Privacy Policy
Carata Limited (Kenya)
Effective Date: 12 August 2026
Last Updated: 7 August 2026
INTRODUCTION
This Privacy Policy (“Policy”) sets out how Carata Limited (“Carata”, “we”, “us”, or “our”), a company incorporated and operating in Kenya, collects, processes, uses, stores, discloses, and protects personal data in connection with its technology platform and related services.
Carata operates a technology platform that facilitates connections between Customers, Businesses (including shops, restaurants, grocers, pharmacies, and other participating merchants), and Delivery Partners/Riders for the fulfilment of food, grocery, retail, prescribed-medicine, and errand deliveries through Carata and Carata App (collectively, the “Platform”).
This Policy is issued in accordance with the Data Protection Act, 2019 (No. 24 of 2019) and the Data Protection (General) Regulations, 2021, together with any other applicable data protection and privacy laws and regulations of Kenya. It explains the manner in which Carata handles personal data and sets out the rights of data subjects, the purposes for which personal data is processed, and the measures adopted by Carata to safeguard such data.
This Policy applies to personal data processed by Carata in connection with the use of the Platform, its websites, applications, products, services, and other interactions with Carata. It should be read together with Carata’s Business Terms & Conditions and Customer Terms & Conditions, which govern the respective use of the Platform and the provision of Carata’s services.
By using the Platform or otherwise providing personal data to Carata, you acknowledge that you have read and understood this Policy and that your personal data will be processed in accordance with its provisions and applicable law.
Where Carata processes personal data on behalf of another party, the processing may also be governed by the terms and instructions applicable to that relationship, including any applicable data processing agreement.
1. WHO THIS NOTICE COVERS AND HOW IT APPLIES
This Privacy Notice explains how Carata Limited collects, uses, shares, retains and protects personal data when you:
- use the Carata website (https://carata.co or https://app.carata.co) or application (Carata) as a Customer to order food, groceries, retail goods, prescribed medicines or Errands;
- register or operate as a Business (merchant, restaurant, shop, pharmacy or other supplier) on the Carata platform via the Carata website (https://business.carata.co) or application (Carata Seller);
- register or work as a Delivery Partner / Rider on the Carata platform via the Carata website (https://rider.carata.co) or application (Carata Rider);
- otherwise interact with Carata, including as a website visitor, job applicant, or supplier to Carata.
Where this Notice refers to “you” or “your”, it means the individual whose personal data is being processed, in whichever of the above capacities applies. Businesses that are companies are not themselves “data subjects”, but this Notice also explains how Carata handles personal data about individuals connected to a Business (such as its owners, staff or contact persons).
2. WHO WE ARE (THE DATA CONTROLLER)
Carata Limited, a company incorporated under the Companies Act, 2015 (Cap. 486, Laws of Kenya), with company registration number PVT-LRUM637Z, registered office at Kodi Estate House B Two, Kodi II, Nairobi West, Nairobi, P.O. Box 00000 – 00509, Langata, Kenya, and KRA PIN P052332127Q, is the data controller responsible for your personal data in connection with the Carata platform, for the purposes of the Data Protection Act, 2019.
Contact details for data protection matters: Email: privacy@carata.co; Postal address: Kodi Estate House B Two, Kodi II, Nairobi West, Nairobi, P.O. Box 00000 – 00509, Langata, Kenya; General enquiries: info@carata.co / +254 748 850 313.
3. PERSONAL DATA WE COLLECT
The personal data we collect depends on how you use the Platform. It generally falls into the categories below.
3.1 Customers
| Category | Examples |
| Identity and account data | Name, phone number, email address, date of birth (for age verification), account password/authentication data, profile photo. |
| Order and transaction data | Products or Errands ordered, order history, delivery address, special instructions, allergy/dietary notes you choose to provide, amounts paid, applicable Tax, refunds. |
| Location data | Delivery address and, where you permit it, real-time device location, to enable ordering, delivery tracking and estimated delivery times. |
| Payment data | Payment method type and limited transaction metadata. Carata does not directly store full M-Pesa PINs, card numbers or banking credentials; these are processed by Safaricom, card networks and/or licensed payment service providers. |
| Communications | Messages with Carata Support, Businesses or Delivery Partners through the Platform; call/chat records where applicable. |
| Content | Ratings, reviews, photographs and Product requests you submit. |
| Device and technical data | IP address, device identifiers, operating system, app version, crash logs, and similar data collected automatically. |
| Sensitive personal data | Where you order prescribed medicines, information about the prescription and, indirectly, your health may be processed. We collect this only where necessary to fulfil the order, and treat it with heightened confidentiality (see Section 6). |
3.2 Businesses (and individuals connected to a Business)
- Business registration details: legal name, trading name, business registration/KRA PIN, licences and permits (including pharmacy or food-handling licences, where applicable).
