Suluhu Privacy Policy

Suluhu operates a digital marketplace that connects customers seeking services with independent Service Providers.

Depending on the circumstances, Suluhu may act as a data controller because it determines the purposes and means of processing certain personal data. Suluhu may also act as a data processor when processing personal data on behalf of another entity.

The precise role Suluhu performs depends on the particular processing activity.

For purposes of this Privacy Policy, "Platform" means the Suluhu mobile applications, websites, software, systems, APIs, communication channels, and related services.

For purposes of this Privacy Policy:

We collect information necessary to operate Suluhu, facilitate transactions, verify users, protect the Platform, comply with legal obligations, and improve our services.

The information we collect depends on how you use Suluhu.

Suluhu may conduct identity and eligibility verification before allowing a Service Provider to provide services through the Platform.

This may involve collecting and processing:

• National ID or passport information;
• identification photographs;
• business registration documents;
• professional certificates;
• licences;
• Certificate of Good Conduct or similar documentation;
• tax-related information;
• photographs;
• verification results; and
• information obtained from legitimate verification sources.

We use this information to:

• establish the identity of Service Providers;
• confirm eligibility to use the Platform;
• reduce fraud;
• protect Customers and Service Providers;
• comply with legal obligations;
• maintain marketplace trust and safety; and
• investigate complaints or suspected misconduct.

Where verification involves sensitive personal data or information obtained from another source, Suluhu will process that information in accordance with applicable law and applicable legal requirements.

Verification does not constitute a guarantee that a Service Provider is suitable for every job or that a Service Provider will always perform services to a particular standard.

Because Suluhu is a location-based marketplace, location information may be important to the operation of the Platform.

Depending on the features you use and the permissions you grant, we may collect:

• approximate location;
• precise GPS location;
• device location;
• service location;
• Service Provider location;
• location associated with a booking;
• geofence entry or exit information; and
• location information generated during a service.

Location information may be used to:

• identify Service Providers operating within a service area;
• match Customers with suitable Service Providers;
• calculate or estimate travel distance;
• facilitate bookings;
• support scheduled services;
• enable geofencing;
• improve safety;
• investigate disputes;
• prevent fraud;
• verify service attendance;
• provide customer support; and
• improve Platform operations.

Where continuous or background location access is required for a particular feature, Suluhu will seek the appropriate device permission and provide information about the purpose of that processing.

You may control certain location permissions through your device settings. Restricting location access may affect the availability or functionality of certain Suluhu features.

When you use Suluhu to request or provide a service, we may collect information relating to the booking, including:

• service requested;
• service category;
• booking date and time;
• service location;
• Customer instructions;
• Service Provider assigned;
• booking status;
• cancellation information;
• arrival information;
• job commencement information;
• job completion information;
• OTP verification records;
• communications;
• photographs;
• ratings and reviews;
• complaints;
• dispute information; and
• payment and transaction information.

This information enables us to operate and administer the marketplace.

Suluhu may use one-time passwords ("OTPs") or other verification mechanisms to confirm events associated with a booking.

For example, an OTP may be used to verify that:

• a Service Provider has arrived at the correct location;
• a Customer has authorized the commencement of a service;
• a job has reached a particular stage; or
• another transaction event has occurred.

Suluhu may retain records of OTP generation, delivery, verification, timestamps, booking identifiers, and related technical information.

These records may be used to:

• facilitate the service;
• prevent fraud;
• resolve disputes;
• establish an audit trail; and
• protect Customers, Service Providers, and Suluhu.

Suluhu may allow Customers and Service Providers to upload photographs or other content in connection with a service.

For example, photographs may be collected:

• before a service;
• after a service;
• to document property condition;
• to demonstrate work performed;
• to support a complaint;
• to resolve a dispute; or
• for quality assurance.

Users should not upload photographs containing unnecessary personal information belonging to another person.

Suluhu may use uploaded content for the purposes for which it was submitted, including service administration, customer support, dispute resolution, fraud prevention, quality assurance, and enforcement of Platform policies.

Suluhu will not use identifiable customer or Service Provider photographs for unrelated commercial advertising without an appropriate legal basis and, where required, consent.

Suluhu may facilitate payments using supported payment providers and financial institutions.

Depending on the payment method, we may process information such as:

• transaction amount;
• transaction date and time;
• payment status;
• transaction reference;
• payment method;
• mobile telephone number associated with a payment;
• M-PESA transaction information;
• card transaction information;
• payout information;
• refund information; and
• billing information.

