Privacy & Data Protection Policy

Effective Date: January 1, 2026

This Privacy Policy explains how Mswahili Technologies (“we”, “our”, or “us”) collects, uses, stores, protects, and discloses personal information across our platforms and services, including Bantu Soko, Bantu Dereva, Kadi, and related digital infrastructure (collectively referred to as the “Services”).

By accessing or using our Services, websites, mobile applications, APIs, or related systems, you acknowledge and agree to the practices described in this policy.

1. Information We Collect

We collect information necessary to operate, maintain, secure, and improve our Services. The categories of information collected may vary depending on how users interact with our platforms.

2. How We Use Information

Information collected through our Services is processed for legitimate operational, contractual, security, analytical, and legal purposes.

• To create, authenticate, and manage user accounts
• To provide and operate marketplace, mobility, logistics, ticketing, and digital platform services
• To process transactions, subscriptions, payments, settlements, and refunds
• To facilitate communication between users, drivers, merchants, couriers, sellers, and support teams
• To improve system reliability, platform performance, analytics, and product development
• To prevent fraud, abuse, unauthorized access, policy violations, and illegal activities
• To comply with legal, regulatory, and contractual obligations

3. Legal Basis For Processing

Where applicable under data protection laws, we process personal information based on one or more of the following legal grounds:

• User consent
• Performance of contractual obligations
• Compliance with legal and regulatory requirements
• Legitimate business interests, including operational security, fraud prevention, and service improvement

4. Sharing & Disclosure Of Information

We do not sell personal information. Information may only be shared where necessary for operational, contractual, security, or legal purposes.

• With drivers, couriers, merchants, sellers, event organizers, or service providers to fulfill user requests
• With payment processors, cloud infrastructure providers, communication services, analytics providers, and other technology partners supporting platform operations
• With regulators, law enforcement agencies, courts, or government authorities where required by law
• During investigations related to fraud, abuse, security threats, unauthorized activity, or violations of platform policies

5. Data Security

We implement administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, misuse, disclosure, loss, or destruction.

Security measures may include encryption, authentication systems, access controls, internal monitoring, operational audits, infrastructure protections, and verification mechanisms such as one-time passwords (OTP).

While we continuously work to maintain secure systems, no platform, infrastructure, or method of electronic transmission can be guaranteed to be completely secure.

6. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill operational purposes, comply with legal obligations, resolve disputes, enforce agreements, maintain security records, and support legitimate business operations.

7. International Data Transfers

Information collected through our Services may be processed, transferred, or stored in jurisdictions outside your country of residence. Where such transfers occur, we take reasonable measures to ensure appropriate safeguards are implemented in accordance with applicable data protection laws.

8. Third-Party Services

Our Services may integrate with third-party providers, including payment gateways, cloud infrastructure providers, analytics services, communication systems, mapping services, and authentication providers.

These third-party services operate under their own policies and terms. We are not responsible for the privacy, security, or operational practices of external providers.

9. User Rights

Subject to applicable laws, users may have rights relating to their personal information.

• Request access to personal information
• Request correction of inaccurate or incomplete information
• Request deletion of personal information where legally permitted
• Object to or restrict certain processing activities
• Withdraw consent where consent is the legal basis for processing

10. Policy Updates

We may update this Privacy Policy from time to time to reflect operational, legal, regulatory, or technical changes. Updated versions will be published on this page with a revised effective date. Continued use of the Services after such updates constitutes acceptance of the revised policy.