- Contact and account data of the Business’s owners, directors or staff who use the merchant dashboard, including name, phone number, email and role.
- Financial and settlement data: bank or mobile-money details for settlement, commission and transaction records.
- Listing and operational data: Product listings, prices, inventory, order-acceptance and fulfilment records.
- Communications with Carata Support and Carata’s account management team.
3.3 Delivery Partners / Riders
- Identity and verification data: name, national ID or passport details, phone number, photograph, and, where applicable, driving licence and vehicle registration details.
- Location data: real-time GPS location while on duty, to enable order assignment, tracking and delivery-time estimation.
- Performance data: delivery times, acceptance/rejection rates, ratings and feedback.
- Payment data: bank or mobile-money details for earnings payments.
4. HOW WE COLLECT PERSONAL DATA
- Directly from you, when you create an account, place an Order, list a Product, apply to become a Delivery Partner, contact Support, or otherwise interact with the Platform.
- Automatically, through your use of the app or website (device data, location data, usage data, cookies and similar technologies — see Section 11).
- From other users, such as a Business or Delivery Partner providing Order-related information about a Customer, or a Customer providing delivery or allergy information relevant to a Business.
- From third parties, including payment service providers and mobile-money operators (e.g. Safaricom M-Pesa), identity-verification providers, and publicly available sources used to verify Business registration or licensing details.
5. WHY WE PROCESS YOUR DATA AND OUR LAWFUL BASIS
Under the Data Protection Act, 2019, Carata must have a lawful basis for each purpose for which it processes personal data. The table below sets out our main purposes and the lawful basis we rely on.
| Purpose | Lawful basis |
| Creating and managing your account; processing Orders, payments and refunds; coordinating delivery | Necessary for the performance of a contract with you (Customer, Business or Delivery Partner Terms) |
| Displaying applicable Tax and the total amount payable at checkout | Necessary for the performance of a contract, and to comply with Kenyan tax law |
| Verifying Business licences (e.g. pharmacy, food-handling) and Delivery Partner identity/eligibility | Necessary for the performance of a contract; legal obligation; legitimate interests in platform safety |
| Customer support, dispute resolution and investigating complaints (e.g. wrong or unsafe Products, Delivery Partner conduct) | Necessary for the performance of a contract; legitimate interests |
| Fraud prevention, security monitoring and enforcement of our Terms | Legitimate interests; legal obligation |
| Marketing communications and promotions | Consent (which you may withdraw at any time) or legitimate interests, consistent with applicable law |
| Processing prescription/health-related information for a medicine Order | Explicit consent, and/or necessity to protect your vital interests or those of another person, and compliance with health-sector legal obligations |
| Complying with tax, company, consumer-protection, data-protection and other legal obligations, and responding to lawful requests from regulators or courts | Legal obligation |
| Improving the Platform, analytics, and (where used) AI-assisted features | Legitimate interests, applied in a way that does not override your rights and freedoms |
6. SENSITIVE PERSONAL DATA
The Data Protection Act, 2019 defines certain categories of personal data as sensitive, including data revealing health status, and affords them additional protection.
- Where you place an Order for a prescribed medicine, the prescription details and any related health information you or the fulfilling pharmacy Business provide are treated as sensitive personal data.
- We collect and use this information only to the extent necessary to fulfil the Order (for example, so the pharmacy Business can verify your prescription), and we do not use it for marketing or profiling.
- We process this data on the basis of your explicit consent (for example, given when you submit the Order) or another basis permitted under the Data Protection Act, 2019, such as protecting your vital interests.
- Access to sensitive personal data within Carata and connected Businesses is restricted to personnel who reasonably need it to fulfil the Order, subject to confidentiality obligations.
7. HOW WE SHARE YOUR DATA
We share personal data only where reasonably necessary for the purposes described in this Notice, or as required by law.
- Businesses: Customer name, contact details, delivery address, Order contents and any relevant allergy/prescription information necessary to prepare and fulfil an Order.
- Delivery Partners: Customer name, delivery address/location, contact number and Order details necessary to complete a delivery; and Business pickup location and contact details.
- Payment service providers and mobile-money operators (including Safaricom M-Pesa), to process payments, settlements and refunds. Your use of M-Pesa or other third-party payment channels is also subject to that provider’s own privacy practices.
- Service providers and processors who perform functions on our behalf, such as cloud hosting, analytics, customer support tooling, identity verification, and AI-assisted listing tools, under contractual confidentiality and data-protection obligations.
- Professional advisers and insurers, where necessary for legal, accounting or insurance purposes.
- Regulators, law enforcement and courts, where required or permitted by Kenyan law, including the Office of the Data Protection Commissioner, Kenya Revenue Authority, and sector regulators (e.g. the Pharmacy and Poisons Board, in relation to a specific complaint).
- Corporate transactions: in connection with a merger, acquisition, financing or sale of business assets, subject to appropriate safeguards.
