Legal

Privacy Policy

How Mzigo.online collects, uses, shares and protects personal data, and the rights you have under the Kenya Data Protection Act, 2019.

Effective: 1 October 2026 · Last updated: 25 October 2026 · See also Terms & Conditions and Support policy

1. Who we are and scope

Mzigo.online ("Mzigo", "we", "us" or "our") operates the Mzigo.online platform and website. For the purposes of the Kenya Data Protection Act, 2019 (the "DPA"), we are the data controller in respect of the personal data described in this Privacy Policy.

This policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have. It applies to our website, the Workspace and customer dashboards, our public API, tracking pages and our support channels. It does not apply to Courier Partners or payment providers, who process personal data under their own privacy policies.

Contact for privacy matters: [email protected] (please use the subject line "Data protection"), or our contact form.

2. Personal data we collect

We collect the following categories of personal data:

  • Account and workspace data: name, phone number, email address, business name, role, login credentials (stored as hashes), team membership and workspace settings.
  • Parcel and delivery data: sender and Receiver names, phone numbers, emails, origin and destination, parcel size, description, declared value, delivery fee, tracking numbers, Locker IDs, scan events, collection codes and proof-of-collection records.
  • Payment and billing data: invoice details, billing name, billing email, address, KRA PIN, VAT rate, M-Pesa payment references and transaction records. We do not store your M-Pesa PIN or full payment credentials.
  • Communications data: messages you send through our contact form or support channels, records of notifications we send you, and your communication channel preferences.
  • Technical and usage data: IP address, device and browser information, session identifiers, pages visited, API key usage, and server logs needed to operate and secure the Service.
  • Files and brand assets: logos, favicons and hero images uploaded by Workspace administrators to our CMS.

3. How we collect personal data

  • Directly from you when you create an account, register a Parcel, pay a fee, upload files, or contact support.
  • From Workspaces when a business registers a Parcel and provides the Receiver's details.
  • From Courier Partners when they scan Parcels, record delivery attempts, or report incidents.
  • From payment providers such as Safaricom M-Pesa, when a payment is made or a callback is confirmed.
  • Automatically through cookies, session identifiers and server logs when you use the Service.

4. How we use personal data and our lawful bases

We use personal data for the following purposes and on the following lawful bases under the DPA:

  • Providing the Service (performance of a contract): registering Parcels, quoting and charging delivery fees, generating labels and tracking data, coordinating with Courier Partners, and issuing collection codes.
  • Notifications (performance of a contract or consent): sending tracking updates, delivery and collection notifications and service messages by SMS, WhatsApp or email, according to the Receiver's or Workspace's communication preferences.
  • Billing and accounting (contract and legal obligation): issuing invoices, reconciling payments, maintaining transaction records, and meeting tax obligations.
  • Support (contract or legitimate interest): responding to enquiries, investigating problems and managing claims.
  • Security and fraud prevention (legitimate interest and legal obligation): authenticating users, maintaining audit logs, detecting misuse and protecting the Service.
  • Improving the Service (legitimate interest): understanding usage trends and fixing defects using aggregated or operational data.
  • Legal compliance: complying with court orders, regulatory requests and applicable law.

Where we rely on consent, you may withdraw it at any time; this does not affect processing carried out before withdrawal. Where we rely on legitimate interests, we balance those interests against your rights and freedoms.

5. How we share personal data

We do not sell personal data. We share personal data only as needed to operate the Service:

  • Courier Partners receive the delivery information needed to collect, transport and deliver a Parcel, including Receiver name and phone number.
  • Payment providers (including Safaricom M-Pesa) process payments and payment confirmations.
  • Messaging providers (for example SMS gateways, WhatsApp Business providers and email delivery services) deliver notifications on our behalf.
  • Hosting and technology providers that host our infrastructure, databases and logs under contractual confidentiality and security obligations.
  • Professional advisers such as auditors or lawyers where necessary, under duties of confidentiality.
  • Authorities where we are required by law or where necessary to protect users, the public or our legal rights.
  • Group and successor entities in connection with a merger, acquisition or sale of assets, subject to appropriate safeguards.

