Privacy Policy

How Zawadigital collects, uses, protects and retains your personal data, and how to exercise your rights under Kenya's Data Protection Act, 2019.

Effective 2 September 2026

1. Who we are

Zawadigital is operated by Zawadigital Limited, registered in Nairobi, Kenya. We act as a data controller for the personal data you submit to us. Questions about this policy or your data can be sent to privacy@zawadigital.co.

2. What we collect

Identity data: name, role, business name.
Contact data: email address, phone number.
Payment data: M-Pesa number, partially-masked card details, bank account details — used to send payouts to merchants and process purchases for buyers.
Transactional data: orders, redemptions, refunds, payout history.
Technical data: IP address, device type, log entries — used to keep the service secure and operational.
Usage data: pages viewed and cards browsed — see Cookies & tracking.

3. Why we process it

To create and operate your account (contractual necessity).
To process payments and pay out merchant earnings.
To verify the legitimacy of businesses listed on the platform.
To meet legal and regulatory obligations, including anti-fraud and tax reporting.
To send you transactional notifications related to your account.
To personalise recommendations and measure product usage.

4. How we protect it

Sensitive identifiers (phone numbers, card numbers, bank account numbers) are masked in the user interface so only the last few digits are ever shown after entry.
Card numbers are never stored in full on our servers — only a tokenised reference returned by our PCI-DSS-compliant payment processor is retained.
Passwords are stored using one-way cryptographic hashing.
Access to personal data inside our team is limited to staff with a documented operational need.
Data is transmitted over TLS and stored in encrypted databases.

5. Cookies & tracking

Zawadigital does not use third-party advertising or tracking scripts. The only cookie that isn't strictly required to run the site is a first-party session identifier we use to personalise your home feed and measure which gift cards are popular.

6. How long we keep it

We retain personal data only for as long as it is necessary for the purposes set out above, or as required by Kenyan tax and financial regulations (typically 7 years for transactional records). When data is no longer needed, it is deleted or irreversibly anonymised. Our published retention schedule sets out specific periods per category of data.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

Be informed about how your data is being used.
Access the personal data we hold about you.
Request correction of inaccurate personal data.
Request deletion of your personal data, subject to our legal retention obligations.
Object to processing for direct marketing.
Lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke).

Correction and deletion

Access, correction, deletion and anonymisation requests are reviewed and actioned by a named member of our team, and logged against your request for audit purposes. Financial and audit records may be retained beyond a deletion request where Kenyan tax or financial regulation requires it — in that case the personal identifiers on those records are anonymised where the record itself must be kept.

8. Exercising your rights

Exercising your rightsTo make a data-subject request, email privacy@zawadigital.co. We'll respond within 7 days and complete the request within 30 days, as required by the Act.

Complaints may also be filed with the Office of the Data Protection Commissioner at odpc.go.ke.