Privacy Policy

1. Introduction

e-Rugah ("we", "us", "our", or "Company") operates the e-Rugah platform ("Platform"). We are committed to protecting your privacy and ensuring you have a positive experience on our Platform. This Privacy Policy explains our policies and practices concerning the collection, use, and disclosure of personal data when you use our Platform and services.

2. Information We Collect

2.1 Information You Provide Directly

Account Registration Information:

• Full name and date of birth
• Email address and phone number
• Home or business address and location information
• Profile photograph and personal identification documents
• Password and security questions (securely encrypted)

Professional Information (for Chefs and Service Providers):

• Professional certifications and qualifications
• Years of experience and culinary specializations
• Portfolio of past work and service samples
• Service areas and availability schedule
• Pricing information and service offerings
• Bank account details for payment processing
• References and previous employer information

Event and Booking Information:

• Event date, time, location, and type
• Number of guests and dietary preferences
• Menu selections and customization requests
• Special requirements and allergies
• Budget and payment information

Communication Data:

• Messages and chat conversations on the Platform
• Contact form submissions and support inquiries
• Email correspondence and notifications
• Feedback, reviews, and ratings

2.2 Information Collected Automatically

Usage Data:

• Pages visited and features accessed
• Time and duration spent on the Platform
• Clicks, searches, and interactions with content
• Referral sources and exit pages

Device and Technical Information:

• IP address and geographic location
• Browser type and version
• Operating system and device type
• Mobile device identifiers
• Connection speed and Internet service provider

Cookies and Tracking Technologies:

• Session cookies for authentication
• Preference cookies for user settings
• Analytics cookies to understand usage patterns
• Marketing cookies from third-party partners

2.3 Information from Third Parties

• Payment information from M-Pesa payment processor
• Verification data from SMS service provider (Twilio)
• Public information from social media platforms (if linked)
• Reviews and ratings from other Platform users

3. Purpose of Data Collection

We collect and use your information for the following purposes:

• To create and maintain your account
• To process bookings and payments securely
• To connect customers with qualified chefs and service providers
• To send booking confirmations and service notifications
• To provide customer support and resolve disputes
• To customize your Platform experience
• To analyze usage patterns and improve our services
• To detect, prevent, and address fraud and security issues
• To comply with legal and regulatory requirements
• To send promotional emails and marketing communications (with consent)
• To verify identity and professional qualifications
• To facilitate two-factor authentication via SMS

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual Obligation: Processing necessary to perform our services agreement
• Legitimate Interest: Our business interests in improving services and preventing fraud
• Consent: Your explicit consent for marketing and analytics
• Legal Compliance: Requirements under Kenyan and international data protection laws

5. How We Share Your Information

5.1 Service Sharing

We share your information with relevant parties to provide our services:

• Chefs/Service Providers: Your event details and preferences are shared only with the chef providing services
• Customers: Chef profile information and availability are shared with customers seeking services
• Hotel and Restaurant Partners: Information necessary to facilitate partnerships and services

5.2 Payment Processing

Payment information is securely transmitted to:

• M-Pesa: Payment processor authorized to process your transactions
• Financial institutions for transaction settlement

5.3 Communication Services

We share phone numbers with:

• Twilio: For SMS-based account verification and two-factor authentication

5.4 Verification and Compliance

We may share limited information for:

• Identity and credential verification
• Compliance with legal orders and court proceedings
• Fraud investigation and prevention

5.5 Data Aggregation

We may share anonymized and aggregated data for:

Research and analytics

Platform improvement and development

Benchmarking and performance analysis

5.6 No Sale of Personal Data

We do not sell your personal data to third parties for marketing purposes. We only share information necessary to provide our services and as required by law.

6. Data Security

6.1 Security Measures

We implement industry-standard security measures to protect your personal data:

• SSL/TLS encryption for data in transit
• AES-256 encryption for sensitive data at rest
• Secure password hashing using bcrypt or similar algorithms
• Two-factor authentication (2FA) for account access
• Regular security audits and penetration testing
• Access controls limiting data to authorized personnel
• Secure APIs for third-party integrations
• Compliance with OWASP security standards

6.2 Limitations

While we strive to protect your data, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security, and any transmission is at your own risk.

6.3 Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you promptly through email or phone and provide guidance on protective measures.

7. Data Retention

We retain your personal data for as long as necessary to:

• Provide our services and fulfill your requests
• Maintain transaction and payment records
• Comply with legal and regulatory requirements
• Resolve disputes and handle complaints
• Prevent fraud and ensure security

Typically, we retain data for 3-7 years after your account closure or last transaction, unless legally required to retain longer. You may request deletion of your account and data at any time by contacting our support team.

8. Your Privacy Rights

Depending on your location and applicable laws, you may have the following rights:

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Request correction of inaccurate information
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation on how we use your data
• Right to Data Portability: Receive your data in a portable, machine-readable format
• Right to Object: Object to processing of your data for marketing or profiling
• Right to Withdraw Consent: Withdraw consent for any data processing at any time
• Right to Lodge a Complaint: File a complaint with the relevant data protection authority

To exercise any of these rights, please contact us using the information provided in Section 13.

9. Cookies and Tracking Technologies

9.1 Cookie Usage

e-Rugah uses cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for authentication and security
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Help us understand how you use the Platform
• Marketing Cookies: Enable personalized advertising (third-party)

9.2 Cookie Management

Most browsers allow you to refuse cookies or alert you when cookies are being sent. However, refusing cookies may impact Platform functionality. You can manage cookie preferences through your browser settings.

10. Children's Privacy

Our Platform is not intended for children under 18 years old. We do not knowingly collect personal information from minors under 18. If we discover we have collected data from a child, we will delete such information immediately and terminate the account. Parents or guardians who believe their child has provided information should contact us immediately.

11. Third-Party Links and Services

Our Platform may contain links to external websites and services. This Privacy Policy applies only to information collected through e-Rugah. We are not responsible for the privacy practices of third-party websites. We encourage you to review their privacy policies before providing personal information.

12. International Data Transfers

Your personal data may be transferred to, stored in, and processed in countries other than where you reside. These countries may have different data protection laws than your home country. By using the Platform, you consent to such transfers, provided we implement appropriate safeguards including Standard Contractual Clauses and data protection agreements.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on this page
• Sending you an email notification
• Requiring your consent before material changes take effect

The "Last Updated" date indicates when this policy was last revised. Your continued use of the Platform following changes constitutes acceptance of the updated Privacy Policy.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: reply@erugah.vegrid.co.ke
• Phone: +254 720 336730

15. Data Protection Authority

If you have unresolved concerns about our data practices, you may file a complaint with:

• Kenya Data Protection Commissioner (KDPC)
• Website: www.odpc.go.ke