Privacy policy
How Loyila collects, uses and protects personal data. Written to comply with the Kenya Data Protection Act, 2019 and its regulations.
This page is a structured scaffold. Each section says what it must cover. Replace every placeholder with reviewed legal text before publishing.
1. Who we are
Identify the data controller: legal name, registration number, registered address, and whether Loyila is registered with the Office of the Data Protection Commissioner (ODPC).
2. What personal data we collect
List each category with examples, for customers and for merchant users separately.
- Account data: name, phone number or email, sign-in credentials. [CONFIRM FIELDS]
- Loyalty activity: programmes joined, visits recorded, stamps, points, rewards, referrals.
- Merchant staff data: name, role, branch, contact details.
- Device and technical data: device type, app version, approximate location if used. [CONFIRM]
- Support messages and lead form submissions from this website.
3. Why we use it
State each purpose in plain language: running loyalty programmes, recording visits, showing rewards, sending campaigns the customer has agreed to, preventing fraud (for example reused QR codes), support, and improving the service.
4. Lawful basis and consent
Explain the basis for each purpose under Section 30 of the Act: consent, performance of a contract, legal obligation, or legitimate interest. Describe how consent is collected in the app, how customers see and change it per merchant, and how they withdraw it.
5. Merchants and their customers
Explain the relationship: each merchant runs its own programme and sees only its own customers. Clarify whether Loyila acts as data processor for merchants, as a joint controller, or as an independent controller, and what the merchant is responsible for.
7. International transfers
Say where data is stored and processed. If any data leaves Kenya, explain the safeguards under Sections 48 and 49 of the Act.
8. How long we keep data
Give retention periods per category and what happens on account closure.
9. Your rights
Under Section 26 of the Act, data subjects can be informed, access their data, object to processing, correct it, and have it deleted. Explain how each right is exercised in the app (export and account closure are built in) and by contacting us, and how long we take to respond.
10. Security
Describe the measures in plain terms: encryption in transit and at rest, access controls, staff roles, and how QR codes are protected against reuse.
11. Children
State the minimum age for a Loyila account and how you handle data from anyone under 18, given Section 33 of the Act.
13. Complaints
Explain how to complain to Loyila first, and that a data subject may also lodge a complaint with the Office of the Data Protection Commissioner, Kenya.
14. Changes to this policy
Say how you will announce changes and how much notice you give for material ones.
15. Contact
Data protection contact: support@loyila.com. Postal address: [SET ADDRESS]. Data Protection Officer, if appointed: [SET DPO].