Privacy Policy
GDPR & Kenya DPALast updated: 1 April 2026
Droppy Technologies Ltd is committed to protecting your personal data. This policy explains what information we collect, how we use it, and your rights under the Kenya Data Protection Act 2019 and applicable international standards.
1. Who We Are
Droppy Technologies Ltd is a company registered in Kenya, with its registered office at Westlands, Nairobi. We operate the Droppy mobile application, web platform, and related services (collectively, the Platform).
2. Information We Collect
We collect information you provide directly (name, phone number, email, delivery addresses, payment details), information generated by your use of the Platform (location data, order history, device identifiers, app usage logs), and information from third parties (M-Pesa transaction confirmations, Google Maps geocoding, background check providers for drivers).
3. How We Use Your Information
We use your data to: match delivery requests with available drivers; process payments via M-Pesa and card processors; provide live GPS tracking; send order status notifications via SMS and push; prevent fraud and verify driver identities; improve our AI matching engine; comply with legal obligations; and communicate service updates or promotional offers (with your consent).
4. Legal Bases for Processing
We process your data on the following legal bases: contractual necessity (to provide the services you request); legitimate interests (fraud prevention, safety, platform improvement); consent (marketing communications, optional analytics cookies); and legal obligation (tax records, regulatory compliance).
5. Location Data
Real-time location is collected from drivers continuously while they are online and from customers during active delivery tracking. Location data is used solely for route optimisation, ETA calculation, and fraud detection. You may withdraw consent to background location at any time in your device settings, though this will limit certain features.
6. Sharing Your Data
We share your data with: the driver assigned to your delivery (name, phone, and pickup/drop-off location only); payment processors (M-Pesa / Safaricom, Stripe); cloud infrastructure providers (AWS, based in EU/US with Standard Contractual Clauses); identity verification providers; and law enforcement when legally required. We do not sell personal data to third parties.
7. Data Retention
Account data is retained for the lifetime of your account plus 7 years for tax and legal purposes. Deleted accounts are anonymised within 30 days. Location history is retained for 90 days. Driver background check documents are retained for 5 years after the driver leaves the platform.
8. Your Rights
Under the Kenya Data Protection Act 2019, you have the right to: access a copy of your personal data; correct inaccurate data; request erasure where no legal basis remains; object to processing for direct marketing; receive your data in a portable format; and lodge a complaint with the Office of the Data Protection Commissioner (ODPC). To exercise any right, email privacy@droppy.co.ke.
9. Security
We use TLS 1.3 encryption in transit, AES-256 encryption at rest, multi-factor authentication for internal systems, and regular penetration testing. In the event of a data breach affecting your rights, we will notify you and the ODPC within 72 hours of discovery.
10. Children
The Platform is not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact privacy@droppy.co.ke and we will delete the account promptly.
11. Changes to This Policy
We will notify you of material changes to this policy via in-app notification and email at least 14 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance.
ยฉ 2026 Droppy Technologies Ltd ยท Registered in Kenya
Questions about this policy? Contact us