1 Who We Are
FikaConnect Ltd ("FikaConnect", "we", "us", "our") is a technology company registered in Uganda operating a delivery marketplace platform at fikaconnect.com and via our mobile applications.
For the purposes of the Uganda Data Protection and Privacy Act 2019 ("DPPA"), FikaConnect Ltd is the data controller responsible for your personal data.
Our registered address is: Plot 45 Kampala Road, Kampala, Uganda.
2 Personal Data We Collect
We only collect data that is necessary for providing, improving, and securing our Platform. Here is exactly what we collect, and from whom:
2.1 Data you give us directly
| Data type | Who it applies to | Why we collect it |
|---|---|---|
| Full name | All users | Account identification and delivery labelling |
| Phone number | All users | Authentication, delivery coordination, payout |
| Email address | All users | Account recovery, notifications, legal communication |
| Profile photo | Drivers (required), Senders (optional) | Trust and identity verification between users |
| National ID / Driving permit | Drivers only | Identity and licence verification before activation |
| Vehicle details (plate, make, model) | Drivers only | Vehicle registration and Sender transparency |
| Mobile money number | Drivers only | Earnings payout processing |
| Pickup & drop-off addresses | Senders | Delivery routing and completion |
| Package descriptions | Senders | Delivery coordination and prohibited items screening |
2.2 Data we collect automatically
- GPS location — collected from Drivers during active deliveries only (see Section 6).
- Device information — device model, OS version, app version, and unique device ID for troubleshooting and fraud prevention.
- Usage data — pages visited, features used, session duration, and clicks — used to improve the Platform experience.
- Log data — IP address, browser type, timestamps of actions — retained for security monitoring and debugging.
- Crash reports — anonymous technical data sent when the app crashes, to help us fix bugs.
2.3 Data from third parties
- Google Sign-In / Firebase Authentication — if you sign in with Google, we receive your name and email address from Google.
- Mobile money operators — MTN and Airtel confirm payout status; we do not receive your full mobile money account details.
- Background check partners — for Drivers, we may receive verification results from approved third-party identity services.
3 How We Use Your Data
We use personal data for the following purposes:
3.1 Providing the Platform
- Creating and managing your Account.
- Matching Senders with available Drivers on their route.
- Enabling real-time delivery tracking for both parties.
- Processing payments and paying out Driver earnings.
- Generating digital receipts and proof-of-delivery records.
3.2 Safety and trust
- Verifying Driver identity, licence, and vehicle before activation.
- Detecting, investigating, and preventing fraudulent or illegal activity.
- Enforcing our Terms of Service and prohibited items policy.
- Responding to safety incidents and legal requests.
3.3 Communications
- Sending booking confirmations, delivery status updates, and receipts.
- Notifying you of changes to our Terms, Privacy Policy, or pricing.
- Responding to your support queries.
- Sending marketing messages — only with your consent, which you can withdraw at any time.
3.4 Platform improvement
- Analysing usage patterns to improve features and fix problems.
- Conducting internal research and developing new services.
- Generating aggregated, anonymised statistics about Platform usage.
4 Legal Basis for Processing
Under the Uganda Data Protection and Privacy Act 2019, we must have a lawful basis for processing your personal data. We rely on the following grounds:
- Contract performance — processing necessary to provide the delivery service you have requested (e.g. sharing your address with a Driver to complete your booking).
- Legal obligation — processing required to comply with Ugandan law (e.g. retaining financial transaction records).
- Legitimate interests — processing for purposes that benefit both you and FikaConnect where your rights are not overridden (e.g. fraud detection, platform analytics, safety monitoring).
- Consent — processing based on your freely given, specific, informed, and unambiguous agreement (e.g. marketing emails, optional profile photo). You may withdraw consent at any time without affecting lawfulness of prior processing.
5 Who We Share Your Data With
We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:
5.1 Between Senders and Drivers
When a Delivery is confirmed, the Sender's pickup address and first name are shared with the assigned Driver. The Driver's name, photo, vehicle details, and phone number are shared with the Sender. This information is available only for the duration of the active Delivery and is removed from both parties' views after completion.
5.2 Service providers (data processors)
- Google Firebase — authentication, database, and cloud storage hosting.
- Google Maps Platform — route mapping and address autocomplete.
- MTN Uganda / Airtel Uganda — Driver payout processing.
- SMS gateway providers — delivery notification SMS messages.
- Crash analytics — anonymous crash reporting to fix bugs.
All service providers are contractually bound to process your data only on our instructions and to implement appropriate security measures.
5.3 Legal and safety disclosures
We may disclose your data to law enforcement, regulatory authorities, or courts when required by Ugandan law, court order, or when we believe disclosure is necessary to protect the safety of any person or prevent fraud.
5.4 Business transfers
If FikaConnect is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and an in-app notice at least 30 days before any such transfer takes effect, and you will have the right to delete your account before the transfer.
6 Location Data
Location data is among the most sensitive data we handle. Here is exactly how we treat it:
6.1 Driver location
- GPS location is collected from the Driver's device only when the Driver has an active accepted delivery.
