Griot Privacy Policy

This Privacy Policy explains how Griot Data Technologies Limited (“Griot Data”, “we”, “us”) collects, uses, discloses, and protects personal data in connection with the Griot Duka mobile application (“the App”). Griot Data is the data controller for the purposes of the Kenya Data Protection Act, 2019.

1. Scope

This Policy applies to merchants who register for and use the App. It does not apply to third-party services that we reference but do not operate.

2. Data we collect

We collect the following categories of personal data:

• Account data. Your mobile telephone number and shop name, provided at registration. The telephone number is verified by a one-time SMS code and identifies your account.
• Location data. If you grant permission, the location of your shop, collected once at registration. Provision of location is optional.
• Business records. Products, stock levels, sale prices, sales, customer credit records (deni) including a customer name and an optional free-text note, expenses, and payment records that you enter or that the App records.
• M-Pesa confirmation data.Where you enable it, the App reads M-Pesa “received” payment confirmations shown by your device and extracts the payment amount and reference. The App does not read the sender’s name, does not access your SMS inbox, and disregards all other notifications.

3. How we use your data, and legal basis

We use your data to:

• create and administer your account and enable sign-in on a new device (legal basis: performance of a contract);
• provide the App’s functions, including recording sales, stock, credit, and expenses, and matching M-Pesa payments to sales (performance of a contract);
• back up your records to the cloud where you enable backup (performance of a contract);
• produce aggregated market insights as described in Section 4 (legal basis: your consent, which you may withdraw at any time).

4. Market insights

The App is provided free of charge. Griot Data produces aggregated market insights for manufacturers, brands, distributors, and other suppliers.

1. Insights are derived from sales activity, namely products, quantities, prices, general area, and dates.
2. Insights are aggregated across multiple shops and are subject to differential-privacy techniques, such that no individual shop, merchant, or person is identifiable.
3. We do not sell your personal data. We do not sell or disclose your shop’s precise location. Location is used only in aggregated, de-identified form to indicate area-level trends.
4. Your account data, and your customers’ names and notes, are excluded from Insights. Data extracted from M-Pesa confirmations is used only to match payments to sales and is excluded from Insights.
5. You may withdraw consent to the use of your data for Insights at any time in the App’s Settings, without affecting your continued use of the App.

5. Disclosure and sharing

We disclose personal data only as follows:

• to Google Firebase, which stores and processes cloud backups on our behalf as a data processor;
• where required by law, legal process, or to establish or defend legal claims;
• to a successor entity in the event of a merger, acquisition, or sale of assets, subject to this Policy.

We do not otherwise sell or share your personal data with third parties for their own purposes. The market insights described in Section 4 are aggregated and de-identified and do not constitute personal data.

6. Data security

Personal data is stored on your device as an append-only, cryptographically signed record. Where cloud backup is enabled, records are transmitted to Google Firebase over an encrypted (HTTPS) connection. Your shop name, telephone number, and your customers’ names and notes are encrypted on your device, using Griot Data’s public key, before transmission, and can be decrypted only by Griot Data.

7. International transfers

Cloud infrastructure provided by Google may store data on servers located outside Kenya. Where personal data is transferred outside Kenya, we take steps to ensure an appropriate level of protection as required by the Kenya Data Protection Act, 2019.

8. Data retention

We retain your personal data for as long as your account remains active. Following a valid deletion request, we delete your personal data and cloud backup within thirty (30) days, except where retention is required by law. Insights already produced in aggregated and de-identified form do not identify you and are not affected.

9. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to access, correct, and delete your personal data, to object to or restrict its processing, to data portability, and to withdraw consent. To exercise these rights, contact us using the details in Section 12.

10. Account and data deletion

You may delete your account and associated data at any time:

• in the App, through Settings, using “Delete account”; or
• without reinstalling the App, by submitting a request at https://griot.cloud/delete-account.

Deletion removes your account, your on-device records, and your cloud backup, subject to the retention exceptions in Section 8.

11. Children

The App is intended for business use by shop operators and is not directed to children.

12. Changes and contact

We may update this Policy from time to time and will revise the effective date above. Where appropriate, we will notify material changes in the App.

Data controller: Griot Data Technologies Limited, Nairobi, Kenya.

Contact: brackly@griotdata.com