TUMISHAPrivacy Policy
1. WHO WE ARE
Tumisha is a cross-border shopping agent service that helps customers in Kenya and Ghana
buy products from Chinese online marketplaces and receive them in Kenya or Ghana. We are
the data controller for personal information processed through the Tumisha app.
2. INFORMATION WE COLLECT
- Account information: email address, password (stored only as a hash), nickname and
profile picture. If you choose Google or Apple sign-in, we receive the identifier
and email provided by that provider.
- Device information: a random device identifier created on first launch (used to
keep your guest cart), device model, operating system and app version.
- Transaction information: orders, delivery addresses and phone numbers, product
snapshots, and payment confirmation references from our payment partners.
- Content you upload: photos you submit for image search and profile pictures you
upload, which are automatically checked for illegal content before being stored.
- Usage information: shopping cart, favourites, browsing history, in-app analytics
(events, referral attribution) and performance measurements, as well as crash/diagnostic logs needed to keep the service running.
3. HOW WE USE YOUR INFORMATION
To create and secure your account; to purchase, consolidate and ship the items you
order; to process payments and refunds through our payment partners; to provide customer support;
and to prevent fraud and abuse. We do not use your information for automated
decision-making or profiling, and we do not sell it.
4. PAYMENTS
Payments are processed by our payment partners (e.g. PayPal, M-Pesa and card networks, as offered in the app at checkout). We never see or store your payment PIN or full payment credentials; we only keep the transaction reference needed
to match your payment to your order.
5. THIRD-PARTY PROCESSORS AND CROSS-BORDER TRANSFER
To deliver the service we share the minimum necessary data with:
- our payment partners, e.g. PayPal (transaction references and order amounts);
- Google / Apple, when you use their sign-in (subject to their own privacy policies);
- cloud infrastructure providers we use to run the service;
- content moderation services, which automatically review images you upload (such as
photos for image search and profile pictures) for illegal content;
- WhatsApp (Meta), when you contact customer support from the app — the chat is
pre-filled with your account email so we can locate your account faster;
- upstream Chinese marketplaces and logistics providers, to fulfil and ship your order
(delivery name, address and phone as printed on the parcel).
Our servers and partners are located outside Kenya and Ghana (including Singapore and China).
Where your data leaves your country, we apply contractual safeguards and only transfer what
is necessary to provide the service, in line with applicable data protection law.
6. HOW LONG WE KEEP IT
Account and transaction records are kept while your account is active and for the
period required by law. If you delete your account, we delete or anonymise your
personal data within 30 days, except records we must keep for tax or legal purposes.
7. YOUR RIGHTS
You may request access, correction or deletion of your data, and object to processing.
Depending on where you live, you may also lodge a complaint with your local regulator:
in Kenya, the Office of the Data Protection Commissioner (ODPC) under the Data
Protection Act, 2019; in Ghana, the Data Protection Commission (DPC) under the Data
Protection Act, 2012 (Act 843). To exercise any right, email sjkj@tumisha.com.
8. CHILDREN
The service is not directed at persons under 18. We do not knowingly collect data from children.
9. SECURITY
We store passwords in hashed form, use encrypted connections (HTTPS) and restrict
access to personal data to staff who need it.
10. CHANGES
If we change this policy we will notify you in the app or by email before it takes effect.