Privacy Policy
What we collect when you order, why, who sees it, and your rights under Kenya's Data Protection Act, 2019.
Last updated 1 November 2026
Who we are
Pilau Depot ("we", "us") sells pilau from street carts in Nairobi and delivers it to offices and homes. For the personal data described here we are the data controller under the Data Protection Act, 2019 (the "Act") and the Data Protection (General) Regulations, 2021.
You can reach us about anything in this policy at:
- WhatsApp or call: 0782 887844
- Post: Pilau Depot, Nairobi, Kenya
What we collect
We collect only what we need to take, deliver and get paid for your order:
- Order details: your name, M-PESA phone number, delivery area, building, floor and office, delivery day and slot, the items you order and any note you add.
- Payment details: the M-PESA transaction result Safaricom sends us (amount, receipt number, time and the paying number). We never see or store your M-PESA PIN.
- Messages: what you send us on WhatsApp or by phone, including office pre-order and catering requests.
- Technical data: your IP address and basic request logs, which our hosting provider keeps briefly for security and to stop abuse, such as repeated payment prompts.
We don't ask for sensitive personal data such as health, religion or ethnicity. If you mention an allergy in an order note, we use it only to prepare that order.
Why we use it, and on what basis
- To fulfil your order: preparing, labelling and delivering it, texting you a confirmation once it's paid, and contacting you about it. The lawful basis is performance of a contract with you (section 30 of the Act).
- To take payment and keep records: sending the M-PESA request, matching payments and keeping accounting records, as tax law requires. The bases are contract and compliance with a legal obligation (section 30).
- To run and protect the service: preventing fraud and abuse, fixing faults and improving our service. The basis is our legitimate interests (section 30), balanced against your rights.
- Marketing: we send offers on WhatsApp or SMS only if you have opted in. You can opt out at any time by replying STOP or telling us. The basis is your consent, together with the direct-marketing rules in section 37 of the Act.
Transfers outside Kenya
Our hosting provider and WhatsApp store data on servers outside Kenya (for example in the European Union). We use these providers because they have appropriate safeguards for personal data, in line with sections 48 to 50 of the Act and Part VI of the General Regulations. You can ask us for details of these safeguards.
How long we keep it
- Order and payment records: up to 7 years, to meet tax and accounting obligations.
- Delivery addresses and order notes: deleted or anonymised 12 months after your last order.
- Server request logs: up to 90 days.
- Marketing consent: until you withdraw it.
How we protect it
The website uses HTTPS. The order database sits behind encrypted connections, the admin area is password-protected, and only the team members who need order data can see it. If a breach puts your rights at risk, we will tell the Office of the Data Protection Commissioner within 72 hours, as section 43 of the Act requires, and tell you when the law says we must.
Your rights
Under section 26 and Part IV of the Act you have the right to:
- be told how we use your data (this policy);
- get a copy of the data we hold about you;
- have wrong or misleading data corrected;
- have data deleted when we no longer need it or have no lawful basis for it;
- object to processing, including any direct marketing;
- restrict processing while a complaint is looked into;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing.
Send a request to the contacts above. We may ask you to confirm your identity, and we will reply within the time limits the Act and the General Regulations set.
Children
Our ordering service is meant for adults. We don't knowingly collect data from anyone under 18 without a parent's or guardian's consent, in line with section 33 of the Act. If you think a child has given us their data, contact us and we will delete it.
Complaints
If you're unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
Changes to this policy
We will update this page when our practices change, and the date at the top will show the latest version. If a change is significant, we will say so on the site or in our messages to you. Our Terms of Use cover ordering and payment.