Skip to content
FundiSasa← Back to app

Privacy Policy

Last updated: [DATE] · Operator: [COMPANY NAME] Ltd, [ADDRESS], Nairobi, Kenya · Data controller contact: [EMAIL]

This policy explains how [COMPANY NAME] Ltd ("FundiSasa", "we") collects and uses your personal data when you use the FundiSasa platform. It is written for compliance with the Kenya Data Protection Act, 2019 (the "DPA") and, where applicable, the EU General Data Protection Regulation (GDPR). The English version is the binding version.

1. Who we are

FundiSasa is a marketplace that connects customers with local service providers ("fundis") in Kenya. We are the data controller for account data and platform operations. For payment processing, our payment provider acts as an independent controller of your M-Pesa transaction data.

2. Data we collect and why

  • Account data — phone number, name, role (customer/fundi). Purpose: creating and securing your account, phone verification via OTP. Legal basis: contract performance.
  • Identity verification data (fundis) — ID type, ID number, photo of your ID document. Purpose: the "Verified" badge and fraud prevention. Legal basis: legitimate interest / legal obligation (KYC). Access is restricted to review staff.
  • Job content — job title, description, photos, area, exact address, time window, quotes, chat messages. Purpose: matching, quoting and completing work. Your exact address and phone number are only shared with the fundi after payment is secured.
  • Payment data — M-Pesa number, amount, receipt references. We never see or store your M-Pesa PIN.
  • Communication data — in-app chat (contact details are automatically redacted until a job is paid for), notifications, SMS delivery logs.
  • Technical data — essential cookies and local storage for sign-in session, language preference and your cookie consent choice (see the Cookie Policy). Analytics only runs if you consent.

3. What we do NOT collect

We do not collect precise geolocation, contacts, photos without your action, biometric identifiers, or any data from children. FundiSasa is restricted to users aged 18 and above.

4. Third parties we share data with

  • M-Pesa / Safaricom Daraja ([PAYMENT_PROVIDER details]) — phone number and payment amount, to process payments and payouts.
  • SMS gateway ([SMS_PROVIDER, e.g. Africa's Talking]) — phone number and message content, to deliver OTPs and service alerts.
  • Analytics provider (only with consent; currently none configured) — anonymized usage data.
  • Cloud hosting ([HOSTING_PROVIDER]) — encrypted database and backups.
  • Authorities — where the law requires (e.g. valid court order).

We never sell your personal data.

5. Retention

  • Account and job data: for the life of your account.
  • Payment and payout records: 7 years, as required by Kenyan tax and accounting law — kept in anonymized form after account deletion.
  • ID verification documents: deleted within 90 days of a decision, unless retention is legally required.
  • OTP codes: deleted immediately after use or expiry (max 10 minutes).
  • Chat messages: deleted when you delete your account.

6. Your rights

Under the DPA you have the right to: access your data; correct inaccurate data; erasure ("be forgotten"); object to or restrict processing; withdraw consent at any time (without affecting earlier lawful processing); and lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

How to exercise them in the product: "Privacy & data" in the footer or account menu lets you opt out of marketing and delete your account (with confirmation). For access, correction or portability requests, email [EMAIL] — we respond within 30 days. You can also change cookie choices anytime via "Cookie settings".

7. Security

Sessions use signed, HTTP-only cookies; passwords do not exist (OTP-only login); ID documents are access-restricted; contact details in chat are redacted until a job is funded. No system is perfectly secure — we notify the ODPC and affected users of breaches as the DPA requires.

8. International transfers

Our hosting is [HOSTING_LOCATION]. Where data is processed outside Kenya, we rely on appropriate safeguards (e.g. adequacy or contractual clauses) as required by the DPA.

9. Contact

Data Protection Officer: [DPO_NAME] · [EMAIL] · [PHONE] · [COMPANY NAME] Ltd, [ADDRESS], Nairobi, Kenya. Supervisory authority: Office of the Data Protection Commissioner, Kenya — [ODPC CONTACT].