Privacy Policy

Last updated: 5 July 2026

This Privacy Policy explains how TreatRight Kenya ("TreatRight", "we", "us") collects, uses, discloses, and protects personal data when you use our platform, in line with the Constitution of Kenya, 2010 (Article 31 — the right to privacy) and the Data Protection Act, 2019, together with its subsidiary regulations. TreatRight acts as a data controller for the personal data described below.

1. What we collect

  • Account and identity data — name, phone number, and (for vendor staff and admin accounts) email address.
  • Gift and transaction data — the vendor and meal selected, recipient phone number and name, gift amount, Paystack transaction reference, and redemption status. Redemption tokens and codes are hashed or randomly generated and are never derived from personal data.
  • Contact form submissions — name, email, phone number (optional), and message, if you contact us directly.
  • Technical data — IP address, timestamps, and basic request logs, collected for security monitoring (e.g. detecting repeated failed logins) and fraud prevention.

We do not collect or store M-Pesa PINs, card numbers, or any payment credential — payment is handled directly between you and Paystack, our payment processor.

2. Why we process your data

We process personal data on the following legal bases recognised under the Data Protection Act:

  • Performance of a contract — to create your account, process a Gift purchase, and enable redemption at a vendor.
  • Legitimate interest — to keep the platform secure, detect and prevent fraud or abuse, and maintain audit logs of account activity.
  • Legal obligation — to keep financial and transaction records as required by Kenyan tax and business record-keeping law.
  • Consent — where we ask for it separately, such as optional communications beyond what the service requires.

3. Who we share it with

We share personal data only where necessary to provide the service:

  • Paystack — to process payments (including M-Pesa, card, and bank transfer). Paystack processes this data under its own privacy terms as the payment service provider.
  • Vendors — receive only what they need to fulfil a Gift (the recipient's name/phone where relevant, the item chosen, and a redemption code) — never the sender's payment details.
  • Regulators and authorities — where disclosure is required by Kenyan law or a valid legal request, including the Office of the Data Protection Commissioner (ODPC).

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

4. How long we keep it

We retain personal data only for as long as necessary for the purposes described above, including any minimum retention period required by Kenyan tax, financial, or consumer-protection law. Redemption tokens expire automatically after a limited window from purchase; expired or redeemed Gift records are retained for accounting and dispute-resolution purposes.

5. Your rights

Under the Data Protection Act, 2019, you have the right to:

  • be informed of how your data is being used (this policy);
  • access the personal data we hold about you;
  • request correction of inaccurate or outdated data;
  • request deletion of your data, subject to our legal retention obligations;
  • object to or request restriction of certain processing; and
  • lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data has been mishandled.

To exercise any of these rights, contact us. We'll respond within a reasonable time and in line with our obligations under the Act.

6. Security

We apply technical safeguards appropriate to the sensitivity of the data we hold, including encrypted transport (HTTPS), hashed storage of redemption tokens, rate-limiting on authentication endpoints, and access restricted to staff who need it to do their job. No system is completely immune to risk, but we take reasonable steps consistent with the Act's security-safeguard requirements.

7. Children

TreatRight is not directed at children. Creating a sender account requires a valid phone number, which assumes an adult phone owner.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

9. Contact us

Questions about this policy or how we handle your data can be sent via our Contact us page or by emailing frontrow254@gmail.com .