Where payment processing is performed by a third-party payment provider, that provider may independently process payment information under its own privacy terms.

Suluhu does not need to retain full card numbers where payment processing can be performed securely by an authorized payment service provider.

Where Service Providers subscribe to paid Suluhu plans, we may process:

• subscription plan;
• subscription status;
• subscription start and expiry dates;
• payment status;
• transaction references;
• renewal information;
• subscription history; and
• account activity associated with the subscription.

This information is used to administer Service Provider subscriptions and determine access to subscription-based Platform features.

When you communicate with Suluhu or another user through the Platform, we may process information relating to those communications.

This may include:

• chat messages;
• support requests;
• emails;
• telephone communications;
• SMS messages;
• system notifications;
• booking-related communications; and
• other communications submitted through the Platform.

We may use this information to:

• facilitate communication;
• provide customer support;
• resolve disputes;
• investigate fraud or abuse;
• improve customer service;
• enforce our policies; and
• maintain records required for legal or operational purposes.

Where legally permitted and appropriately disclosed, certain communications may be recorded or retained for quality assurance, security, dispute resolution, or training purposes.

When you use Suluhu, we may automatically collect technical information such as:

• IP address;
• device type;
• operating system;
• application version;
• browser type;
• device identifiers;
• language;
• time zone;
• network information;
• crash reports;
• performance information;
• login timestamps;
• session information; and
• other diagnostic information.

We use this information to:

• operate the Platform;
• maintain security;
• diagnose technical problems;
• prevent abuse;
• improve performance;
• analyse Platform usage; and
• develop new features.

Suluhu may receive information from third parties where permitted by law.

These third parties may include:

• payment providers;
• identity verification providers;
• communication providers;
• mapping and location providers;
• analytics providers;
• cloud hosting providers;
• fraud prevention providers;
• government or regulatory authorities;
• business partners; and
• other service providers supporting the Platform.

Where we obtain personal data indirectly, we will process it in accordance with applicable law and the purposes for which the information was obtained.

Suluhu may process personal data for the following purposes:

Suluhu will process personal data only where there is a lawful basis for doing so.

Depending on the circumstances, this may include:

Suluhu may send service-related communications necessary to operate your account, including:

• booking confirmations;
• OTPs;
• payment notifications;
• cancellation notifications;
• account security alerts;
• service reminders; and
• important policy updates.

These communications are generally necessary for providing the Platform.

Where we send promotional communications, we will provide an appropriate mechanism for opting out where required by law.

You may continue to receive essential service communications even after opting out of promotional communications.

Suluhu does not sell personal data to third parties.

We may share personal data where necessary to operate the Platform or where permitted or required by law.

Recipients may include:

Some technology and service providers used by Suluhu may process or store personal data outside Kenya.

Where personal data is transferred outside Kenya, Suluhu will take steps required by applicable Kenyan data protection law to ensure that appropriate safeguards are in place or that another lawful basis for the transfer exists.

Where applicable, information about relevant transfer destinations and safeguards will be made available to data subjects.

The Data Protection Act restricts transfers outside Kenya unless adequate safeguards or consent and other applicable legal requirements are satisfied.

Suluhu retains personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

• the type of information;
• the purpose for processing;
• the duration of the user relationship;
• legal requirements;
• accounting and tax obligations;
• dispute resolution;
• fraud prevention;
• security requirements; and
• the establishment, exercise, or defence of legal claims.

When personal data is no longer required, Suluhu may:

• delete it;
• anonymise it;
• pseudonymise it; or
• securely dispose of it.

The Data Protection Act requires retention to be limited to what is reasonably necessary, subject to specified exceptions.

Suluhu takes reasonable technical and organizational measures designed to protect personal data against:

• unauthorized access;
• unauthorized disclosure;
• accidental loss;
• destruction;
• alteration;
• misuse; and
• other unlawful processing.

Depending on the nature of the information and associated risks, measures may include:

• encryption;
• access controls;
• authentication;
• role-based permissions;
• secure communications;
• system monitoring;
• backups;
• security logging;
• vulnerability management;
• staff confidentiality obligations;
• incident response procedures; and
• other appropriate technical and organizational safeguards.

No electronic system is completely secure. Accordingly, Suluhu cannot guarantee that personal data will never be accessed, disclosed, altered, or destroyed through circumstances beyond our reasonable control.

