Privacy Policy
Your privacy matters to us. Learn how we collect, use and protect your information.
Last updated: 12 November 2026
This Privacy Policy explains how Duka ("we", "us" or "our") collects, uses and shares your personal information when you use our website and services. By using our services, you agree to the collection and use of information in line with this policy.
Introduction
At Duka, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose and protect your information when you visit our website and use our services. We are committed to protecting your personal data and to being transparent about how we handle your information.
Information We Collect
We collect several types of information to provide and improve our services:
Information You Provide
- •Name, email address and phone number
- •Shipping and billing addresses
- •Payment information (processed securely by our payment providers)
- •Order history and shopping preferences
- •Messages to our customer support team
- •Account details (username and password)
- •Product reviews and ratings
Information Collected Automatically
- •IP address and device information
- •Browser type and version
- •Operating system
- •Pages viewed and time spent on our website
- •Referring website addresses
- •Cookies and similar tracking technologies
How We Use Your Information
We use the information we collect for the following purposes:
- •To process and fulfil your orders and transactions
- •To contact you about your orders, account and services
- •To provide customer support and answer your questions
- •To send marketing messages and promotional offers (with your consent)
- •To personalise your shopping experience and product recommendations
- •To improve our website, products and services
- •To analyse usage patterns and trends
- •To detect, prevent and resolve fraud and security issues
- •To meet legal obligations and enforce our terms
- •To carry out research and analysis
Sharing and Disclosure of Information
We do not sell your personal information. We may share your information with:
Service Providers
- •Payment providers (M-Pesa, card payment processors)
- •Shipping and delivery companies
- •Cloud hosting and storage providers
- •Email and communication service providers
- •Analytics and marketing platforms
Legal Requirements
- •When required by law or legal process
- •To protect our rights, property or safety
- •To prevent fraud or illegal activity
- •In connection with a business transfer or acquisition
Data Security
We use strong security measures to protect your personal information:
- •SSL/TLS encryption for data in transit
- •Secure servers and firewall protection
- •Regular security audits and penetration testing
- •Access controls and authentication procedures
- •Staff training on data protection practices
- •Secure payment processing through PCI-DSS compliant providers
- •Regular backups and disaster recovery procedures
Note: However, no method of transmission over the Internet or electronic storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security.
Cookies and Tracking Technologies
We use cookies and similar technologies to improve your experience:
Types of Cookies We Use
- •Essential cookies: needed for the website to work
- •Performance cookies: help us understand how you use our site
- •Functional cookies: remember your preferences and settings
- •Marketing cookies: show relevant advertising
Managing Cookies
- •You can control cookies through your browser settings
- •Disabling cookies may affect how the website works
- •Most browsers let you refuse or delete cookies
- •Third-party cookies are covered by their own privacy policies
Your Rights and Choices
You have the following rights over your personal information:
- •Access: request a copy of your personal information
- •Correction: update or correct inaccurate information
- •Deletion: ask us to delete your personal information
- •Restriction: limit how we use your information
- •Portability: receive your data in a structured format
- •Objection: object to certain processing activities
- •Withdraw consent: opt out of marketing messages at any time
- •Complaint: lodge a complaint with a supervisory authority
Note: To exercise these rights, please contact us at privacy@duka.co.ke. We will respond to your request within 30 days.
Marketing Communications
With your consent, we may send you marketing messages about:
- •New products and special offers
- •Sales and promotional events
- •Product recommendations based on your interests
- •Company news and updates
Note: You can opt out of marketing messages at any time by clicking the 'unsubscribe' link in our emails or by updating your preferences in your account settings.
Children's Privacy
Our services are not directed at anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us immediately so that we can delete it.
International Data Transfers
Your information may be transferred to and processed in countries other than Kenya. We make sure such transfers comply with applicable data protection laws and that appropriate safeguards are in place to protect your information.
Data Retention
We keep your personal information for as long as needed to:
- •Fulfil the purposes set out in this Privacy Policy
- •Meet legal, accounting or reporting requirements
- •Resolve disputes and enforce our agreements
- •Maintain business records
Note: After the retention period, we will securely delete or anonymise your information.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will tell you about any significant changes by:
- •Posting the updated policy on our website
- •Updating the 'Last updated' date
- •Sending an email notice (for significant changes)
- •Showing a prominent notice on our website
Note: We encourage you to review this Privacy Policy regularly. Continuing to use our services after changes are posted means you accept the updated policy.
Contact Us
If you have questions, concerns or requests about this Privacy Policy or our data practices, please contact us:
- •Email: privacy@duka.co.ke
- •Phone: +254 700 000 000
- •Address: Nairobi CBD, Kenya
- •Data Protection Officer: dpo@duka.co.ke
Note: We take all privacy enquiries seriously and will respond as quickly as possible.
By using Duka's services, you confirm that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services. For any privacy questions or concerns, contact us at privacy@duka.co.ke