HubCart Privacy Policy

Company: HubCart Ltd.

Registration No.: PVT-KW1995BD

Registration Date: 2 April 2026

Website: www.hub-cart.com

Contact Email: support@hub-cart.com

Last Updated: 3 September 2026

Effective Date: 18 May 2026

1. Introduction

HubCart Ltd. ("HubCart", "we", "us", or "our") operates the HubCart mobile application and web platform (collectively, the "Platform"). We are committed to protecting your personal information and your right to privacy.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. By using our Platform, you agree to the practices described in this Policy.

2. Information We Collect

2.1 Information You Provide Directly

• Identity information: Full name, National ID number, date of birth, gender, district of birth.
• Contact information: Phone number, email address, physical address.
• Account information: Username, password (stored as a one-way hash), profile photo.
• KYC & verification documents: Copies of your National ID, business registration certificates, driving licence, vehicle or motorcycle registration documents, logbook (where available), insurance certificates, and PSV badges.
• Payment information: M-Pesa phone number used for payments. We do not store full M-Pesa PINs or debit/credit card numbers.
• Business information (for suppliers and eateries): Business name, KRA PIN, NHIF/NSSF numbers, cuisine type, operating hours, menu items.
• Vehicle information (for drivers): Vehicle make, model, year, plate number, chassis/VIN number.

2.2 Information Collected Automatically

• Location data: GPS coordinates when you use the Platform, including real-time location for ride and delivery tracking. Approximate location is collected even when the app is in the background for drivers on active rides. Where you grant the app location permission, the coordinate at that moment may also be used to produce aggregate area coverage counts (see section 9.1).
• Device information: Device model, operating system, device ID, app version.
• Usage data: Pages and features accessed, search queries, timestamps, error logs.
• Transaction data: Order history, payment amounts, delivery status, dispute records.

2.3 Information from Third Parties

• M-Pesa (Safaricom): We receive payment confirmation and transaction reference numbers from Safaricom when you complete a payment.
• Push notifications (Google Firebase Cloud Messaging): We use FCM to deliver push notifications to registered devices.
• SMS gateway: We use an SMS provider (including Africa's Talking when configured) to deliver one-time passwords (OTPs) and notifications.
• KYC verification providers: We may use third-party identity verification services (such as Smile Identity or equivalent) to confirm the authenticity of documents you upload.

3. How We Use Your Information

We use your information to:

1. Provide and operate the Platform — process orders, facilitate rides, enable deliveries, and connect buyers and sellers.
2. Identity verification (KYC) — verify your identity and documents to comply with Kenyan financial regulations and prevent fraud.
3. Process payments — initiate and confirm M-Pesa transactions on your behalf.
4. Send communications — deliver OTPs, order updates, receipts, and promotional messages (which you may opt out of).
5. Improve the Platform — analyse usage patterns to fix bugs and develop new features, and measure aggregate service coverage by area so we know where more drivers or sellers are needed (see section 9.1).
6. Legal compliance — comply with the Kenya Data Protection Act 2019, Central Bank of Kenya payment service regulations, and any other applicable law.
7. Fraud prevention and safety — detect suspicious activity, duplicate documents, and account abuse.
8. Dispute resolution — maintain records of transactions and communications to resolve disputes fairly.

4. Legal Bases for Processing (Kenya Data Protection Act 2019)

We process your personal data under the following legal bases:

5. How We Store and Protect Your Information

• Infrastructure: HubCart is operated for the Kenyan market on Google Cloud Platform. Our primary application servers and database are hosted in Google Cloud's africa-south1 region (Johannesburg, South Africa) — the closest available Google Cloud region to Kenya. This means your personal data is stored and processed outside Kenya. Some supporting services (web hosting, push notifications, transactional email) operate from Google and provider data centres in other regions, including the United States. See section 6 for the recipients involved.
• Encryption: Data is encrypted at rest and in transit using industry-standard TLS 1.2+.
• Document hashing: Uploaded identity documents are hashed (SHA-256) so duplicates can be detected without storing document content in plain text across multiple records.
• Access controls: Strict role-based access ensures employees can only access data relevant to their job function.
• Audit logs: All administrative actions, KYC overrides, and critical operations are logged with timestamps and actor identity.
• Co-signer approvals: Critical operations (such as refunds and payment configuration changes) require dual authorisation from two different staff members.

We retain your data for as long as your account is active or as required by Kenyan law (generally 7 years for financial transaction records under the Tax Procedures Act).

6. Sharing Your Information

We do not sell your personal information. We share it only as follows:

All third-party processors are bound by data processing agreements that require them to protect your information.

