DukaPro Technologies Ltd is a registered Data Controller with the Office of the Data Protection Commissioner of Kenya. This page explains how we meet our obligations under the Data Protection Act, 2019.
Our Data Protection Officer
You can reach our DPO at dpo@dukapro.co.ke or at our Riverside Drive office in Nairobi.
Lawful basis for processing
- Performance of the contract you sign when subscribing.
- Legitimate interest in improving the Service reliably.
- Consent, where required by law (e.g. marketing communications).
Your rights
- Right of access — request a copy of your personal data.
- Right to rectification — correct inaccurate data.
- Right to erasure — request deletion, subject to legal retention.
- Right to portability — receive your data in a structured format.
- Right to object — withdraw consent where processing is based on it.
Data breaches
In the unlikely event of a personal data breach, we will notify the ODPC within 72 hours and affected users without undue delay.
Cross-border transfers
Primary storage remains in Kenya. Off-site encrypted backups are held in a secure facility in Frankfurt, Germany — an adequate jurisdiction under the Act.