PRIVACY NOTICE
1. PRIVACY NOTICE
GoBEBA (“we,” “our,” or “us”) is committed to protecting and respecting the privacy of our community members. We recognize the trust our customers, clients, partners, and other stakeholders place in us, and we understand the importance of safeguarding their personal information.
The protection of personal data and the use of such information solely for purposes related to our services is a top priority for GoBEBA. We are dedicated to ensuring that any personal information entrusted to us is handled with the utmost care and in compliance with applicable privacy laws.
This Privacy Notice outlines how we collect, process, and use personal information, and provides information on your rights with respect to accessing, correcting, and controlling your data. We are committed to maintaining transparency, accountability, and the highest standards of privacy protection in all our operations.
This notice applies to all personal information collected by GoBEBA and serves to ensure that your data is treated responsibly and securely.
2. DEFINITIONS
“Biodata” means Biographical information i.e., Personal information regarding gender, nationality, contact information, physical location, and any other.
“Data Controller” means the natural or legal person, authority, organization, or other agency that makes decisions individually or together with other parties regarding the purposes and means for processing Personal Data.
“Data Protection Act” means the Data Protection Act 2019 under the laws of Kenya as amended
“Personal Data” means any information identifying you or information relating to you that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Personal Data excludes anonymous data or data that has had the identity of you as an individual permanently removed.
“Data Processor” means a natural or legal person, authority, organization, or other agency that processes Personal Data on behalf of the Data Controller.
“Responsible Person” means Data Protection Officer
3. PURPOSE
We established this Privacy Notice for the purposes of compliance with the applicable data protection laws in Kenya.
This Privacy Notice sets our standards towards the access and use of any personal data, or any other information provided from you or any other sources to us.
Please also read Terms and Conditions (“Terms”), which describe the terms under which you access and use our Services.
4. WHAT INFORMATION WE COLLECT ABOUT YOU
To effectively operate, provide, improve, and personalize our services, GoBEBA may collect certain personal information when you apply for, access, or use our services. The types of information we collect depend on how you interact with us.
We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped as follows:
a) We collect identification data, which includes your name, phone number, location, and any additional delivery notes that help us ensure accurate and timely deliveries. This also includes your email address if provided, for communication purposes.
b) We collect contact data, which includes your delivery address, billing address, phone numbers, and email address. This is necessary for communication, service delivery, and order management.
c) We may collect financial information necessary for processing payments for our services, including payment details through methods like bank transfers or M-Pesa.
d) We collect transaction data, which includes records of payments made to and from you, along with the details of the orders you place with GoBEBA, including water and cooking gas deliveries.
e) We collect usage data, which includes information on how you interact with our platform, including order history, delivery preferences, and any feedback you provide. This helps us improve our services and personalize the experience.
f) We retain communication data, which includes any inquiries, messages, or complaints you send to our customer support team. This allows us to provide efficient support and address any questions or issues you may have.
g) For our riders, we collect identification data (name, phone number, ID number), as well as location data, driving license information, and insurance details to ensure safe and efficient deliveries.
h) We collect vendor data, which includes vendor name, phone number, pricing details, EPRA certification, County Government licenses, location, and payment information (bank or M-Pesa details) for processing transactions related to service deliveries.
5. WHEN THE DATA IS COLLECTED
We collect and process data about you from the following sources:
1. Information You Provide Us:
This includes information about you that you provide by filling out application forms or by corresponding with us through phone, email, or other methods. We use various methods to collect data from and about you, including through direct interactions. This includes the personal data you provide when you:
- Make orders from our website, register to be a third party vendor or sign up to be a rider.
- Request information about our services or events.
- Participate in surveys, promotions, or competitions.
- Provide feedback or contact us with inquiries.
2. Information We Receive from Other Sources:
- We may receive your personal data from third-party sources, such as service provider or other trusted partners with whom we have interactions. These sources may include but are not limited to, companies’ registries, public records, or any third parties where you have given consent for your data to be shared with us.
