Introduction and scope
Juggernaut Prime Company respects your privacy and is committed to protecting personal data in line with the Data Protection Act, 2019 of Kenya. This policy explains how we collect, use, share and protect personal data where we act as a data controller: for example, data about people interested in MyDuka, registered business accounts ("Customers") and the people they give access to ("Authorised Users").
It does not cover the personal data we process on behalf of a Customer as a data processor, such as sales records and the details of the Customer's own customers and suppliers. We process that data only to provide MyDuka to the Customer and on the Customer's instructions, as set out in our Terms of use, and the Customer's own privacy notice applies to it.
Who we are
Juggernaut Prime Company is the company in Kenya that builds and runs MyDuka, a point-of-sale and back-office service for shops, bars, restaurants and hotels. For questions about this policy or to exercise your rights, contact us at help@myduka.store or on WhatsApp at +254 115 082 806.
Personal data we collect
Account and registration data: business name, contact name, phone number, email address, location (county and town) and KRA PIN, provided when a Customer registers or sets up the account.
Sign-in data: either a password, kept only in a one-way scrambled form so nobody can read it, or the name and email of the Google account you choose to sign in with. We never see your Google password.
Authorised User data: names, roles, the branches or outlets they work at, contact details and sign-in details of staff a Customer adds. Till PINs are kept only in a scrambled form.
M-Pesa details: if a Customer connects M-Pesa, the Safaricom keys and passkey are stored encrypted and used only to ask Safaricom to charge that Customer's customers.
Billing data: when a Customer pays for a plan, invoicing details and payment confirmations. We do not store card numbers or M-Pesa PINs; those are handled by the payment provider.
Support and communications data: messages, emails and calls with our team.
Usage data: technical logs of what was requested, when, from which account and whether it worked (never passwords, PINs or keys), and the device and browser used.
How we collect personal data
Directly from you when you register, set up your business or use MyDuka; from Google if you choose to sign in with Google; from Safaricom when it confirms M-Pesa payments; and automatically from your use of our website and the MyDuka app.
How we use personal data
To provide, maintain and support MyDuka; sign you in and keep your account secure; process billing and payments; match M-Pesa payments to sales; communicate with you about the service, including service and security notices; improve MyDuka, using aggregated or anonymised data where possible; comply with our legal obligations, including to the Kenya Revenue Authority and the Office of the Data Protection Commissioner; and, where you have agreed, send you news about our products. We do not use your data, or your customers' data, for advertising.
Legal basis for processing
We process personal data because it is necessary to perform our contract with you, to comply with a legal obligation, on the basis of your consent (for example, for marketing messages), or where necessary for our legitimate interests in running and improving MyDuka, provided this does not override your own rights and interests.
Sharing and disclosure
We share personal data only with: service providers who run parts of MyDuka for us, namely Microsoft Azure (hosting), Resend (delivering our emails) and Google (only if you sign in with Google); Safaricom, to process M-Pesa payments you start; professional advisers such as auditors and lawyers; the Kenya Revenue Authority and other regulators where the law requires it; and a successor company if MyDuka is merged, acquired or sold. We do not sell personal data.
Within a Customer's business, only the people the Customer gives access to can see its data, limited by their role and by the branches or outlets they work at.
Cross-border data transfers
Our servers are in Microsoft Azure's South Africa region, which is outside Kenya. Where personal data is stored or transferred outside Kenya, we take steps to make sure it is protected to the standard the Data Protection Act, 2019 requires. Devices you sign in on also keep a working copy of your business data, so tills can keep selling when the internet drops.
Data retention
We keep personal data for as long as needed to provide MyDuka and for the purposes in this policy, including our legal, tax and accounting obligations under Kenyan law. Technical logs are deleted after 30 days. When a business account is closed we keep its records for 90 days so they can be recovered, then delete or anonymise them, except records the law requires us to keep.
Your rights
Under the Data Protection Act, 2019 you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data deleted, subject to our legal duties to keep some records; object to or restrict certain processing; receive a copy of your data in a portable format (business owners can also export their data from Settings); withdraw consent where processing is based on consent, without affecting what was done before; and complain to the Office of the Data Protection Commissioner if you believe your rights have been infringed. To exercise these rights, contact us at help@myduka.store. Staff of a business can also ask the Owner, who controls the business's records.
Security
We use technical and organisational measures to protect personal data against unauthorised access, change, disclosure or destruction, including role-based access controls, encryption in transit, scrambled passwords and PINs, encrypted M-Pesa keys, a log of every change, and confidentiality duties for our staff. No system is completely secure, so please also protect your own sign-in details, PINs and devices.
Cookies
MyDuka uses only the cookies it needs to work: to keep you signed in and to remember which device is a paired till. We do not use advertising or tracking cookies. Our public pages load their fonts from Google Fonts. You can clear cookies in your browser at any time, but clearing them on a till un-pairs it and signs you out.
Children's data
MyDuka is for businesses and their staff and is not directed at children. We do not knowingly collect personal data from children through our own registration or marketing.
Changes to this policy
We may update this policy from time to time. We will tell business Owners about significant changes by email or in MyDuka, and update the date at the top of this page.
Contact us
Juggernaut Prime Company. Email: help@myduka.store. WhatsApp: +254 115 082 806.
Office of the Data Protection Commissioner, Kenya: www.odpc.go.ke
See also the Terms of use.