6.1 Transfers outside Kenya

Because our infrastructure is hosted in Google Cloud's africa-south1 region (South Africa), and because some of the providers above operate from other countries, your personal data is transferred outside Kenya. The jurisdictions currently involved are:

Our mobile application build and code-signing service is provided by a vendor headquartered outside Kenya. That service processes application source code and build files, not your personal data.

Where we transfer your personal data outside Kenya, we do so on the basis that the transfer is necessary to perform our contract with you, and we require each recipient to apply appropriate safeguards through data processing agreements. Our providers are established international processors that operate their own security and data-protection programmes.

If you would like more detail about a specific transfer, contact us at support@hub-cart.com.

6.2 Contact details you choose to publish on a listing

If you advertise an item for sale on the Platform (for example a vehicle), you may choose to publish a contact telephone number, and optionally a contact name, on that listing so interested buyers can call or message you directly.

This is entirely optional and off by default. If you do not turn it on, no contact number appears on your listing, and buyers reach you through the Platform's in-app messaging instead.

Where you do turn it on:

• You choose the number. It is a separate number you enter for the listing. We do not publish the phone number you use to sign in to your account unless you deliberately enter that same number.
• A published number is public. Your listing can be viewed by anyone, including people who are not signed in, so treat a published number as public information. Please do not publish a number you are unwilling to receive unsolicited calls on.
• You can withdraw it at any time by turning the setting off or editing your listing, after which the number is no longer shown. Copies already taken by others, or held in search-engine caches, are outside our control.
• HubCart is not a party to your sale. Any resulting sale, payment, financing, viewing or delivery arrangement is between you and the buyer directly. We publish what you ask us to publish; we do not verify, endorse or guarantee it.
• We do not sell these numbers or use them for marketing, and we do not add them to any mailing or calling list. They appear only on the listing you attached them to.

Legal basis: your consent (section 4). Consent is given per listing and can be withdrawn at any time without affecting the rest of your account.

7. Your Rights

Under the Kenya Data Protection Act 2019, you have the right to:

1. Access — request a copy of the personal data we hold about you.
2. Rectification — request correction of inaccurate or incomplete data.
3. Erasure — request deletion of your personal data (subject to legal retention obligations).
4. Objection — object to processing based on legitimate interests.
5. Portability — receive your data in a structured, commonly used format.
6. Withdraw consent — withdraw consent for marketing communications at any time.

To exercise any of these rights, email us at support@hub-cart.com with "Data Rights Request" in the subject line. We will respond within 21 days.

8. Children's Privacy

Our Platform is intended for users aged 18 and above. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Location Data

We collect precise GPS location data to:

• Display nearby drivers and suppliers to customers.
• Enable real-time tracking of deliveries and rides.
• Calculate distances and estimated arrival times.
• Route drivers and riders efficiently.
• Measure service coverage in an area — see "Coverage analytics" below.

Drivers and riders: Location is collected in the background when you are actively logged in and available for work. You can stop background location collection by going offline in the app.

Customers: Location is only collected during active order tracking. We do not track customers in the background.

9.1 Coverage analytics (aggregate only)

We use location data to understand how many users of each type (customers, drivers, suppliers, eateries, rideshare operators and other roles) are active in a given area, so we can tell where the Platform needs more drivers or more sellers. An area with many sellers and no drivers cannot deliver, and this measurement is how we find and fix that.

For this purpose:

• We use only aggregate counts — for example "1,500 suppliers and 800 drivers within 10 km of a point".
• We do not produce, display or export a map of individual users. No staff screen shows your personal location, name or account alongside these counts.
• The counts are derived from location you have already provided for the purposes above (your shop or branch address, a listing location, a driver GPS position, or a location permission you granted in the app).
• Aggregated coverage figures cannot be traced back to you.

If you do not wish your granted app location to contribute to these aggregate counts, you can decline or revoke the location permission in your device settings; the Platform will continue to work, and features that need a location will ask you for one at the time.

10. Cookies and Analytics

Our web platform uses cookies and similar technologies to:

• Maintain your login session.
• Remember your preferences.
• Analyse platform performance.

You can disable cookies in your browser settings, but some features may not work correctly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-app notification and update the "Last Updated" date at the top. Continued use of the Platform after changes constitutes acceptance of the updated Policy.

12. Contact Us

HubCart Ltd.

Registration No.: PVT-KW1995BD

Website: www.hub-cart.com

Email: support@hub-cart.com

For data protection concerns or complaints, you may also contact the Office of the Data Protection Commissioner of Kenya at www.odpc.go.ke.

© 2026 HubCart Ltd. All rights reserved.