DELIVERYMALL PRIVACY POLICY
Effective date: 6 August 2026
Version: 2026.08.06
This Privacy Policy explains how DeliveryMall Enterprise Limited ("DeliveryMall", "we", "us" or "our") collects, uses, stores, shares and protects personal data through the DeliveryMall customer, Vendor and Delivery Partner applications, website and related services.
DeliveryMall is the data controller for personal data processed for its own purposes. Some Vendors, payment providers and other service providers may act as independent controllers for information they process under their own legal obligations.
1. CONTACT AND PRIVACY POINT OF CONTACT
Company: DeliveryMall Enterprise Limited
Address: Oginga Odinga Road, Kisumu, Kenya
Email and privacy enquiries: info@deliverymall.co.ke
Customer care telephone and WhatsApp: +254 787 448899
Website: https://www.deliverymall.co.ke
A privacy request may be submitted through the in-app support function, by email or through the account-deletion page at https://www.deliverymall.co.ke/data-deletion.
2. SCOPE
This Policy applies to Customers, recipients, Vendors, Delivery Partners, website visitors, customer-support contacts and other Users of DeliveryMall services.
It does not replace the independent privacy notices of a Vendor, bank, payment provider, mobile-money operator or another third party where that party controls its own processing.
3. PERSONAL DATA WE COLLECT
Depending on how you use DeliveryMall, we may collect:
3.1 Account and contact data
name;
telephone number;
email address;
password or authentication credentials in protected form;
account type, language and preferences;
saved delivery addresses; and
organisation or business information.
3.2 Identity, eligibility and compliance data
national identification or other identification where required;
date of birth or age-confirmation data;
Vendor licences, permits, tax or registration records;
Delivery Partner driving licence, vehicle, insurance and employment or contractor records;
recipient identification for regulated products; and
prescription information where pharmacy fulfilment requires it.
3.3 Order, delivery and transaction data
items and services ordered;
Vendor, recipient and delivery details;
pickup and drop-off addresses;
Order notes and substitutions;
status, timestamps, prices, fees, taxes, refunds and complaint history;
delivery confirmation codes, recipient name, signature or proof-of-delivery photograph; and
payment status, payment reference and tokenised or masked payment information received from the payment provider.
DeliveryMall does not intentionally store a Customer's complete card number or card security code where payment is processed by an external payment provider.
3.4 Location data
For Customers, we may collect precise or approximate location when the User chooses location-based address selection, nearby Vendor discovery, live tracking or another location feature.
For Delivery Partners, we may collect precise location while available for assignment, travelling to pickup, carrying an active Order, navigating or completing a delivery-related safety process. This may continue in the background where the Delivery Partner has been prominently informed and has granted the required device permission.
3.5 Photos, camera and files
We may process photographs and uploaded files including product images, prescriptions, identification documents, parcel condition images, proof of delivery and evidence supporting a complaint or refund.
3.6 Communications
We may process customer-support messages, calls, emails, WhatsApp messages, SMS responses, Vendor communications, reviews and reports of objectionable content or conduct.
3.7 Device, network and diagnostic data
We may collect IP address, device or app identifiers, operating system, app version, language, browser information, crash logs, performance data, security events and interaction data required for operation, analytics, fraud prevention and troubleshooting.
3.8 Information from third parties
We may receive information from Vendors, Delivery Partners, recipients, payment providers, banks, mobile-money operators, identity-verification providers, mapping providers, communications providers, social-login providers where enabled, and public or regulatory sources.
4. WHY WE PROCESS PERSONAL DATA
We use personal data to:
create and secure accounts;
verify identity, age, Vendor status or Delivery Partner eligibility;
display nearby Vendors and calculate delivery distance and charges;
accept, prepare, dispatch, track and complete Orders;
process payments, refunds, credits and invoices;
connect Customers, Vendors, recipients and Delivery Partners for fulfilment;
provide navigation and proof of delivery;
deliver customer support and resolve complaints;
prevent fraud, account abuse, theft and unsafe conduct;
moderate reviews, photographs and other User content;
send essential service and security communications;
send optional marketing where consent or another lawful basis permits it;
maintain tax, accounting and legal records;
analyse and improve Platform reliability and performance;
enforce the Terms and agreements; and
comply with law, court orders and lawful regulatory requests.
