Privacy Policy

1Overview and Commitment#

Blink is committed to safeguarding personal data and processing it lawfully, fairly, and transparently in accordance with the Data Protection Act, 2019 (Kenya) and related regulations. Blink will not process personal data in a manner incompatible with the purposes stated in this Policy.

Blink Hub Limited is a duly registered Data Controller under the laws of Kenya, Data Controller Registration Number (ODPC NO.) 375-571F-F852.

2Key Definitions#

"Personal Data" means any information relating to an identified or identifiable natural person.

"Processing" means any operation performed on personal data including collection, storage, use, disclosure, and deletion.

"Data Subject" means an individual to whom Personal Data relates.

2.1 Data Protection Principles

Blink processes Personal Data in accordance with the following principles:

• Lawfulness, fairness and transparency;
• Purpose limitation – Personal Data is collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
• Data minimisation – Only Personal Data necessary for the stated purposes is collected;
• Accuracy – Personal Data is kept accurate and up to date;
• Storage limitation – Personal Data is retained only for as long as necessary;
• Integrity and confidentiality – Appropriate technical and organisational measures are implemented to safeguard Personal Data.

3Summary of Information#

Purposes of Processing

When You Are a USER (Customer)

When You Are a PARTNER (Merchant / Vendor)

When You Are a JOB APPLICANT

When You Are a WEBSITE VISITOR

Lawful Basis for Processing

Data Sharing — If You Are a USER

4Data We Collect#

Blink may collect the following categories of Personal Data depending on your interactions with the Platform:

4.1 Registration & Account Data

• Full name
• Email address
• Mobile number
• Profile photo (optional)
• Password hash

4.2 Transaction & Order Data

• Order history
• Transaction identifiers
• Delivery address
• Contact instructions
• Ratings and feedback

4.3 Payment Data

Processed by third-party providers:

• Billing amounts
• Masked payment identifiers

4.4 Location & Geolocation Data

With your explicit consent, Blink may collect precise or approximate location data from your device for the purposes of:

• Facilitating order delivery;
• Optimising routing and logistics;
• Fraud detection and service integrity.

Location tracking may occur while the application is in active use and, where permitted by device settings and consent, in the background for delivery optimisation. You may disable location permissions at any time through your device settings; however, certain services may not function properly without location access.

4.5 Technical & Device Data

• Device type and OS
• App usage logs
• IP address
• Error reports

4.6 Communications Data

• In-App chats
• Customer support interactions
• Emails

4.7 Merchant & Delivery Partner Data

• Business registration details
• Licence or permit information
• Vehicle and insurance data
• Bank account details (for payouts)

4.8 Optional Sensitive Data

Only as voluntarily provided (e.g., dietary preferences).

5Purposes and Legal Bases for Processing#

5.1 Contractual Performance

To:

• Register your account
• Process orders and payments
• Fulfil deliveries
• Provide customer support

5.2 Compliance with Law

To:

• Prevent fraud and security breaches
• Respond to law enforcement requests
• Retain data required by tax and regulatory obligations

5.3 Legitimate Interests

To:

• Improve and personalise services
• Enhance platform security
• Prevent abusive activity

5.4 Consent

Where legally required, for:

• Location tracking
• Marketing communications
• Cookies and similar technologies

Provision of certain Personal Data is mandatory in order to create an account and access Blink services. Failure to provide required information may result in inability to register or use certain features of the Platform. Optional data (such as marketing preferences or dietary information) is provided voluntarily.

6Data Processing by Category of Data Subject#

6.1 For Users

Purpose: Provide Platform services, process orders, handle payments, communicate promotions, and provide support.

Data Categories: Account data, transaction data, location, technical logs, communications.

Legal Bases: Contract necessity; consent for optional processing; legitimate interests for fraud prevention.

6.2 For Merchants

Purpose: Enable Merchant registration, product listing, order fulfilment, revenue settlement.

Data Categories: Business registration info, contact details, bank details, performance data.

Legal Basis: Contract necessity; legal obligations; legitimate interests.

6.3 For Delivery Partners

Purpose: Assign delivery tasks, coordinate logistics, verify identity, process payouts.

Data Categories: Identity data, vehicle details, licence and insurance, location data.

Legal Basis: Contract necessity; legal compliance (traffic and labour regulations); legitimate interests.

7Data Receivers & Disclosure#

7.1 Service Providers

• Payment processors
• Analytics and cloud service providers
• Fraud detection partners
• Customer support platforms

These providers process data solely on Blink's instructions. Blink enters into written data processing agreements with all third-party processors to ensure compliance with applicable data protection laws.