6. HOW WE WILL USE YOUR INFORMATION
We will only use your personal data where we have your consent or a legal basis to process it. We will use your personal data in the following circumstances:
a) To Fulfill the Contractual Agreement – We may process your personal data to fulfill the terms of a contractual agreement we are about to enter into or have already entered into with you.
b) For Legitimate Interests – We may process your personal data for purposes of our legitimate interests (or those of a third party), where your interests and fundamental rights do not override those interests. Legitimate interests refer to our interest in running and managing our operations to provide the best service and safest experience possible. In such cases, we make sure to evaluate and balance any potential impact on you (both positive and negative) and your rights.
c) To Comply with Legal Obligations – We may process your personal data to comply with any legal obligations we are required to fulfill.
We may process your personal data for multiple lawful purposes, depending on the specific reason for processing. The following outlines the ways in which we use and process your personal data:
a) To Deliver and Manage Our Services: We use your personal data to fulfill and personalize the services we provide, such as water and cooking gas deliveries, rider registration, and third-party vendor registration.
b) To Manage Risk, Security, and Crime Prevention: We use your data to detect, prevent, investigate, and report fraudulent activities. We implement security measures to verify your identity and ensure compliance with relevant laws and regulations.
c) To Administer and Protect Our Operations: We use your data to ensure business continuity, manage complaints, and resolve any queries related to our services.
d) To Analyze How You Use Our Services: We process your data to study how customers, riders, and vendors interact with our services, communicate about our offerings, and test new delivery methods or initiatives to improve our services.
e) To Gather Feedback: We use surveys or feedback mechanisms to assess customer satisfaction and identify areas for improvement in our offerings.
f) To Facilitate Payment Processing: We use your personal data to facilitate payment instructions and manage account information for payments, including working with third-party providers to process payments securely.
7. TO WHOM WE MAY DISCLOSE YOUR INFORMATION
We may disclose your personal data to other entities within GoBEBA or its affiliates for legitimate business purposes (including providing services to you), in accordance with applicable law. Additionally, we may disclose your personal data to:
(a) Government Authorities and Regulators: Including law enforcement agencies or regulatory bodies when required by law.
(b) Financial Institutions: Through which your transactions are processed, such as payment service providers or banks.
(c) Other Companies and Partners: Including any third parties, such as vendors, suppliers, or partners that assist us in providing services to you (e.g., GoBEBA delivery partners, third-party vendors, or contractors).
(d) In the Event of a Merger or Acquisition: If GoBEBA undergoes a merger, acquisition, or any other business transition, your personal data may be transferred to the new owners, and they may use it in the same way as outlined in this Privacy Notice.
(e) Third-Party Service Providers and Professional Advisers: Including data processors, legal advisers, accountants, auditors, insurance providers, and other professionals who help us operate our business and deliver services.
All third parties with whom we share your personal data are required to protect the security of your data and handle it lawfully. We do not allow our third-party service providers to use your personal data for their own purposes. Instead, they are permitted to process your data only for specific purposes and according to our instructions.
Marketing
We strive ensure your consent regarding certain personal data uses, specifically in so far as marketing and advertising. We have established the following personal data control mechanisms:
a) We may use your identity, contact, technical, usage, and transaction data to assess what may be of interest or relevance to you, such as information regarding upcoming promotions, new services, or special offers related to water and cooking gas delivery. This information helps us determine which services, promotions, or initiatives to promote to you.
You will only receive marketing communications from us if you have expressly consented to receiving such information, based on your interaction with GoBEBA services or your preferences.
Opting Out
(a) You can ask us or third parties to stop sending you marketing messages at any time by writing to us or logging into the relevant website and checking or unchecking relevant boxes to adjust your marketing preferences or by following the opt-out links on any marketing message sent to you or by contacting us at any time through the contacts provided.
(b) Where you opt-out of receiving these marketing messages, this will not apply to Personal Data provided to us because of product or service subscribed to, warranty registration, product or service experience or other transactions.
8. DATA RETENTION POLICY
GoBEBA is committed to retaining personal data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, regulatory, tax, accounting, or reporting obligations. In the event of a complaint or if we reasonably believe there is potential for litigation arising from our engagement with you, we may retain your personal data for an extended period.
To determine the appropriate retention period for personal data, GoBEBA considers the following factors: the volume, nature, and sensitivity of the data; the potential risks associated with unauthorized use or disclosure; the purposes for which the data was collected; and whether those purposes can be achieved through other means. We also consider any relevant legal, regulatory, tax, accounting, or other applicable requirements.
