Privacy policy

Who we are

DukaNext (“DukaNext”, “we”, “us”) builds business tools for Kenyan businesses: an online shop, a CRM, Instagram and WhatsApp automation, inventory, product photo tools and others we add. We are a business registered and operating in Kenya, and we respect your privacy and your customers’ privacy. This policy explains what personal data we collect, why, who we share it with, and the choices and rights you have under the Data Protection Act, 2019 of Kenya.

Contact us about anything in this policy:

• Email: hello@dukanext.co.ke
• Address: USIU Road, Nairobi, Kenya

Two roles: our own data and your customers’ data

We act in two different roles, and this policy covers both.

• When you create an account and use our tools, we decide how your personal data (for example your name, email address and phone number) is used. In this case we are the data controller.
• When you put information about your own customers, contacts or staff into our tools, or collect it through your shop, you decide what is done with it and we handle it for you. In this case you are the data controller and we are your data processor. Our Terms of Service describe our duties as your processor.

What this policy covers

This policy covers our websites, our account portal, our apps and all of our tools, including the online shop (Shop), CRM, Automate, Inventory and Onaa. It applies to the people who have an account with us and the people who visit our websites.

What data we collect

When you create and use your account

• Your name, email address and mobile phone number.
• If you sign in with Google, your name, email address and profile picture from Google.
• Codes we send to confirm your email address and phone number, which we keep in a protected (hashed) form for a short time.
• Sign-in and device information, such as your browser and device type, IP address and when you signed in, which we use to keep your account safe and show you where you are signed in.
• The date and version of the Terms of Service and Privacy Policy you agreed to.

Plans and payments

• Which plan you have, how long it lasts and your payment history (amount, date, reference).
• We do not store your full card number or your M-Pesa PIN. Payments are handled by our payment partners.

Shop

• Your shop’s details, products, images, prices, orders, customers, coupons, reviews, messages from visitors, delivery and pickup settings, and your connected domain and email settings.
• Information your shop’s visitors and customers give you, such as their name, phone number, email address and delivery address.
• Settings for payment providers, advertising and analytics tools that you choose to connect.

CRM

• Your business details, customers, prospects, quotes, invoices, bookings, payments and automations, and the messages sent through them.
• If you connect your own mail server, the details needed to send email on your behalf.

Automate

• The Instagram and WhatsApp accounts you connect, and access tokens that let us act on them for you.
• Comments, messages and contact details of the people who write to your accounts, so that your automations and shared inbox can work.
• The automations, menus, forms, templates and broadcasts you create.

Inventory

• Your products, stock levels, warehouses, purchase orders, stock counts and the data synced from platforms you connect.

Onaa

• The photos you upload and the images we produce from them, and your credit balance and usage.

How you use our websites and tools

• Basic usage information such as pages visited and actions taken.
• A random identifier kept in your browser to count how many people go from our pages to signing up. It does not contain your name or email address.

When you contact us

• The messages you send us, and any details you give us.

How we use your data

• To create your account, sign you in and keep it secure.
• To provide, run and improve our tools and your plan, including billing and support.
• To send you messages that you need, such as sign-in codes, payment receipts, plan reminders, security alerts and changes to our terms.
• To send product news, offers and tips, which you can opt out of at any time.
• To prevent fraud, abuse and breaches of our terms, and to protect our users and systems.
• To comply with the law and answer lawful requests from authorities.
• To understand how our tools are used so that we can improve them.

Our lawful bases

Under the Data Protection Act, 2019 we process personal data only where we have a lawful basis:

• To perform our contract with you (providing your account and tools).
• Your consent, for example when you opt in to marketing, or connect a Meta account. You can withdraw consent at any time.
• Our legitimate interests, such as keeping our service secure and improving it, where these are not overridden by your rights.
• To comply with a legal obligation.

Who we share data with

We do not sell your personal data. We share it only with the following, and only as needed:

• Service providers (sub-processors) that help us run our tools, who may use data only on our instructions. They are listed below.
• Payment providers, when you pay or are paid through them.
• Services you choose to connect, such as Meta, a payment provider or an advertising tool, which then handle data under their own policies.
• Authorities, where the law requires it or to protect rights and safety.
• A buyer or successor, if our business is sold or reorganised, with the same protections for your data.

Current sub-processors and providers

• Paystack: takes payments for plans.
• Pesapal: takes payments for shops and invoices where a merchant connects it.
• IntaSend: processes payments for the DukaNext Wallet.
• Meta Platforms (WhatsApp and Instagram): sends and receives messages for Automate, and syncs product catalogues when you connect them.
• Google: lets you sign in with Google.
• DigitalOcean: hosting and file storage.
• TextSMS: sends SMS codes.
• Resend and SendGrid: send email on our behalf.
• OpenAI and PhotoRoom: AI features, such as drafting product descriptions and improving photos in Onaa.

We update this list when it changes.

Transfers outside Kenya

Some of the providers above process data outside Kenya. When personal data leaves Kenya, we take the steps the Data Protection Act, 2019 requires so that it stays protected, such as contracts with the provider and choosing providers with appropriate safeguards.

How long we keep data

• Account data: for as long as your account is open, and for a limited time afterwards.
• Content in your tools: for as long as your account is open. If your plan ends, we keep your content for at least 90 days so you can renew or export it, then we may archive or delete it after warning you by email.
• A deleted CRM business: for 14 days so you can restore it, then it is removed.
• Billing and payment records: for as long as the law requires.
• Backups are kept for a limited time and are deleted on their normal schedule.

How we protect your data

We protect data with measures that include encrypted connections, hashed verification codes and sign-in tokens, access controls and monitoring. No system is perfectly secure. If a breach puts your personal data at risk, we will tell you and the Data Protection Commissioner as the law requires.

Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used;
• access your data;
• ask us to correct it;
• ask us to delete it;
• object to how it is used, including for marketing;
• withdraw your consent at any time; and
• ask for a copy of your data in a usable format.

To use a right, email hello@dukanext.co.ke. We may need to confirm who you are first. If you are not happy with how we handle your data, you can complain to us, and you also have the right to complain to the Office of the Data Protection Commissioner.

• Website: www.odpc.go.ke
• Email: info@odpc.go.ke

If you are a customer of one of our merchants

When you buy from a shop, book a service or write to a business that uses DukaNext, that business decides why and how your data is used, and we handle it for them. Please contact the business to use your rights. If you cannot reach them, write to us at hello@dukanext.co.ke and we will pass your request on.

Responsibilities of businesses using our tools

If you use our tools to collect or use data about your customers, you are responsible for having a lawful basis to do so, for giving your customers the notices the law requires, for registering with the Data Protection Commissioner if you must, and for responding to your customers’ requests.

Cookies and similar technology

We use cookies and similar storage that are needed to keep you signed in, remember your choices and keep our service secure. We also use a random identifier in your browser to count sign-up steps, with no name or email. If we add advertising or other analytics cookies to our own websites, we will tell you and ask for your consent where the law requires.

Children

Our tools are for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, email us and we will delete it.

Changes to this policy

We may update this policy, for example when we add a tool or change a provider. We will post the new version on this page with its date, and tell you about important changes by email or in your account.