7.2 Merchants & Delivery Partners

• Order details are shared for processing and fulfilment.

7.3 Legal & Regulatory Authorities

• Where required by Kenyan law (e.g., anti-fraud, anti-money-laundering investigations).

7.4 Business Partners

With explicit consent or subject to a data sharing agreement.

8International Data Transfers#

Personal data may be transferred outside Kenya only where:

• The receiving country ensures adequate data protection; or
• Appropriate safeguards are in place such as binding contractual clauses.

9Data Retention#

Blink retains Personal Data only for as long as necessary to fulfil the purposes outlined in this Policy and to comply with legal obligations. Indicative retention periods include:

• Account Data – retained while the account remains active and for up to seven (7) years following account closure for legal and audit purposes;
• Transaction and Order Data – retained for a minimum of seven (7) years to comply with tax and financial reporting obligations;
• Marketing Data – retained until consent is withdrawn or the individual opts out;
• Location Data – retained for operational necessity and anonymised thereafter where possible;
• Recruitment Data – retained for up to two (2) years unless otherwise required by law;
• Dispute and Legal Records – retained for the duration of applicable statutory limitation periods.

Upon expiry of applicable retention periods, Personal Data is securely deleted or irreversibly anonymised.

10Security of Personal Data#

Blink implements appropriate technical and organisational safeguards including:

• Encryption (at rest and in transit)
• Access controls
• Regular audits
• Incident response protocols

However, no system is completely secure; absolute security cannot be guaranteed.

11Data Subject Rights#

Under the Data Protection Act, 2019, you have rights including:

• Right of access
• Right to correction
• Right to erasure (subject to legal limits)
• Right to restriction
• Right to data portability
• Right to object to processing
• Right to withdraw consent

Requests may be submitted to Blink's Data Protection Officer at privacyblinkhubltd@gmail.com.

12Cookies and Similar Technologies#

Blink uses cookies, pixels, and tracking technologies to:

• Enable Platform functionality necessary for service provision
• Analyse usage patterns and improve services
• Deliver personalised content and marketing communications (subject to consent)

Cookie Categories

• Strictly necessary: required for service operation
• Analytics: used to improve the platform
• Marketing: used to deliver personalised content and offers

Consent for non-essential cookies is obtained during app onboarding or via settings. Users may withdraw consent at any time via app settings or browser/device controls.

13Children's Data#

Blink's services are not directed to individuals under the age of eighteen (18) years. Blink does not knowingly collect, process, or solicit Personal Data from children without verifiable parental or legal guardian consent.

If Blink becomes aware that Personal Data has been collected from a child without appropriate consent, Blink shall take reasonable steps to:

• Verify the age of the individual;
• Obtain parental or guardian consent where legally required; or
• Delete the Personal Data promptly where such consent is not obtained.

Parents or legal guardians who believe that a child may have provided Personal Data to Blink without consent may contact the Data Protection Officer to request review and deletion of such data.

14Automated Decision-Making & Profiling#

Blink may use automated systems to:

• Detect fraud
• Improve routing and logistics
• Personalise content

Users may request human review where decisions have significant effects.

15Data Breach Notification#

In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, Blink shall:

• Notify the Office of the Data Protection Commissioner without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach;
• Notify affected Data Subjects where the breach is likely to result in a high risk to their rights and freedoms;
• Implement appropriate remedial and mitigation measures.

16Changes to This Policy#

Blink may update this Policy where necessary due to:

• Changes in legal requirements
• Platform evolution
• Business developments

Where required by law, Blink will notify Users of material changes. Continued use of the Platform constitutes acceptance of the updated Policy.

17Contact Information#

Blink Hub Limited

Gulf Towers, Enterprise Road, Industrial Area, Nairobi · P.O. Box 18887, Kenya

Data Protection Officer

privacyblinkhubltd@gmail.com

General enquiries

blinkhubltd@gmail.com

You may also contact the Office of the Data Protection Commissioner in Kenya for unresolved complaints under the Data Protection Act, 2019.

18Legal Basis and Consent Clarification#

Blink processes Personal Data on the legal bases described in this Policy, including performance of a contract, compliance with legal obligations, legitimate interests, and consent where required by law.

Where processing is based on consent (such as marketing communications or optional location tracking), you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Withdrawal of consent may be exercised through the Blink application settings or by contacting the Data Protection Officer.