Privacy Policy

ParcelMtandao ("we", "us") respects your privacy and operates within the framework of the Kenya Data Protection Act, 2019. This policy explains what we collect, why, who we share it with, and the rights you have over your data.

What we collect

• Identity: first & last name, phone number, email address.
• Address: sender pickup address (if provided) and recipient delivery address.
• Shipment details: parcel description, declared value, weight, dimensions.
• Account: for registered customers — login credentials (hashed), profile preferences.
• Operational: tracking events (drop-off, scans at each hub, delivery confirmation).
• Technical: IP address, browser type, session cookies (for login persistence only — no cross-site tracking).

Why we collect it

• To accept, route, and deliver your parcel.
• To send SMS and email status updates to senders and recipients.
• To enable tracking and account self-service.
• To prevent fraud and meet our legal obligations (KRA tax records, AML rules).
• To improve our service via aggregated, anonymised analytics.

Who we share it with

• Recipient: the recipient sees the sender's name and tracking details so they can verify the parcel is theirs.
• Sender: the sender sees the recipient's name and delivery progress.
• SMS providers: phone numbers and short message text — solely to deliver the SMS notifications you've asked us to send.
• Email / SMTP providers: email addresses and message bodies — solely to deliver the email notifications.
• Partner saccos & couriers: when a parcel transits a sacco partner office, their staff scan the barcode and see the shipment number, route, and recipient name.
• Law enforcement: only on receipt of a valid court order or written request under Kenya's lawful intercept rules.

We do not sell personal data, ever. We do not share data with advertisers.

How long we keep it

• Shipment records: 7 years (KRA tax record requirement).
• Tracking log: 7 years (alongside the shipment record).
• Account data: until you delete your account, plus 30 days for backup retention.
• Outbound SMS log: 2 years (for cost reconciliation with the SMS provider).
• Server access logs: 90 days.

Your rights under the Data Protection Act, 2019

• Access: request a copy of the data we hold about you.
• Correction: ask us to fix anything inaccurate.
• Deletion: ask us to delete your account and personal data, subject to legal retention rules.
• Objection: object to processing for marketing (we don't market by default, but if we ever did, you can opt out).
• Portability: request your data in a portable format.
• Lodge a complaint: with the Office of the Data Protection Commissioner (odpc.go.ke) at any time.

Cookies

We use a single session cookie (pcm_session) to keep you signed in while you browse. We do not use third-party advertising cookies, fingerprinting, or cross-site tracking.

Contact our Data Protection Officer

Email dpo@parcelmtandao.com with any data-related request. We respond within 7 working days as required by the Act.