Privacy Policy
Last updated 2 October 2026 · Version 2026-10-02
This policy explains what personal data Urban Bites collects, why, who sees it, and the choices you have. We process personal data in line with the Data Protection Act, 2019 (Kenya) and its regulations.
1. Who we are
The data controller is [Registered company name], [Registered office address], Kenya (ODPC registration: [ODPC data controller/processor registration number]). For privacy questions write to privacy@urbanbites.shop.
For each order, the Service you order from (a restaurant, pharmacy or shop) and the rider who delivers it receive the details they need to fulfil it. Where they decide how to use that data for their own purposes they are separate controllers; see "Who we share it with".
2. What we collect
| Type | Examples | How we get it |
|---|---|---|
| Account details | Name, email, phone number, password (stored only as a one-way hash), profile photo, referral code | You, when you register or edit your profile |
| Order details | Items, delivery notes, order history, ratings and reviews, messages with riders or the Service | You, when you order and chat |
| Delivery addresses & location | Saved addresses; your device location when you allow it, to show Services that reach you and to calculate delivery | You, and your browser/phone if you grant permission. For riders, live location while online |
| Payment information | Payment method used, M-Pesa phone number, transaction references and status, wallet balance and history, refunds | You and our payment providers. We never receive or store your full card number or M-Pesa PIN |
| Verification & security data | One-time codes (and the channel they were sent by), login time, IP address, device/browser type | Automatically |
| Communications | Messages you send us, area or service requests, feature requests, support and WhatsApp conversations, incident reports | You |
| Rider and partner details | ID details, vehicle details, payout phone number and earnings, business details and branch coordinates | You, when you apply or are onboarded (see the Partner & Rider Terms) |
| Cookies & local storage | Sign-in session, cart, theme, remembered location, your cookie choice | Your browser — see the Cookie Policy |
We don't knowingly collect sensitive personal data. If you order medicines, the items in your order may reveal health information — we treat this with extra care and only share it with the pharmacy and rider who need it to fulfil the order.
3. Why we use it
| Purpose | Lawful basis (DPA 2019) |
|---|---|
| Create and secure your account, verify you with one-time codes | Performing our contract with you; legitimate interest in preventing fraud |
| Process orders, take payment, assign and track delivery, handle refunds and support | Performing our contract with you |
| Show Services available in your area and calculate delivery fees | Performing our contract; your consent to share your location |
| Send order updates and security messages (SMS, WhatsApp, email, push) | Performing our contract; legitimate interest |
| Prevent fraud, abuse and unsafe activity; keep an audit trail of staff actions | Legitimate interest; legal obligation |
| Keep tax, accounting and payment records | Legal obligation |
| Improve the platform and understand demand for new areas and services | Legitimate interest; your consent where required (e.g. optional cookies) |
| Send promotions and offers | Your consent — you can withdraw it at any time |
We don't sell your personal data. We don't use it for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
- The Service you order from — your name, phone, order contents and delivery notes (and prescription details for a pharmacy).
- Riders — your name, phone number, delivery address and order number, only while a delivery is in progress.
- Payment providers — Paystack and Safaricom M-Pesa process payments and refunds; they have their own privacy notices.
- Messaging providers — SMS gateways, WhatsApp/Meta and email delivery services carry one-time codes and order updates.
- Technology suppliers — cloud hosting, database and content-delivery providers that store and serve our platform, and map tile and font providers that your browser contacts to display pages (they can see your IP address).
- Professional advisers, auditors and regulators — when needed to protect our legal rights or comply with the law.
- Law enforcement and courts — when we're legally required to, or to prevent a serious crime.
- A buyer of the business — if we merge or are acquired, your data may transfer under the same protections.
Our suppliers may only use your data to provide services to us, under contract.
5. Hosting & transfers abroad
Some of our technology providers store or process data outside Kenya. Where that happens we make sure it is allowed under sections 48–50 of the Data Protection Act: the recipient is bound to appropriate safeguards (such as contractual protections), or you have consented, or the transfer is necessary to perform your order or contract. Contact privacy@urbanbites.shop for details of the safeguards used.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile data | While your account is open, then deleted or anonymised after you ask us to close it (subject to the records below) |
| Orders, payments and refunds | 7 years — to meet tax, accounting and dispute requirements |
| One-time codes | Minutes — they expire after 10 minutes and are cleared after use |
| Rider live location | Only while a delivery is active; coarse history may be kept for dispatch reliability and fraud checks |
| Area / service requests | Until we can serve the area or you ask us to delete them |
| Staff action (audit) logs | Up to 7 years, for security and accountability |
| Support chats and incident reports | Up to 3 years from resolution |
7. Your rights
Under the Data Protection Act you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete data we no longer need (we'll keep what the law requires us to keep);
- stop or restrict processing, or object to it, including direct marketing;
- give you your data in a commonly used format, or transfer it to another provider (data portability);
- withdraw consent at any time — this doesn't affect what we did before you withdrew.
Email privacy@urbanbites.shop from the address on your account. We may need to verify your identity first, and we aim to respond within 30 days. You can edit most details yourself in your Profile. To delete your account, email us — we'll settle any open orders and wallet balance first.
8. Security
We use encryption in transit (HTTPS), hashed passwords, role-based access for staff with an audit log of what they do, rate limits on sign-in and codes, and separate payment providers so we never hold your card details. No system is perfectly secure; if a breach affects your data in a way that creates a real risk, we'll notify you and the Office of the Data Protection Commissioner within the time the law requires (72 hours for the regulator).
9. Children
Urban Bites is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has given us data, tell us and we'll delete it.
10. Marketing
We send promotional messages only if you opt in, and every message tells you how to stop. Order, payment and security messages aren't marketing and are sent regardless.
11. Changes
We'll update this policy when our practices change and show the new date at the top. For significant changes we'll notify you.
12. Contact & complaints
Privacy questions: privacy@urbanbites.shop, or by post to [Registered company name], [Registered office address], Kenya.
If you aren't happy with how we've handled your data, you can complain to the Office of the Data Protection Commissioner (ODPC), Kenya — www.odpc.go.ke. We'd appreciate the chance to put it right first.