Privacy Policy
This explains what personal data Mtepe handles, why, and what rights you have. It follows the Data Protection Act, 2019 of Kenya.
Who is responsible. Hosea Kiptoo Kurgat, trading as Mtepe, of P.O. Box 2525-00606, Nairobi, is the data controller for seller accounts and for the running of the platform. For a buyer's order, the seller whose shop you bought from is the data controller, and Mtepe is their data processor: we hold the information on their behalf so their shop can work.
Contact: [email protected] ยท WhatsApp +254 758 769 501
What we collect
If you are a buyer: your name, your M-Pesa phone number, how and where you chose to collect your order (a Pickup Mtaani agent, a matatu or bus operator's office in your town, or the seller's shop), what you ordered and what you paid, the M-Pesa receipt number for your payment, and basic technical information such as your IP address and browser, which our servers log for security.
We do not receive or store your M-Pesa PIN, and we never see your card or bank details. You enter your PIN on your own phone, with Safaricom.
If you are a seller: your name, email address, phone number, business details, your till and store numbers, and the credentials you give us for M-Pesa and for delivery partners. Credentials are encrypted before they are stored.
Why we use it
- To take an order, request payment for it, and confirm that payment.
- To pass your name, phone number and where you collect to whoever carries your parcel.
- To let the seller pack, dispatch and follow up the order.
- To show a buyer the status of their own order.
- To keep the service secure, prevent fraud, fix faults, and meet our legal obligations.
The lawful bases we rely on are performance of a contract (taking and fulfilling your order), our legitimate interests (security and fraud prevention), and legal obligation (records we must keep).
We do not sell personal data, and we do not use it for advertising.
Who we share it with
- Safaricom (M-Pesa), to request and confirm a payment.
- Whoever carries your parcel: Pickup Mtaani, or the matatu or bus operator the seller sends it with, so it reaches you. For a shop collection, nobody else.
- The seller whose shop you ordered from.
- Our hosting and infrastructure providers, who store or carry data on our instructions: the company that hosts our server, Cloudflare (which delivers the site and routes our email), and Brevo (which sends our email).
- Authorities, where the law requires it.
Some providers may store or process data outside Kenya. Where they do, we rely on the safeguards permitted under the Data Protection Act.
How long we keep it
- Order records, including buyer name, phone and collection point: 7 years, because they are business and tax records of the seller.
- Payment confirmations and the events that led to them: 7 years.
- Server and security logs: 90 days.
- Seller account data: while the account is open, then 30 days after closure, unless the law requires longer.
Your rights
Under the Data Protection Act you may ask to see the personal data we hold about you, to correct it, to have it deleted where there is no lawful reason to keep it, to object to certain uses, and to receive a copy in a usable form.
For an order, ask the seller first, since the data is theirs. If that does not work, contact us at [email protected] and we will help. We reply within 30 days.
You may also complain to the Office of the Data Protection Commissioner (ODPC), Kenya.
Cookies
We use a small number of cookies that are necessary for the service: one that keeps a seller signed in, and one that remembers a buyer's basket. We do not use advertising or tracking cookies, and there is no third-party analytics script on shop pages.
Security
Passwords are hashed. Sellers' payment credentials are encrypted at rest. Access to the live system is limited to people who need it. Traffic is encrypted in transit. Backups are taken daily and restores are tested.
If a breach occurs that is likely to cause you harm, we will notify the ODPC and affected people as the Act requires.
Changes
If we change this policy in a way that affects you, we will say so on this page and, for sellers, in the admin.
Last updated 2026-09-27