SmartDrop Privacy Notice

4.1 Identity Information

• Full names.
• Username.
• Business contact information.
• Account identifiers.
• Customer reference numbers.

4.2 Contact Information

• Mobile telephone numbers.
• Email addresses.
• Delivery and collection contact details.

4.3 Parcel and Transaction Information

• Parcel reference numbers.
• Sender information.
• Recipient information.
• Merchant information.
• Courier information.
• Delivery instructions.
• Locker size selections.
• Locker location details.
• Collection and deposit timestamps.
• Delivery status records.

4.4 Authentication Information

• One-Time Passwords (OTPs).
• Access codes.
• QR codes.
• Login credentials.
• Authentication logs.

4.5 Payment Information

SmartDrop does not store full payment card numbers unless expressly permitted by law and processed through compliant payment providers.

• M-Pesa transaction references.
• Payment amounts.
• Billing information.
• Payment confirmations.
• Transaction dates.

4.6 Device and Technical Information

• IP addresses.
• Device identifiers.
• Browser information.
• Operating system information.
• Application version information.
• Usage records.
• Network information.
• Error logs.

4.7 Location Information

Where permitted by law or authorized by the user:

• GPS location information.
• Locker location data.
• Delivery location information.

4.8 Security Information

• Login history.
• Access logs.
• Session records.
• Administrative activity logs.
• Security audit records.
• CCTV footage.
• Access control records.

4.9 Customer Support Information

• Support tickets.
• Correspondence.
• Feedback submissions.
• Complaint records.

7.1 Service Providers

Including cloud hosting providers, technology vendors, SMS providers, email service providers, infrastructure providers and analytics providers.

7.2 Logistics Partners

Where necessary to facilitate delivery, collection, returns and customer support.

7.3 Merchants and Business Customers

To manage transactions, deliveries, returns, customer inquiries and disputes.

7.4 Payment Service Providers

Including mobile money operators, payment gateways and financial institutions.

7.5 Professional Advisers

Including lawyers, auditors, insurers and consultants.

7.6 Regulatory Authorities

Where disclosure is required by law, court order, regulatory direction or law enforcement request.

11.1 Scope of Profile Data

For purposes of this Policy, "Profile Data" means personal and account-related information associated with your use of our platform, including:

• Identity and Contact Information: Full name, email address, telephone number, username and profile photograph.
• Authentication and Device Information: Hashed passwords, authentication tokens, device identifiers, session information and push-notification settings.
• Account Preferences and Usage History: Saved delivery or collection locations, communication and marketing preferences, browsing activity and non-transactional smart shelf interaction history.
• Technical Information: Application activity, usage telemetry and technical diagnostics associated with your account.

Transaction records, payment information, customer support records, security logs and CCTV footage are subject to separate retention requirements as outlined below.

11.2 Account Deletion and Right to Erasure

You may request deletion of your account and erasure of your personal data at any time, free of charge, through the "Delete Account" feature in our application or by submitting a written request to our Data Protection Officer at privacy@smartdrop.africa.

We will assess and process deletion requests within the applicable statutory timelines. For security purposes, we may verify your identity before acting on a request.

Upon verification and approval of your request:

a. Your account will be immediately deactivated, login access revoked and marketing communications discontinued.

b. Profile Data will be deleted from active operational systems within fourteen (14) days, where deletion is legally permissible and operationally practicable.

c. Relevant third-party service providers processing your personal data on our behalf will be instructed to delete the information where applicable.

d. Residual copies held in encrypted disaster-recovery backups will be isolated from ordinary use and permanently overwritten within thirty (30) to sixty (60) days, in accordance with our backup rotation procedures.

Where certain information must be retained to fulfil a legal obligation, complete an outstanding transaction or establish, exercise or defend a legal claim, we will retain only the information necessary for that purpose and restrict its further processing. Account deletion will not be made conditional solely on the existence of an outstanding balance or unresolved transaction.

We will respond to deletion requests within fourteen (14) days of receipt. Where applicable, requests subject to additional data protection requirements in other jurisdictions will be handled within the relevant statutory response periods.

11.3 Retention of Personal Data for Legal and Operational Purposes

Account deletion does not require the immediate destruction of records that we are legally required or otherwise lawfully entitled to retain. Such information will be stored securely, with access restricted to authorised personnel and use limited to the purpose justifying its retention.

The following retention periods will generally apply:

The above periods are subject to the following conditions:

a. Transaction and tax records may be retained beyond the stated periods where required by an ongoing tax assessment, investigation or legal proceeding.

b. Customer support and dispute records may be retained for longer where a complaint, dispute or legal claim remains unresolved.

c. Security logs and CCTV footage may be preserved beyond their standard retention periods where required for an active investigation, security incident, regulatory inquiry or legal proceeding.

d. Where applicable, additional statutory retention requirements, including those relating to anti-money laundering obligations, will take precedence.

We will retain only the minimum personal data necessary for each applicable purpose and will not use retained records for unrelated commercial or marketing activities.

11.4 Security and Restriction of Retained Data

Personal data retained following account deletion will be segregated from active operational systems, where reasonably practicable, and protected through appropriate technical and organisational safeguards.

Access will be limited to authorised personnel who require the information for legitimate legal, regulatory, security or claims-related purposes. Retained information will not be used for marketing, profiling or unrelated business activities.

Personal data held in encrypted backups will be inaccessible for ordinary business operations. Where a backup is restored, applicable deletion instructions will be reapplied to prevent previously deleted information from being reintroduced into active systems.

11.5 Secure Disposal and Anonymisation

Upon expiry of the applicable retention period, or when the legal or legitimate purpose for retaining the information ceases to exist, we will securely delete, destroy, overwrite or irreversibly anonymise the relevant personal data.

Anonymised information that can no longer reasonably be used to identify an individual may be retained for statistical analysis, reporting, research and service improvement.

We may retain a minimal audit record of completed deletion requests solely to demonstrate compliance with our data protection obligations. Such records will contain no unnecessary copies of deleted personal data and will be subject to an appropriate retention period.