Data protection notice

This notice sits alongside the Privacy policy and explains how Skyhat operates as a data controller under the Kenya Data Protection Act, 2019 (the Act) and the Data Protection (General) Regulations, 2021.

1. Our role

Skyhat is the data controller for the personal data described in our Privacy policy. Where a vendor shop processes your order data for its own purposes, that shop is a separate controller and its own practices apply to that data. Where we process data on a vendor's instruction inside the vendor workspace, we act as a data processor under contract.

2. Data protection principles we apply

Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Personal data is collected for the specific purposes published in the Privacy policy and is not further processed in an incompatible way.

3. Lawful bases and sensitive data

We rely on contract, legitimate interest, consent, and legal obligation. We do not ask for sensitive data (health, biometrics, religion, or similar) from shoppers or vendors. If a shop legitimately holds such data about its own staff, that is the shop's responsibility under the Act.

4. Data subject rights

Access, rectification, erasure, restriction of processing, objection, and data portability. Requests to [email protected] are answered within thirty (30) days. We may ask for proof of identity before releasing data, and we will explain any refusal.

5. Processors and sub-processors

We engage processors for hosting, database, communications, mapping, and payment services. Each is under written confidentiality and security obligations. A current list of the main categories (hosting, email/SMS, WhatsApp Business, payment gateway, analytics) is available on request.

6. International transfers

Transfers outside Kenya rely on adequate safeguards, including standard contractual clauses, and we transfer only what a service needs to do its job.

7. Retention and deletion

Retention periods are set in the Privacy policy. Records are deleted or anonymised when the purpose and legal duty both end. Backups are purged on a rolling schedule, so deletion from live systems may take a short period to reach backups.

8. Security and breaches

We use role-based access, encrypted transport, and audit logging on admin actions. If a personal data breach occurs that is likely to risk your rights and freedoms, we will notify the ODPC within seventy-two (72) hours of becoming aware of it and notify affected users where required.

9. Complaints

Start with us at [email protected]; we will investigate and reply. If you remain unhappy, you can complain to the Office of the Data Protection Commissioner of Kenya, Lower Kabete Road, Nairobi (www.odpc.go.ke).

10. Marketing and WhatsApp

Optional order and quotation reminders are sent to the phone number you give us. Reply STOP, use the app setting, or email us to opt out; transactional messages about an order you placed still apply.

Questions: [email protected] · 0712010020 / 0181675744 (Kenya).