We do not sell personal data to third parties for their own independent marketing purposes.
8. INTERNATIONAL AND CROSS-BORDER TRANSFERS
Some of our service providers (for example, cloud hosting or analytics providers) may store or process personal data outside Kenya. Where we transfer personal data outside Kenya, we will do so only where permitted under sections 48–50 of the Data Protection Act, 2019 — for example, where the recipient jurisdiction or organisation has adequate data-protection safeguards, where appropriate contractual safeguards (such as standard contractual clauses) are in place, or where you have given explicit consent to the transfer, or another exemption under the Act applies.
9. DATA RETENTION
We retain personal data only for as long as necessary for the purposes described in this Notice, including to:
- maintain your account for as long as it remains active;
- comply with tax, company and other statutory record-keeping requirements (which may require retention of transaction records for a number of years after the transaction, as prescribed by the Tax Procedures Act, 2015 and other applicable law);
- resolve disputes, investigate complaints and enforce our Terms;
- meet regulatory retention requirements applicable to health-related records held by pharmacy Businesses.
When personal data is no longer needed for these purposes, we will delete it or anonymise it, save where longer retention is required or permitted by law.
10. DATA SECURITY
We implement administrative, technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration, appropriate to the nature of the data and the risks involved, consistent with section 41 of the Data Protection Act, 2019. No system connected to the internet can be guaranteed to be completely secure, and we cannot promise that unauthorised third parties will never be able to defeat our security measures.
If we become aware of a breach that is likely to result in a real risk of harm to affected data subjects, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay, in each case as required under the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
11. COOKIES AND SIMILAR TECHNOLOGIES
Our website and app may use cookies, SDKs and similar technologies to keep you signed in, remember preferences, measure usage, and, where you consent, support marketing and analytics. You can control cookies through your browser or device settings; disabling some cookies may affect how the Platform functions.
12. YOUR RIGHTS
Under the Data Protection Act, 2019, you have the following rights in relation to your personal data, subject to applicable exceptions:
| Right | What it means |
| Right to be informed | To know how and why your personal data is processed (this Notice). |
| Right of access | To request a copy of the personal data we hold about you. |
| Right to rectification | To ask us to correct inaccurate or incomplete personal data. |
| Right to erasure | To ask us to delete your personal data, subject to legal retention requirements. |
| Right to object | To object to processing based on legitimate interests or for direct marketing. |
| Right to restrict processing | To ask us to limit how we use your data in certain circumstances. |
| Right to data portability | To request your data in a structured, commonly used format, where technically feasible. |
| Right not to be subject to automated decision-making | To not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you, without appropriate safeguards. |
| Right to withdraw consent | Where processing is based on consent, to withdraw it at any time, without affecting processing already carried out. |
| Right to lodge a complaint | To complain to the Office of the Data Protection Commissioner (see Section 14). |
To exercise any of these rights, contact us using the details in Section 2. We will respond within the timeframes required by the Data Protection Act, 2019 and may need to verify your identity before actioning a request.
13. CHILDREN’S PRIVACY
Carata’s Customer Terms & Conditions require Customers to be at least 18 years old. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take reasonable steps to delete it. If you believe a child has provided us with personal data, please contact us using the details in Section 2.
14. DATA PROTECTION OFFICER, REGISTRATION AND COMPLAINTS
- Carata is not yet registered as a data controller and data processor with the Office of the Data Protection Commissioner (ODPC), in accordance with section 18 of the Data Protection Act, 2019 and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.
- Where required under the Act, Carata will designate a Data Protection Officer and publish their contact details.
- You have the right to lodge a complaint with the ODPC if you believe your data protection rights have been infringed: Office of the Data Protection Commissioner, Britam Tower, Hospital Road, Upper Hill, Nairobi, Kenya; www.odpc.go.ke/file-a-complaint/ (tel: 0207 801 800; email: info@odpc.go.ke); Office at 13th Floor, Britam Tower, Hospital Road, Upper Hill, P.O. Box 30920 – 00100 GPO, Nairobi.
15. THIRD-PARTY LINKS AND SERVICES
The Platform may contain links to, or integrate with, third-party services (for example, Safaricom M-Pesa, social media platforms, or a Business’s own website). This Notice does not cover the privacy practices of those third parties, and we encourage you to review their respective privacy policies.
16. CHANGES TO THIS NOTICE
We may update this Notice from time to time to reflect changes in our practices or in applicable law. Where a change is material, we will provide reasonable notice (for example, through the app, website or email) before it takes effect. The “Last Updated” date at the top of this Notice shows when it was last revised.
17. CONTACT US
If you have questions, requests or concerns about this Notice or how we handle your personal data, contact us at: Email: privacy@carata.co; Phone: +254 748 850 313; Postal address: House 43, Pima House, Gandhi Avenue, Nairobi West, Nairobi, P.O. Box 00000 – 00509, Langata, Kenya.