PRIVACY POLICY

Scope

This Policy applies to the PickSpot mobile applications, PickSend merchant services, PickSpot and PickSend websites, customer support services, and related products and services operated by PickSpot Network Limited.

Information we collect

• Account information — name, phone number, email address, date of birth, profile information, and government-issued identification where required.
• Delivery information — delivery addresses, saved addresses, delivery instructions, delivery and order history, and tracking information.
• Merchant interaction information — merchant identifiers, order and product information, transaction records, and communications.
• Payment information — payment confirmations, transaction references, payment status, settlement records, and refund records. Payment processing is provided by licensed third-party payment providers. PickSpot does not store full payment card information.
• Device and usage information — device identifiers, operating system and application version, device type, IP address, diagnostic information, features used, activity logs, and order and delivery activity.
• Verification information — identity documents, selfies, verification results, and compliance records, where verification is required.
• Images — product photographs, rejection photographs, verification photographs, and support-related images submitted through the platform.

How we use information and our lawful bases

We use information to create and manage accounts, operate PickSpot handles, process order requests, facilitate deliveries and payments through third-party providers, process refunds, verify identities, prevent fraud and detect abuse, monitor and improve services, provide support, communicate with users, and meet legal and regulatory obligations.

Under the Data Protection Act, 2019, we rely on the following lawful bases:

• Performance of a contract — to operate handles, process orders, facilitate delivery and payment through third-party providers, and provide settlement and refunds.
• Compliance with a legal obligation — for identity verification, record-keeping, tax, and regulatory requirements.
• Legitimate interests — for fraud prevention, risk management, security, and service improvement, balanced against your rights and interests.
• Consent — where we ask for it, such as for certain communications; you may withdraw consent at any time without affecting prior processing.

Delivery identity and address information

Fraud prevention and risk management

We may use information collected through the platform to detect fraud, prevent abuse, investigate suspicious activity, assess customer and merchant risk, review failed deliveries and refund activity, and enforce platform policies. Automated systems and human reviewers may be used in these processes.

Information sharing

We may share information with:

• Independent delivery service providers — delivery addresses, recipient information, instructions, and order identifiers necessary to complete deliveries. Delivery addresses are shared only with delivery service providers and not with merchants.
• Merchants — customer handle, name, and order details necessary to prepare the order. Merchants do not receive customer delivery addresses.
• Licensed payment providers — information necessary to process payments, refunds, settlements, and related transactions.
• Verification providers — information required for identity verification, fraud prevention, or compliance reviews.
• Service providers — technology, infrastructure, analytics, communications, security, and support providers under appropriate confidentiality and data-protection obligations.
• Legal and regulatory authorities — where required by law, legal process, court order, or regulatory request, or to protect rights, safety, or property.

Merchant information sharing

When receiving an order request, customers may be shown merchant information including store name, social profiles, product photographs, and merchant trust and performance indicators. Merchants may receive information reasonably necessary to prepare and hand over orders, but this does not include customer delivery addresses.

Data retention

We retain information for as long as reasonably necessary to operate the platform, maintain transaction records, process refunds, resolve disputes, prevent fraud, meet legal obligations, and enforce agreements. Retention periods vary depending on the type of information and applicable legal requirements.

Security

We implement reasonable technical, administrative, and organisational measures designed to protect information against unauthorised access, disclosure, loss, misuse, alteration, and destruction. No system can guarantee absolute security, and you remain responsible for protecting your account credentials and devices.

Your rights

Subject to the Data Protection Act, 2019, you have the right to be informed of how your data is used; to access your data; to request correction of inaccurate or incomplete data; to request deletion of your data; to object to or request restriction of certain processing; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner.

To exercise these rights, contact us at contact@pickspot.net. Certain requests may be limited where retention is required by law, operational necessity, fraud prevention, or contractual obligations.

Children's privacy

PickSpot is intended for individuals who are at least eighteen (18) years old. We do not knowingly collect personal data from individuals under 18. If we become aware that we have done so, we will take steps to delete it.

International transfers

Information may be processed, stored, or transferred outside Kenya where necessary to operate the service. Where such transfers occur, we will take steps consistent with the Data Protection Act, 2019 to ensure appropriate safeguards are in place. If you access PickSpot from outside Kenya, additional or different privacy terms may apply as notified by PickSpot.

Cookies and similar technologies

Our websites and applications may use cookies, local storage, analytics technologies, and similar tools to authenticate users, improve performance, measure usage, enhance security, and personalise experiences. You may control certain cookie settings through your device or browser.

Changes

PickSpot Network Limited may update this Privacy Policy from time to time. Updated versions become effective upon publication. Continued use of PickSpot after publication constitutes acceptance of the revised Policy.

Contact

Questions or requests regarding this Privacy Policy or your personal data may be directed to contact@pickspot.net or PickSpot Network Limited, Yare Towers, Yusuf Hajj Avenue, Eastleigh, Nairobi 00100, Kenya. PickSpot Network Limited is the data controller responsible for the processing described in this Policy.