- Location collection begins when the Driver taps "Accept Job" and stops automatically when the delivery is marked complete or cancelled.
- Live location is shared in real-time with the Sender of the active delivery only — no other parties.
- Location history for a completed delivery is retained for 30 days for dispute resolution purposes, then permanently deleted.
- We do not track Driver location outside of active delivery sessions, even if the app is running in the background.
6.2 Sender location
- We use your device location only with your permission to auto-fill pickup addresses. This is optional — you may type addresses manually.
- We do not store your precise device location. Only the address you confirm as the pickup point is saved to your booking record.
7 Cookies & Tracking Technologies
Our website uses cookies and similar technologies. Our mobile app does not use browser cookies.
Strictly necessary cookies
These are essential for the website to function and cannot be disabled. They include session management and security tokens. No consent is required for these.
Analytics cookies
We use privacy-respecting analytics to understand how visitors use our website (pages visited, time spent, referral sources). These are enabled by default but you can opt out at any time using the cookie preference button in the page footer.
Marketing cookies
We do not use marketing or advertising cookies. We do not run retargeting campaigns or share data with ad networks.
8 How Long We Keep Your Data
We keep your personal data only for as long as necessary for the purposes described in this Policy, or as required by law.
| Data type | Retention period | Reason |
|---|---|---|
| Account profile data | Duration of account + 30 days after deletion | Active service provision; grace period for recovery |
| Delivery records | 3 years after delivery date | Dispute resolution and legal compliance |
| Financial transaction records | 7 years | Uganda Revenue Authority requirements |
| Driver location history | 30 days after delivery completion | Dispute resolution only |
| Driver verification documents | Duration of account + 1 year | Regulatory compliance and fraud prevention |
| Support communications | 2 years from last interaction | Quality improvement and dispute history |
| Server logs (IP, timestamps) | 90 days | Security monitoring and debugging |
| Marketing consent records | Until consent is withdrawn + 1 year | Proof of consent |
When the retention period ends, data is securely and permanently deleted or anonymised so it can no longer be linked to you.
9 How We Protect Your Data
We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:
- Encryption at rest: All personal data stored in our databases is encrypted using AES-256.
- Encryption in transit: All data transmitted between your device and our servers uses TLS 1.3.
- Firebase Security Rules: Database access is controlled by strict server-side rules — users can only access their own data.
- Access controls: Staff access to personal data is role-based and limited to what is necessary for their job. Access is logged and reviewed regularly.
- Two-factor authentication: Available for all user accounts and mandatory for all FikaConnect staff with database access.
- Penetration testing: We conduct regular security assessments of our Platform.
- Incident response: We have a documented data breach response plan. In the event of a breach affecting your data, we will notify you and the Personal Data Protection Office of Uganda within 72 hours of becoming aware.
10 Your Data Rights
Under the Uganda Data Protection and Privacy Act 2019, you have the following rights regarding your personal data. You can exercise most of them directly in your Account Settings, or by contacting our DPO at ssenfukaraymond@gmail.com.
Request a copy of all personal data we hold about you. We'll provide it within 30 days, free of charge, in a readable format.
Ask us to correct inaccurate or incomplete data about you. Most profile data can be updated directly in your account settings.
Request deletion of your account and personal data. Some data may be retained where legally required (e.g. financial records for 7 years).
Object to processing based on legitimate interests, including for direct marketing. We will stop unless we have compelling grounds to continue.
Receive your personal data in a structured, machine-readable format (JSON or CSV) to transfer to another service if you wish.
Ask us to pause processing of your data while a complaint is being investigated, without requiring full deletion.
We will respond to all rights requests within 30 days. If your request is complex, we may extend this by a further 30 days, and will notify you. Requests are free of charge unless they are manifestly unfounded or excessive.
If you are unhappy with how we handle your request, you have the right to lodge a complaint with the Personal Data Protection Office of Uganda (PDPO).
11 Children's Privacy
The FikaConnect Platform is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us at ssenfukaraymond@gmail.com and we will delete that data promptly.
12 Third-Party Links & Services
Our Platform may contain links to third-party websites or integrate with third-party services (such as Google Maps). This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use.
When you use Google Maps features within our app, your interaction with those features is also subject to Google's Privacy Policy.
13 Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes that affect your rights or how we use your data, we will:
- Update the "Last updated" date at the top of this page.
- Send a notification to your registered email address at least 14 days before the changes take effect.
- Display a prominent in-app notice for all active users.
We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of changes constitutes your acceptance of the updated Policy.
14 Contact Us & Data Protection Officer
For any questions, concerns, or to exercise your data rights, please contact our Data Protection Officer:
- Email (preferred): ssenfukaraymond@gmail.com
- General enquiries: ssenfukaraymond@gmail.com
- Security incidents: ssenfukaraymond@gmail.com
- Postal address: Data Protection Officer, FikaConnect Ltd, Plot 45 Kampala Road, Kampala, Uganda
If you are not satisfied with our response, you may contact the Personal Data Protection Office of Uganda to lodge a formal complaint.
Questions about your privacy?
Our Data Protection Officer will personally respond to all privacy enquiries within 2 business days. Your data rights matter to us.