Breach Notification
In the event of a data breach that poses a risk to data subjects, Nduky will notify the Office of the Data Protection Commissioner within 72 hours and affected individuals without undue delay, as required by law.
13. Changes to This Policy
We may update this Data Protection Policy from time to time to reflect changes in our practices or legal requirements. We will notify data subjects of significant changes through our platform or other appropriate means.
14. Contact Information
For questions or concerns regarding this policy or our data protection practices, please contact:
Data Protection Officer
Nduky Express
E: info@nduky.com
T: 0712 226227
By using Nduky's services, you acknowledge that you have read and understood this Data Protection Policy and agree to the collection and use of your personal data as described herein.
For questions about data protection, please contact our Data Protection Officer at info@nduky.com