5. LEGAL BASES
Depending on the processing, DeliveryMall relies on one or more of the following:
Contract: processing necessary to create an account, accept payment, fulfil an Order, provide delivery, operate a Vendor relationship or manage Delivery Partner work.
Consent: optional marketing, certain device permissions, background location where consent is required, and other processing for which the User provides a clear affirmative choice.
Legal obligation: tax, accounting, regulatory, safety, employment and lawful-request obligations.
Legitimate interests: fraud prevention, service security, quality control, dispute resolution, operational analytics and protection of Users and DeliveryMall, balanced against the User's rights.
Protection of vital interests or public interest: limited urgent safety or legal situations where applicable.
Where consent is the basis, the User may withdraw it. Withdrawal does not affect processing already lawfully carried out and may make a location, camera, marketing or similar optional feature unavailable.
6. HOW WE SHARE PERSONAL DATA
We share only what is reasonably necessary with:
6.1 Vendors and Delivery Partners
Vendors may receive Customer name, Order details, relevant instructions and limited contact or location information needed to prepare and hand over an Order. Delivery Partners may receive pickup, recipient, address, route and contact information needed to complete delivery.
A Customer and recipient may receive the Delivery Partner's first name, photograph, vehicle details, location or contact relay information where needed for identification, tracking and safety.
6.2 Payment and financial providers
Payment processors, banks, card networks and mobile-money providers process payment, refund, fraud and settlement information under their own security and legal requirements.
6.3 Technology and communications providers
DeliveryMall may use hosting, cloud, database, mapping, analytics, crash-reporting, cybersecurity, SMS, email, push-notification and WhatsApp providers. Depending on the current deployment, these may include services supplied by Google, Firebase, Google Maps, Cloudflare, Meta/WhatsApp and Celcom Africa.
6.4 Professional advisers and insurers
We may share necessary information with auditors, lawyers, accountants, insurers and investigators under confidentiality and legal obligations.
6.5 Authorities and legal proceedings
We may disclose data where required by law, a lawful court order, regulatory request, tax obligation, law-enforcement process or to protect rights, safety, property and evidence.
6.6 Business transfers
If DeliveryMall is restructured, financed, merged or sold, data may be transferred subject to lawful notice and continued protection.
We do not sell personal and sensitive User data for monetary consideration.
7. LOCATION AND PERMISSION CONTROLS
7.1 Customer location
Customer location is requested only when relevant to address selection, Vendor discovery, delivery pricing or tracking. Where reasonably possible, the Customer may enter an address manually instead.
7.2 Delivery Partner location
Delivery Partner location may be required for dispatch, navigation, live tracking, safety, attendance linked to operational work, route evidence and proof of delivery. Background collection will be limited to clearly disclosed operational scenarios and stopped when the relevant work or availability state ends.
7.3 Camera and photos
Camera and photo permissions are used for user-initiated tasks such as prescriptions, proof of delivery, product images, identity verification and complaints. DeliveryMall should use system pickers or limited access where technically available.
7.4 Notifications
Transaction and security notifications are part of service operation. Marketing notifications are optional and can be disabled in app settings or device settings.
7.5 Foreground service
Our Vendor (Store) and Delivery Partner applications use foreground services while you are actively using the app. A foreground service keeps a visible notification on your device so the app can continue performing a task you started - for example, receiving new orders, updating order status, or reporting delivery progress - while the app is open or temporarily in the background. You will see a persistent notification while a foreground service is running, and the service stops when the task completes or when you close the relevant screen. Foreground services never run without a visible notification, and we do not use them to collect data in the background beyond what is needed for the active task.
8. PRESCRIPTIONS AND HEALTH-RELATED DATA
Prescription images and related information are sensitive personal data. They are used only to verify and fulfil a lawful pharmacy Order, resolve a pharmacy complaint, comply with legal obligations and protect User safety.
They are made available only to authorised personnel and the relevant licensed pharmacy Vendor on a need-to-know basis. DeliveryMall does not use prescription information for advertising or unrelated profiling.
9. CHILDREN
DeliveryMall is not directed to children and does not knowingly allow a child below eighteen to independently create an account or purchase regulated products.
Where a parent or guardian permits a minor to use the service under supervision, the parent or guardian is responsible for the activity. DeliveryMall will delete personal data knowingly collected from a child without valid authority where required by law.
