This Privacy Policy explains how R3d Cup Network (“RedCup”, “we”, “us”) collects and uses personal data, and the rights you have. It is written for Kenya’s Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. Users in Switzerland are also protected by the Swiss Federal Act on Data Protection. It applies to customers, movers and merchants.
1. Who is responsible for your data
The data controller is [Registered company name], trading as R3d Cup Network, [postal address, Nairobi, Kenya]. ODPC registration number: [pending]. Data protection contact: info@redcup-network.com.
Each merchant is responsible for how it uses its own customers’ details to fulfil orders (for example a phone number to call you about a delivery).
2. Age: 18 and over only
RedCup is for people aged 18 or older. Under Kenyan law a child is anyone under 18. Everyone confirms they are 18+ when they sign up, and we record when. If we learn that an account belongs to someone under 18, we close it and delete its data.
3. What we collect, why, and our legal basis
| Data | Why | Legal basis |
|---|---|---|
| Name, email, phone, password (stored only as a secure hash), role, profile photo | Your account and signing you in | Contract |
| Orders: items, amounts, delivery address, notes, handover PIN | Placing, preparing, delivering and receipting orders | Contract |
| Payment references and the phone number used for M-Pesa | Taking payment and matching it to your order (we never see your M-Pesa PIN) | Contract; legal obligation (tax records) |
| Chat messages and photos with a business | Talking to the shop about your order | Contract |
| Issue reports and evidence photos | Letting the shop (and, for delivery issues, the mover) resolve a problem | Contract; legitimate interest |
| Customer location (only if you share it) and your area | Showing shops near you | Consent, which you can withdraw in your browser at any time |
| Mover live location (only while online and on a delivery) | Routing, and showing the customer their order on the way | Contract; legitimate interest (safety) |
| Mover ID, vehicle papers and insurance | Verifying movers so deliveries are safe and lawful | Legal obligation; legitimate interest |
| Merchant business details, M-Pesa Till/Paybill | Running the storefront and settling payments | Contract |
| Trust Passport history (completed and disputed exchanges) | Showing reliability to the other side of an exchange | Legitimate interest. See section 7. |
| Device, browser, language, theme | Making the app work on your phone | Legitimate interest |
| Signed-in devices (browser and device type, IP address, sign-in and last-active time) and a security log (sign-ins, failed sign-ins, password changes, consent, data exports) | Protecting your account. You see your own devices and activity in Your devices and can sign other devices out. | Legitimate interest (security) |
| Waitlist: name, phone, optional email, city, role, business name, and when you confirmed 18+ and our Terms | Holding your spot, launch updates, your wallpaper art, and verifying your payment number at onboarding | Consent. Email us any time to be removed. |
| Marketing choice | Sending offers and news, only if you opted in | Consent |
We do not use advertising trackers, analytics cookies or session recording. We never record your screens, taps or keystrokes, and we do not sell personal data.
4. Who receives your data
- The other people on your order. The merchant sees what you ordered and how to reach you. The mover sees the pickup, and your exact address only after pickup.
- Paystack (payment processing) and Safaricom M-Pesa through Paystack: your M-Pesa number and the amount. In Switzerland, TWINT where it is offered.
- Cloudinary, where we use it: storage for photos and documents. Private uploads (chat photos, issue photos, mover documents) are kept as restricted files.
- Our hosting provider: [provider, server country].
- OpenStreetMap tile servers load map images when you open a map, and the OSRM routing service receives the mover’s start and drop-off points to draw a route. Both receive your IP address.
- Push notification services (Google, Apple or Mozilla, depending on your browser) deliver notifications you have allowed.
- Google Maps or WhatsApp, only when you tap “Directions” or “Share”. Their own privacy policies apply.
- Authorities, where Kenyan law requires it.
Fonts, icons and map code are served from our own servers, so loading the app does not send your IP address to Google or other font or script hosts.
5. Transfers outside Kenya
Some providers above, and our servers, are outside Kenya. We only transfer data where the Data Protection Act allows it: with appropriate safeguards (contract terms with the provider), and only what is needed for the purpose.
6. How long we keep data
- Account and profile: while your account is open. You can delete it at any time in the app.
- Orders, payments and receipts: 5 years, because Kenyan tax law requires business records to be kept. After you delete your account they are kept without your contact details.
- Mover live location: cleared from the order once the delivery is confirmed.
- Chat messages and photos: while the conversation’s accounts exist. Deleted with your account.
- Mover documents: while you are an active mover, then for up to 12 months unless the law requires longer.
- Issue reports: up to 2 years after the case closes.
- Security log and signed-in devices: 90 days, then deleted automatically.
- Waitlist entries: until you join at launch (they then become your account), you ask to be removed, or 12 months, whichever comes first.
7. Trust Passport and automated decisions
Your Trust Passport summarises completed and disputed exchanges. It never automatically suspends an account or decides an issue. A shop resolves issues with its customer directly. You can object to this processing and ask us to review your history (DPA s.35).
8. Your rights
Under the Data Protection Act (ss.26, 31, 34–40) you can:
- Be informed about how we use your data (this policy).
- Access and take a copy: use Download my data in your profile, or email us.
- Correct your details in your profile, or ask us.
- Delete your account in the app (Delete account), or ask us.
- Object to processing based on legitimate interest, and withdraw consent (location, marketing) at any time.
- Stop marketing: turn off Offers & news in your profile, or reply STOP to any marketing SMS.
We answer requests within the time limits of the Data Protection (General) Regulations, 2021 (for example within 7 days for an access request). If you are not satisfied, you can complain to the Office of the Data Protection Commissioner (ODPC), www.odpc.go.ke.
9. Security and breaches
We use encrypted connections, hashed passwords, private storage for sensitive uploads, and per-role access. If a breach is likely to put your rights at risk, we notify the ODPC within 72 hours of becoming aware of it, and tell affected users without undue delay, as the Act requires (s.43).
10. Cookies and local storage
We use only what is strictly necessary for the service to work. There are no analytics, advertising or tracking cookies, so there is nothing to consent to here. Your agreement to these terms is kept on your account, not in a cookie, so it follows you on every device.
| Name | What it does | How long |
|---|---|---|
sessionid (cookie) | Keeps you signed in | Until you sign out, or 2 weeks |
csrftoken (cookie) | Protects forms against forgery | 1 year |
rc_admin_session (cookie) | RedCup staff only: the admin sign-in | Until sign-out, or 2 weeks |
cx-theme (on your phone) | Your chosen theme | Until you change or clear it |
rc_geo (on your phone) | Your shared location, to show nearby shops. Only if you shared it. | Until you clear it |
pushAsked (on your phone) | Remembers that we already offered notifications | Until you clear it |
| Skipped offers (movers, on your phone) | Hides offers you skipped this session | Until the tab closes |
| Offline copy (service worker) | Lets the app open quickly and offline | Until you clear site data |
You can clear all of this at any time in your browser settings. You will then need to sign in again.
11. Changes
When we change this policy we update the date above. If a change is significant, we ask you to confirm the new version in the app.
12. Contact
Privacy questions or requests: info@redcup-network.com.
See also our Terms & Conditions.