1. Scope and applicable privacy laws

Yamjoy Limited processes personal data to operate its customer, merchant, courier and support services. Our privacy programme is designed to comply with the Kenya Data Protection Act, 2019 and, where our activities fall within their scope, applicable privacy laws in Tanzania, Uganda and Rwanda.

The EU General Data Protection Regulation (GDPR) applies only where its territorial scope is met, including where Yamjoy offers goods or services to people in the European Union or monitors their behaviour there. Operating in East Africa alone does not automatically make GDPR applicable.

2. Information we collect

We may collect your name, mobile number, email address, account identifiers, delivery addresses, order history, device and technical information, support communications, fraud and security signals, and payment status or transaction metadata.

When you use location-enabled features, we may process precise or approximate location information needed to set a delivery point, assign or support fulfilment, provide tracking, improve safety, or resolve a delivery issue. We do not need to store your card number to operate Yamjoy when payment credentials are handled by an authorised payment provider.

3. How we use personal data

For restaurant staff management, an authorised restaurant owner may provide employee names, contact and salary receiving numbers, employee identifiers, job and branch details, work schedules, salary terms, payment records, date of birth, sex, profile photographs and next-of-kin contact details. Owners should provide only information needed for staff administration and inform employees and emergency contacts about its use. Employee profile records are available only through authorised restaurant account access; they are not part of the public restaurant listing.

We use these staff records to display employee profiles, calculate configured earnings, maintain payroll accountability and process owner-authorised disbursements. Payment and SMS providers receive the recipient details needed to execute the requested payment or service notification. We do not store plaintext transaction PINs.

We use personal data to create and secure accounts, process and fulfil orders, connect customers with restaurants and couriers, provide delivery tracking, process payments, prevent fraud, communicate service updates, provide support, maintain records, improve reliability and comply with legal obligations.

We process only the data reasonably necessary for a defined purpose and apply access controls according to role.

4. Who we share information with

We may share the information necessary to fulfil an order with the restaurant selected by the customer and the courier assigned to the delivery. We may also use service providers for payments, messaging, hosting, analytics, security, customer support and other operational functions.

We may disclose information to regulators, courts, law-enforcement authorities or other public bodies when required or permitted by applicable law. We do not sell personal data.

5. Payments

Payment services may be provided through Vozua Pay or another payment provider available in the relevant market. Payment providers process payment credentials under their own security and compliance responsibilities. Yamjoy may retain transaction references, amount, status and other payment metadata required for order, accounting, fraud prevention and support.

6. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including order fulfilment, account administration, fraud prevention, support, accounting, dispute handling and legal obligations.

Financial and transaction records may be kept for the period required by applicable tax, accounting or other law. Precise location information is minimised and retained only for as long as needed for fulfilment, safety, support, fraud prevention or a lawful retention requirement. We do not state a fixed retention period unless it reflects our actual operational and legal requirements.

7. Your rights

Depending on applicable law, you may have rights to be informed about processing, access personal data, request correction, object to certain processing, request deletion or restriction, withdraw consent where processing is based on consent, and complain to the relevant supervisory authority.

To exercise a privacy right, contact info@yamjoy.com. We may need to verify your identity before acting on a request.

8. International transfers

Where personal data is transferred across borders, Yamjoy will use safeguards required by applicable law and will assess the protection available in the receiving location or through the receiving service provider.

9. Security

We use reasonable organisational and technical safeguards designed to protect personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction. No internet service can guarantee absolute security.

10. Children and age-restricted products

Yamjoy is not intended to allow children to purchase age-restricted goods. Where a user is below the age at which they can independently enter into a contract in their country, use of the service should be supervised or authorised by a parent or legal guardian where required by law.