Privacy Policy
What we collect, why, who sees it, and your rights.
1. Who is responsible for your data
ZangCash Pay Ltd, Nairobi Garage, Westlands, Nairobi, Kenya, is the data controller for personal data on zangcash.com and in our portals. We follow the Data Protection Act, 2019 and its regulations. Contact us about your data at support@zangcash.com.
2. What we collect
- Account data: your name, mobile number, county and sub-county, and a hashed password (we cannot read your password). We do not ask for your email address.
- Request data: the service you ask for, the details you give (for example budget, dates, area), how and when you want to be contacted, and your short note.
- Points and payout data: points earned, ratings given to your requests, redemptions, and the M-Pesa number we pay (your verified phone number).
- Ratings you give: your star rating, tags and comment about a business.
- Support messages you send us.
- Technical data: your IP address, browser type, the time you sign in, security events, and a count of visits to our website. We keep a log of SMS codes we send (without the code itself).
- Consent records: when you accepted our Terms and Privacy Policy, with the version and your IP address.
- Referral data: if you arrive through an agent’s link or poster, we record which agent referred you.
Businesses and agents give additional information when they register (for example business documents, licence numbers, and payout details). It is used to verify them and to pay them.
3. Why we use your data
| Purpose | Basis |
|---|---|
| Create and secure your account; send SMS codes | Performing our contract with you; legitimate interest in security |
| Match your request with a business and pass your details to that business | Performing our contract; your consent when you send a request |
| Calculate points, pay redemptions and agent earnings | Performing our contract; legal obligations (tax and accounting) |
| Prevent fraud, duplicate and fake requests, and misuse | Legitimate interest; legal obligations |
| Support, complaints and improving the Service | Legitimate interest; performing our contract |
We do not sell your personal data. We do not use it for advertising profiles.
4. Who we share it with
- The one business that takes your request. It receives your name, phone number, county, your request details, your contact choice and best time, and your trust score band (Low, Medium or High). It may use them only to respond to your request.
- The agent who referred you sees limited information, such as that you joined through them and how many of your requests were completed, so they can be credited. They do not see your phone number or request details.
- Service providers that help us run ZangCash: our SMS provider (to deliver codes), Safaricom M-Pesa (to pay you or receive business top-ups), and our hosting provider. They may process data only to provide their service to us.
- Authorities where the law requires, or to protect rights and safety, for example to prevent fraud.
5. Cookies and similar technologies
- Essential cookies keep you signed in and protect forms from attack (session and security). The site cannot work without them.
- Referral cookie (30 days) remembers which agent’s link you used.
- Visit counts. We record a simple first-party count of visits (a shortened, hashed connection identifier, the page and where you came from) to understand how the site is used. We do not use advertising or cross-site tracking cookies.
- Your browser stores a small note that you saw our cookie notice.
6. How long we keep data
We keep your account and request history while your account is active and as long as needed for the purposes above. We keep payment, payout and tax records for as long as the law requires. When you delete your account, we remove your name, phone number and other personal details and keep only anonymised or legally required records. Security logs and visit counts are kept for a limited period.
7. How we protect your data
We use encrypted connections (HTTPS), hashed passwords, SMS verification, limits on login attempts, restricted staff access, and an audit trail of administrator actions. No system is perfectly secure. If a personal data breach puts your rights at risk, we will tell the Data Commissioner within 72 hours as the law requires, and tell you where the law requires.
8. Your rights
Under the Data Protection Act, 2019 you have the right to be informed about how we use your data, to access it, to object to its processing, to ask us to correct inaccurate data, to ask us to delete it, and to receive your data in a usable format. You may also withdraw your consent at any time (which does not affect past processing).
- See and download your data: My account → Download my data.
- Correct your details: My account → Profile and Phone number.
- Delete your data: My account → Delete my account.
- Anything else: email us at support@zangcash.com and we will answer within the time the law allows.
If you are not happy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).
9. Transfers outside Kenya
Some of our service providers may store or process data outside Kenya. Where that happens we will make sure the transfer meets the Data Protection Act, 2019 (including its rules on safeguards and, where required, consent) before personal data leaves Kenya.
10. Children
ZangCash is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.
11. Changes
We may update this policy. We will post the new version here with a new date and, for important changes, tell you in the portal.