10. MARKETING
DeliveryMall may send promotions where the User has consented or where applicable law otherwise permits. Marketing consent is separate from acceptance of the Terms and is not required to place an Order.
A User may opt out using the unsubscribe instruction, in-app communication settings or by contacting DeliveryMall. Essential Order, security and account messages will continue.
11. AUTOMATED PROCESSING
DeliveryMall may use automated rules to detect fraud, calculate delivery fees, assign Orders, estimate arrival time, prioritise risk reviews or identify policy violations.
Where an automated decision produces a significant adverse effect, a User may request human review through customer support where applicable law grants that right.
12. DATA RETENTION
DeliveryMall applies the following retention principles:
account profile data is retained while the account is active and is deleted or anonymised after a verified deletion request, subject to lawful exceptions;
tax, invoice, payment and accounting records are retained for at least five years from the end of the relevant reporting period, and longer where a proceeding or legal obligation requires it;
Order and complaint records are retained for the period reasonably required for fulfilment, refunds, disputes, fraud prevention, safety and legal claims;
precise live location is retained only as long as reasonably necessary for dispatch, delivery evidence, safety, dispute handling and lawful obligations, then deleted, aggregated or anonymised;
unsuccessful login and security logs are retained for a limited period required for fraud and cybersecurity monitoring;
prescription and identity documents are retained only for the period required for fulfilment, audit, safety, dispute or law, with stricter access controls; and
marketing preference records are retained to ensure that opt-out choices are respected.
When a retention period expires, data is securely deleted or irreversibly anonymised unless a legal hold applies.
13. ACCOUNT AND DATA DELETION
A User may request account deletion in the Application through:
Profile or Menu > Settings > Account > Delete Account
A User may also use https://www.deliverymall.co.ke/data-deletion.
Deletion covers the account and associated personal data, not merely account deactivation. DeliveryMall may require reauthentication or OTP verification.
Some transaction, tax, fraud-prevention and legal records may be retained in restricted or anonymised form. DeliveryMall aims to complete verified deletion requests within thirty days and will explain any lawful delay or retention.
14. YOUR DATA-PROTECTION RIGHTS
Subject to law and identity verification, a User may request:
information about how personal data is used;
access to personal data;
correction of inaccurate or misleading data;
deletion or erasure;
restriction of processing;
objection to processing;
withdrawal of consent;
data portability where applicable; and
human review of certain significant automated decisions where applicable.
A request can be submitted to info@deliverymall.co.ke, through in-app support or through https://www.deliverymall.co.ke/data-deletion. DeliveryMall may request reasonable verification and will not retaliate against a User for exercising a legal right.
A User may also complain to the Office of the Data Protection Commissioner of Kenya where applicable.
15. SECURITY
DeliveryMall uses reasonable technical and organisational safeguards, including access control, role-based permissions, encrypted transmission using HTTPS/TLS, secure credential storage, logging, backups, provider due diligence and incident response.
No system is completely secure. Users must protect passwords and verification codes and promptly report suspected compromise.
16. INTERNATIONAL DATA TRANSFERS
Some technology providers may process data outside Kenya. Where personal data is transferred internationally, DeliveryMall will use contractual, technical and legal safeguards required by applicable law and will limit the data to what the provider needs.
17. DATA BREACHES
DeliveryMall will investigate suspected personal-data breaches, contain risk, preserve evidence and notify affected Users and the Office of the Data Protection Commissioner where notification is legally required.
18. THIRD-PARTY LINKS AND SERVICES
The Platform may link to a Vendor, map, payment, social-login or other third-party service. That third party's privacy policy applies to processing it independently controls. DeliveryMall is not responsible for a third party's unrelated privacy practices.
19. CHANGES TO THIS POLICY
DeliveryMall may update this Policy for changes in law, technology, services, SDKs, Vendors or data practices. The version and effective date will be updated. Material changes will be communicated through the Platform or another appropriate channel. Fresh consent will be requested where required.
20. CONTACT
Questions, rights requests and complaints should be directed to:
DeliveryMall Enterprise Limited
Oginga Odinga Road, Kisumu, Kenya
Email: info@deliverymall.co.ke
Telephone and WhatsApp: +254 787 448899
Account deletion: https://www.deliverymall.co.ke/data-deletion