Chekit Privacy Policy

Last updated: 28 August 2026

This policy explains how Chekit Commerce Technologies Ltd (Company No. PVT-PQ1ARKA8, The Piano, 171 Brookside Drive, Westlands, Nairobi; P.O. Box 452-01000, Thika; admin@chekit.co.ke; +254 727 499 710) handles personal data across all Chekit surfaces: our websites, the customer, merchant, and rider mobile apps, and our marketing site ("Platform"). We process personal data as a data controller under the Data Protection Act, 2019 in line with the requirements of the Office of the Data Protection Commissioner (ODPC).

1. What we collect

Everyone: name, phone number, email, account credentials (passwords are stored hashed), and support and dispute correspondence. When you sign in to one of our apps we also record the app version, the platform (Android or iOS), and a push notification token issued by Google Firebase, so we can send you order and delivery updates.

Customers: delivery addresses and their map coordinates, your device location at the point of checkout if you choose to use it to set a delivery pin, order history, payment references (M-Pesa transaction references and wallet movements, and we do not receive or store your M-Pesa PIN), a profile photo if you upload one, reviews, and waitlist signups.

Merchants and their staff: business identity and KYC information (registration documents, KRA PIN, permits, ID documents of owners and signatories), branch locations as map pins, your device location if you choose to use it to set a branch pin, product listings and product photographs, order and settlement records, and bank or M-Pesa payout details.

Riders: identity and vetting information (ID, driving licence details), vehicle type, your precise device location, collected continuously while you are online for work, including when the app is in the background or the screen is off, proof-of-delivery photographs you take with the camera, delivery and earnings history, and payout details.

2. Device permissions the apps ask for, and what we do with them

Each permission is requested in the app, you can decline it, and you can withdraw it later in your phone settings. Declining a permission only disables the feature that needs it.

Location. All three apps can ask for precise location.

• In the customer app, location is used only while the app is open, and only to place your delivery pin at checkout. You can type an address instead.
• In the merchant app, location is used only while the app is open, and only to place a branch or pickup pin. You can drag the pin on the map instead.
• In the rider app, location is collected in the background. While you are online for work, Chekit collects your location continuously, including when the app is closed or not in use, so that we can offer you nearby deliveries, guide you to the pickup and the customer, show the customer and the merchant that the order is on its way, and support you if something goes wrong. We do not collect your location when you are offline. Going offline in the app stops collection.

We do not use location data for advertising, and we do not sell it.

Camera and photos. The rider app uses the camera to take the proof-of-delivery photograph that is attached to the order. The merchant app uses the camera and photo library for KYC documents and product images. The customer app uses the photo library only if you choose to set a profile photo. We access only the images you select or capture.

Notifications. With your permission we send order, delivery, and payment notifications through Google Firebase Cloud Messaging.

SMS verification code. Our apps use Google's SMS Retriever service to fill in the one-time verification code we send you. This gives the app the text of that single Chekit message only. It does not give us access to any other SMS on your phone, and we do not read your messages.

Rider app, additional permissions. The rider app runs a foreground service with a persistent notification while you are online, so that location and new-offer alerts keep working reliably. It may also ask to display over other apps, so an incoming delivery offer can reach you while you are using another app, and to be excluded from battery optimisation, so Android does not stop the service mid-delivery. These permissions handle alerts and reliability. They do not collect any additional personal data.

3. Why we process it (and the lawful basis)

We do not sell personal data. We do not use automated decisions producing legal effects without human review.

4. Sharing

We share only what each party needs. Merchants see the order details needed to fulfil it. Riders see pickup and drop-off details, and the first name and phone number needed for the delivery. Safaricom (M-Pesa) processes payments. Our service providers host and support the Platform (see §5). Regulators and law enforcement receive data where the law requires it, and professional advisers receive it under confidentiality.

Live delivery location. While a delivery is in progress, the rider's location is shown to the customer and the merchant for that order, so they can see the order is on its way. It is shown for the duration of the delivery only. Riders are not shown to anyone when they are offline, and customers are never shown a rider's location outside their own order.

Maps. When a map or a route is displayed, the coordinates involved are sent to Google Maps Platform to draw it.

5. International transfers

Our infrastructure providers (including Amazon Web Services and Google, for Firebase notifications and Maps) may store or process data outside Kenya. We transfer on the basis of contractual safeguards with those providers and, where applicable, your consent, in line with sections 48 and 49 of the Data Protection Act.

6. Cookies

Our shopping website uses two functional cookies only: an authentication cookie (keeps you signed in; 30 days) and a delivery-location cookie (remembers your chosen delivery area; 30 days). We currently use no advertising or analytics cookies. If that changes, this policy will be updated and consent obtained where required. Our marketing site sets no cookies.

7. Retention

We keep account data while your account is active; order, payment, settlement, and tax records for at least 7 years (statutory record-keeping); KYC records for the period required by applicable law; rider location traces only as long as needed for dispatch, safety, dispute resolution, and fraud prevention, up to 12 months; proof-of-delivery photographs with the order record they belong to; dispute records for 7 years. Data no longer needed is deleted or anonymised.

8. Your rights

Under the Data Protection Act you may: access your data; request correction or deletion; object to or restrict processing; withdraw consent (where consent is the basis); and request a copy in a portable format. Exercise these in-app, or through our account and data deletion page, or via admin@chekit.co.ke. We respond within the statutory timelines. You may also complain to the ODPC (www.odpc.go.ke).

9. Security

Access controls, encrypted transport, hashed credentials, segregated payment records, and audit logs protect your data. If a breach is likely to risk your rights, we will notify the ODPC within 72 hours of becoming aware and inform affected users without undue delay.

10. Children

The Platform is for persons aged 18+. We do not knowingly process children's data.

11. Changes and contact

We will post updates here with a new version and effective date, and notify you of material changes. Questions or requests: admin@chekit.co.ke · +254 727 499 710.