Suluhu maintains procedures for identifying, investigating, containing, and responding to personal data security incidents.

Where a personal data breach occurs, Suluhu will take steps required by applicable law, which may include notifying the Office of the Data Protection Commissioner and affected data subjects where legally required.

Suluhu may also take measures such as:

• restricting access;
• resetting credentials;
• investigating affected systems;
• preserving evidence;
• notifying relevant service providers;
• improving security controls; and
• implementing corrective measures.

Subject to applicable law and any lawful limitations, you have rights in relation to your personal data.

These may include the right to:

To exercise your rights, contact Suluhu using the details provided in Section 31 of this Privacy Policy.

Your request should, where reasonably possible, include:

• your full name;
• registered email address or telephone number;
• the nature of your request;
• sufficient information to identify the relevant personal data; and
• any supporting information reasonably necessary to process the request.

Suluhu may take reasonable steps to verify your identity before fulfilling a request.

This is intended to protect users against unauthorized disclosure or modification of their personal data.

We will respond to requests within the period required by applicable law.

Where we are unable to comply with a request, we will provide an explanation where legally permitted.

Suluhu is intended for individuals who are legally able to enter into contracts and use the Platform.

Suluhu does not knowingly collect personal data from children for independent use of the Platform where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to Suluhu in circumstances where this was not permitted, please contact us.

Where legally required, we may take steps to delete the information.

Our websites and certain Platform features may use cookies and similar technologies.

These technologies may be used to:

• maintain sessions;
• remember preferences;
• improve security;
• analyse website usage;
• improve performance;
• measure marketing effectiveness; and
• improve user experience.

You may be able to control cookies through your browser settings.

Some cookies may be necessary for the website to function and may not be capable of being disabled without affecting functionality.

A separate Cookie Policy may provide additional information where applicable.

Suluhu may integrate with third-party services, including payment providers, mapping services, communication platforms, analytics providers, cloud infrastructure providers, and identity verification services.

Those third parties may process personal data in accordance with their own privacy policies and contractual obligations.

Suluhu does not control the privacy practices of independent third parties.

Users should review the applicable privacy notices of third-party services where appropriate.

The Platform may contain links to websites or services operated by third parties.

Suluhu is not responsible for the privacy practices, security, or content of third-party websites.

You should review the privacy policy of any third-party website before submitting personal information.

Suluhu may use automated systems to assist with certain Platform functions.

These may include:

• matching Customers with Service Providers;
• ranking or displaying Service Providers;
• detecting suspected fraud;
• identifying unusual activity;
• recommending services;
• optimizing service availability; and
• analysing Platform usage.

Where applicable law requires additional information, safeguards, or human review in relation to automated decision-making that significantly affects a data subject, Suluhu will provide the applicable information and mechanisms required by law.

Suluhu may update this Privacy Policy from time to time to reflect:

• changes to the Platform;
• changes to our business;
• changes in technology;
• changes in law;
• changes in regulatory requirements; or
• changes to our data processing practices.

When we make material changes, we may notify users through:

• the Platform;
• email;
• SMS;
• push notifications; or
• another appropriate communication method.

The "Last Updated" date at the beginning of this Privacy Policy indicates when the document was most recently revised.

If you have questions, concerns, complaints, or requests relating to this Privacy Policy or Suluhu's processing of personal data, contact us:

Data Controller: Suluhu On Demand Services Limited

Physical Address: Duldul Business Park Phase III, Mombasa Road, Kenya

Postal Address: P.O BOX 35330, CITY SQUARE

Email: info@suluhu.net

Telephone: +254 707 776 447

Data Protection Officer / Privacy Contact: Data Protection & Privacy Office

Suluhu encourages users to contact us first so that we can investigate and attempt to resolve privacy concerns.

If you believe that your personal data rights have been infringed and you are not satisfied with our response, you may have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) or pursue another remedy available under Kenyan law.

The ODPC is responsible for regulating the processing of personal data and protecting the rights of data subjects in Kenya.

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the Republic of Kenya.

Nothing in this Privacy Policy limits any rights or remedies available to a data subject under applicable law.

This Privacy Policy should be read together with Suluhu's other policies and agreements, including:

• Terms of Service;
• Service Provider Agreement;
• Refund and Cancellation Policy;
• Community Guidelines;
• Acceptable Use Policy; and
• Cookie Policy, where applicable.

Where another Suluhu policy describes a particular processing activity in greater detail, that policy should be read together with this Privacy Policy.