Who we are
duka.bio gives sellers in Kenya their own online shop link. Their customers use it to order products, book services and buy event tickets, and pay by M-Pesa or card.
- duka.bio is run by Buniverse Limited, a private limited company registered in Kenya (company number PVT-BB16Y5Z7). Buniverse also runs Gariboss (gariboss.com).
- Postal address: P.O. Box 1733-00900, Kiambu, Kenya.
- Email: [email protected]
- WhatsApp: 0753 102 002
Sellers and customers: who decides what
Sellers are our customers. For a seller's own account, duka.bio decides how the data is used (we are the data controller).
Customers who order, book or buy a ticket do it from a seller's shop. The seller uses their details to serve them, and duka.bio stores and uses them on the seller's behalf (for customer data, the seller is the data controller and we are the data processor). A customer can ask the seller or us about their data; we will help either way.
What we collect
About sellers
- Name, phone number and email address.
- Your sign-in account, held by our sign-in provider, Clerk.
- Your shop: its name and link, logo and cover photo, description, WhatsApp number, and the address or location you choose to show.
- Where your money goes: the M-Pesa number, till or bank account you choose, and the name on it as the payment company confirms it.
- What you sell: products, photos and videos, prices and stock, services and staff for bookings, and events.
- Your duka.bio plan and how you paid for it.
About customers
- Orders: name, phone number, the delivery area or address given, what was ordered, and the payment.
- Bookings: name, phone number, the service and time booked, any note left for the seller, and the deposit.
- Tickets: name, phone number, email if given, the tickets bought, and whether each ticket was used.
- Every payment: amount, date and time, the M-Pesa reference, the phone number that paid, and whether it went through. Card numbers are kept by the payment company, never by us.
When you visit duka.bio or a shop
- Google Analytics counts visits and the pages people open, on duka.bio and on every shop, so we can see how people find shops. It uses cookies and sees your IP address and browser.
- Each seller sees how many people visited their shop and from where. We count this on our own servers (Umami), without cookies.
- If a seller adds their own TikTok pixel to their shop, TikTok also sees visits to that shop, for the seller's ads.
- Your cart is kept in your own browser. Sellers use cookies to stay signed in.
Why we use it
- To run the service: show the shop, take orders, bookings and ticket sales, take payments, and tell the seller and the customer what happened.
- For the seller's business: a seller needs a customer's name, phone and address to deliver, serve or let them in. Customer data is used for that and nothing else.
- To bill sellers for paid plans.
- Because the law requires it: payment and billing records are kept for tax and for disputes.
- To keep duka.bio working and safe: fixing problems, and stopping shops that sell what the law does not allow.
We do not sell personal data, and we do not use it for our own advertising. A customer's details are shown only to the seller they bought from, never to other sellers.
Who else sees it
Only the companies we need to run duka.bio, and only what each one needs:
- Paystack: takes customers' M-Pesa and card payments, pays sellers out, and takes sellers' plan payments.
- Safaricom (M-Pesa): sends the payment prompt to the customer's phone.
- WhatsApp (Meta): carries order, booking, ticket and payment messages.
- Clerk: sellers' sign-in accounts.
- Google Analytics: visit counts.
- Hetzner: the servers where duka.bio, its database and its photos run.
We also share data when the law requires it, for example a court order, or a request from the Data Commissioner or the Kenya Revenue Authority.
Where it is kept
Our servers are run by Hetzner in the European Union. Clerk and Google are based in the United States and the European Union. Under the Data Protection Act we send data outside Kenya only to companies that protect it to the standard Kenyan law expects, and only what is needed for the service.
How long we keep it
- A seller's account, shop and products: for as long as the shop is open.
- Orders, bookings, tickets, payments and plan bills: at least 5 years, because Kenyan tax law requires business records to be kept that long. They are also how a payment dispute gets settled.
- A customer's contact details on an order can be deleted on request; the record of the sale itself stays with the seller's books.
If a seller closes their shop, we delete their data on request, except the records the law makes us keep.
How we protect it
- Every connection to duka.bio and its shops is encrypted (HTTPS).
- We never see or store passwords: sign-in is handled by Clerk.
- We never see or store card numbers: card payments are handled by Paystack.
- A seller sees only their own shop, orders and customers.
If personal data is ever exposed, we will tell the Data Commissioner within 72 hours, as the law requires, and tell the people affected.
Your rights
Under the Data Protection Act, 2019, you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct anything that is wrong;
- delete data we no longer need (except records the law makes us keep);
- stop using your data for something you object to;
- give your data to you in a form you can take to another service.
Send the request by email or WhatsApp (details above). We may ask you to prove who you are first, so nobody gets someone else's data. A customer can also ask the seller they bought from.
If you are not happy with how we handled your data, you can complain to the Office of the Data Protection Commissioner: www.odpc.go.ke.
Children
Opening a shop on duka.bio is for people aged 18 or older.
Changes
When this policy changes, we update the date at the top. If a change matters to how your data is used, we will tell sellers before it applies.
See also our terms of service.