As required by law, GoBEBA may need to retain certain basic information about our customers, riders, third-party vendors, and stakeholders (including identity, contact, financial, and transaction data) for a minimum period following the cessation of our relationship. This retention period is typically aligned with regulatory or legal requirements. Our internal policies, which may be updated periodically, could also require the retention of such data for a longer duration.
In certain cases, we may anonymize or deidentify personal data so that it can no longer be linked to any individual. This de-identified data may be used for research or statistical purposes indefinitely, without further notification.
9. AUTOMATED DECISION MAKING
At GoBEBA, we handle all decisions related to service applications, rider registrations, and third-party vendor partnerships through a manual review process. We do not rely on automated decision-making systems. Each application is carefully assessed by our team to determine eligibility for service offerings, delivery arrangements, or vendor collaborations.
As part of our review process, we may conduct background checks, including verifying financial information, assessing the qualifications of riders or vendors, and ensuring compliance with legal or regulatory requirements. If any issues are identified during the review, we may take the following actions:
a) Non-Approval of Application: We may decide not to offer a service or may not approve the application to become a rider or vendor.
b) Retention of Information: Any relevant information may be retained for future reference, including for evaluating service requests or assisting in decision-making for future service engagements.
10. DATA INVOLVING CHILDREN
At GoBEBA, we prioritize the privacy and security of your personal data. We collect only the necessary information for service delivery, including contact details, payment information, and qualifications.
We do not collect or process data from individuals under the age of 18. Personal data is used solely for service provision, payment processing, and vendor or rider assessments.
We do not share your data with third parties, except where required by law or for service-related purposes. All data is securely stored and accessible only by authorized personnel.
11. CHANGE OF PURPOSE
We will only use your Personal Data and special category data for the purposes for which we collected it as indicated in this Privacy Notice or for reasons we give you during the collection of the data.
If we need to use your Personal Data for an unrelated purpose, we will notify you and seek your consent where necessary.
Please note that we may process your Personal Data without your knowledge or consent if this is required or permitted by law.
12. TRANSFER OF YOUR PERSONAL DATA
We may need to transfer or store your information in another jurisdiction to fulfill a legal obligation, for our legitimate interest and to protect public interest.
If the other jurisdiction does not have the same level of protection for Personal Data, when we do process the data, we shall put in place appropriate safeguards e.g., contractual commitments to ensure the data is adequately protected.
We ensure your Personal Data is protected by requiring all our related companies to follow the same rules when processing your Personal Data.
Where third parties are based in other jurisdictions, their processing of your Personal Data will involve a transfer of data to their jurisdictions.
13. HOW TO EXERCISE YOUR RIGHTS
Subject to legal and contractual limitations as well as legitimate interests, you have rights under applicable laws in relation to your Personal Data. These are listed below:
(a) right to access Personal Data that we hold about you.
(b) right to request that we correct your Personal Data where it is inaccurate or incomplete.
(c) right to request that we erase your Personal Data noting that we may continue to retain your information if obligated or entitled to do so.
(d) right to object and withdraw your consent to the processing of your Personal Data.
(e) right to request restricted processing of your Personal Data noting that we may be entitled to continue processing your data and refuse your request; and
(f) right to request transfer of your personal data in a format we shall determine from time to time.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within a reasonable time. Occasionally it could take us longer if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.
14. HOW WE SECURE YOUR DATA
We have put in place appropriate security measures to prevent your Personal Data from being lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
The collection of your personal data shall be adequate, relevant and limited to the strict minimum. Before processing personal data, we will determine whether and to what extent the processing of personal data is necessary to achieve the purpose for which it is performed.
15. DATA PROTECTION OFFICER
If you have any questions or concerns regarding this Privacy Notice or your rights related to protection of your personal information may be sent via email at vipi@gobeba.com. or at the following number 0710-440403
To ensure effective and legal handling of our customers’ Information we have appointed a Data Protection Officer. You can reach our Data Protection Officer by sending an email at vipi@gobeba.com.
16. CHANGES TO THIS PRIVACY NOTICE
We reserve the right to modify or update this Privacy Notice at any time. Any changes will be posted on the GoBEBA website. We will notify you of any changes via email, using the address you’ve provided, at least two months in advance.
If we do not hear from you, your continued use of our services will be considered as acceptance of the updated Privacy Notice.