Courier Partners and payment providers may act as separate data controllers in their own right; we encourage you to read their privacy policies.

6. International transfers

Our hosting, messaging and email providers may process personal data outside Kenya. Where personal data is transferred outside Kenya, we take steps required by the DPA, including relying on appropriate safeguards and contractual protections with our providers.

7. How long we keep personal data

  • Account and Workspace data: for the life of the Workspace and a reasonable period afterwards to allow data export and resolve disputes.
  • Parcel and tracking data: retained to provide tracking, resolve claims and maintain operational records.
  • Billing, invoice and transaction records: retained for the period required by Kenyan tax and company law.
  • Support and contact messages: retained while the request is open and for a reasonable period afterwards.
  • Security and audit logs: retained for a limited period appropriate for security monitoring and incident investigation.

When data is no longer needed, we delete or anonymise it. Where deletion is not immediately possible (for example in backups), we isolate the data and delete it on the next backup cycle.

8. How we protect personal data

We use technical and organisational measures appropriate to the risk, including server-side sessions, hashed passwords and PINs, CSRF protection, role-based access, audit logging, verification of payment callbacks, and minimisation of the data we collect. Access to production data is restricted to personnel who need it, under confidentiality obligations.

No method of transmission or storage is completely secure. If we become aware of a personal data breach likely to result in a risk to your rights, we will notify you and the Office of the Data Protection Commissioner as required by the DPA.

9. Your rights

Subject to the DPA and applicable exemptions, you have the right to:

  • be informed about how your personal data is used;
  • access a copy of the personal data we hold about you;
  • request correction of inaccurate or incomplete data;
  • request deletion of personal data that is no longer necessary;
  • request restriction of, or object to, certain processing;
  • receive your personal data in a structured, commonly used format, and request transfer where technically feasible;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

To exercise a right, contact [email protected] with sufficient detail for us to verify your identity. We aim to respond within the period required by the DPA. We will not charge a fee except where permitted by law. Where we cannot fulfil a request (for example because of legal retention obligations), we will explain why.

10. Cookies and similar technologies

The Service uses a small number of strictly necessary cookies and local storage items:

  • Session cookie: keeps you signed in and securely identifies your server-side session.
  • CSRF token: protects forms and API requests against cross-site request forgery.
  • PWA install state: local storage used to remember whether you dismissed the install prompt for the progressive web app.

We do not use advertising cookies. If we introduce analytics or non-essential cookies in the future, we will provide a consent mechanism where required and update this policy.

11. Marketing communications

We send service and transactional messages (for example tracking updates and invoice notices) as part of the Service. Where we send marketing or product updates, you can opt out using the unsubscribe mechanism we provide, from the communication preferences in your Account, or by contacting support. Opting out of marketing does not stop essential service messages.

12. Children

The Service is intended for use by persons aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us and we will delete it.

13. Automated decision-making and profiling

We do not make automated decisions that produce legal or similarly significant effects about you. Delivery fees are calculated automatically from the route, size, value and selected services, but they are pricing calculations, not profiling decisions about individuals. Fraud and abuse signals may flag accounts for human review.

15. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, the Service or applicable law. We will post the updated policy on this page with a revised "Last updated" date. Where the changes are material, we will notify Workspace owners by email or through the Service before the changes take effect.

16. How to contact us and how to complain

For privacy questions or to exercise your rights, contact [email protected] (subject line "Data protection") or use the contact form. We will try to resolve your concern promptly.

If you are not satisfied with our response, you have the right to complain to the Office of the Data Protection Commissioner (ODPC) in Kenya at www.odpc.go.ke. See also our Terms & Conditions and Support policy.