Privacy Policy

Welcome to Pika Plan. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how Pika Plan Ltd ("we", "us", or "our") collects, uses, discloses, and safeguards your information when you use our platform to discover meal plans, order from vendors, and manage your dietary preferences. This policy is designed to comply with the Data Protection Act, 2019 (Kenya) and the General Data Protection Regulation (GDPR) where applicable.

For the purposes of the Data Protection Act, 2019 and the GDPR, Pika Plan Ltd (Registration No: PVR-2024-001234) is the Data Controller responsible for your personal data. Our registered office is located in Nairobi, Kenya. We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy policy.

We collect information that you voluntarily provide to us, information collected automatically, and information from third parties: • Account Data: Name, email address, phone number, and password. • Profile & Preferences: Dietary restrictions, allergies, cuisine preferences, household size, and budget ranges. • Transaction Data: Order history, payment method details (processed securely via M-Pesa and Payhero), and billing addresses. • Location Data: Delivery addresses and approximate location (if permitted) to match you with nearby vendors. • Usage Data: IP address, browser type, device information, and interaction data to improve our platform.

Under the Data Protection Act, 2019 and GDPR, we rely on the following legal bases to process your personal data: • Performance of a Contract: To process your orders, manage your account, and facilitate deliveries. • Consent: Where you have explicitly agreed (e.g., marketing emails, precise location tracking). • Legitimate Interests: To improve our AI meal recommendations, detect fraud, and ensure platform security. • Legal Obligation: To comply with tax, financial, and regulatory requirements.

We use your data to: • Generate personalized, AI-driven meal plans and shopping lists. • Facilitate secure transactions between you and food vendors. • Process payments and handle refunds via our payment partners. • Send transactional notifications (order confirmations, delivery updates). • Improve our machine learning algorithms for better dietary matching. • Comply with legal and regulatory obligations.

We do not sell your personal data. We only share data with trusted third parties necessary to operate the platform: • Food Vendors: When you place an order, we share your name, delivery address, and order details with the specific vendor to fulfill your request. • Payment Processors: M-Pesa, Payhero, and card processors handle your financial data securely. We do not store full card numbers. • Cloud & Infrastructure: Secure hosting providers (e.g., AWS, Vercel) to maintain platform uptime. • Legal Authorities: When required by law or to protect our legal rights.

Our platform is hosted on secure cloud infrastructure that may process data outside of Kenya or the European Economic Area (EEA). Where we transfer your data internationally, we ensure it is protected by Standard Contractual Clauses (SCCs) approved by the European Commission and compliant with Section 48 of the Kenya Data Protection Act, 2019.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected: • Account Data: Retained until you request account deletion. • Transaction & Financial Data: Retained for 7 years to comply with Kenyan tax and financial regulations. • Usage & Analytics Data: Anonymized after 24 months. Once the retention period expires, data is securely deleted or anonymized.

Under the Data Protection Act, 2019 and GDPR, you have the following rights: • Right of Access: Request a copy of the personal data we hold about you. • Right to Rectification: Request correction of inaccurate or incomplete data. • Right to Erasure (Right to be Forgotten): Request deletion of your data, subject to legal retention obligations. • Right to Restrict Processing: Request that we limit how we use your data. • Right to Data Portability: Request your data in a structured, machine-readable format. • Right to Object: Object to processing based on legitimate interests or direct marketing. • Right to Lodge a Complaint: You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya (https://www.odpc.go.ke) or your local supervisory authority in the EU.

We implement robust technical and organizational measures to protect your data, including: • End-to-end encryption for data in transit (TLS 1.3) and at rest (AES-256). • Role-based access controls (RBAC) for our internal team. • Regular security audits and penetration testing. • Secure payment tokenization via M-Pesa and Payhero. While we strive to protect your data, no internet transmission is 100% secure, and we cannot guarantee absolute security.

Pika Plan is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take immediate steps to delete such information.

We use essential cookies to maintain your session and secure your account. We also use analytics tools to understand platform usage and improve our AI recommendations. You can manage your cookie preferences through your browser settings. For more details, please refer to our Cookie Policy.

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. The "Last Updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated via email or a prominent notice on the platform.

If you have any questions, concerns, or wish to exercise your data protection rights, please contact our Data Protection Officer: Email: privacy@pikaplan.com Company: Pika Plan Ltd Address: Nairobi, Kenya You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at https://www.odpc.go.ke.