Privacy policy

01 · What this policy covers

This policy explains what Zawadi collects from merchants and their customers, what we do with it, and how we keep it safe. It covers the Zawadi website, the merchant dashboard and apps, and the Zawadi Rewards customer app.

The customer records a business collects in Zawadi belong to that business. We process them on the business's behalf, as our terms of service describe, under the Kenya Data Protection Act, 2019.

02 · What we collect

• Merchant accounts: the owner's name, email, phone number, business name and location, and M-Pesa payment records for the plan.
• Customer records: names, phone numbers, visits, points and stamps, rewards claimed, credit balances where a shop uses Duka Credit, and the SMS messages sent on a merchant's behalf.
• Staff activity: which staff member recorded each visit, award or redemption, and when.
• Technical data: IP addresses, browser and device details, and app crash reports, used to keep accounts secure.

03 · How we use your data

We use data to run the service and for nothing else. We do not sell it, and we do not use customer phone numbers for our own marketing. In practice that means:

• Recording visits, points, stamps, rewards and credit for each shop.
• Sending the SMS messages a merchant sets up: points updates, reminders, offers and win-back messages.
• Showing merchants who is coming back and who has gone quiet.
• Billing merchants for their plan and SMS credits by M-Pesa.
• Keeping accounts secure and spotting misuse.

A customer can ask a shop to stop sending them offers at any time, and our terms require every merchant to honour that. Points updates still go out while they are members.

04 · Keeping data safe

Data travels over HTTPS between your devices and our servers. Access inside Zawadi is limited to the staff who need it to run the service, and every merchant account is protected by a password and per-staff PINs. We send SMS through Kenyan gateway providers, who receive only the phone number and the message.

05 · Your rights and how long we keep data

We keep a merchant's data for as long as their account is open. A merchant can export their customer list from the dashboard at any time, and can ask us for a full export before closing the account. After that, the account's data is deleted.

A customer who wants to see, correct or delete what a shop holds about them can ask the shop, or email us and we will pass the request on and help the shop answer it.