Privacy Policy
Last updated: 17 March 2026
Data controller: Reef Support B.V., The Netherlands
Reef Support B.V. ("we", "us", "our") operates the MiMaji platform at mimaji.co.ke and through the MiMaji mobile application. We take the security and confidentiality of your personal data seriously. This Privacy Policy describes what information we gather, the purposes for which we use it, with whom we share it, and the choices available to you.
1. Data We Gather
Account data: When you register, we collect your full name, telephone number, email address, and delivery address(es). Transaction data: We record details of each order you place, including product selection, order value, payment reference, delivery status, and timestamps. Technical data: We automatically collect your IP address, browser type, device model, operating system, screen resolution, and approximate geolocation (derived from IP or GPS where you grant permission). Communications: If you contact us via email, WhatsApp, or in-app chat, we retain the content of those exchanges. Feedback & reviews: Ratings and written reviews you submit about Vendors or delivery riders.
2. Why We Process Your Data
We process your personal data for the following purposes: (a) to create and administer your account; (b) to process, dispatch, and track your orders; (c) to facilitate M-Pesa payments and issue refunds where applicable; (d) to communicate with you regarding your orders, account, or support queries; (e) to send you promotional offers, newsletters, or product updates (only with your explicit opt-in consent); (f) to analyse usage patterns and improve Platform functionality; (g) to detect, prevent, and investigate fraud or misuse; (h) to comply with legal obligations.
3. Legal Bases
We rely on the following legal bases: contractual necessity (to fulfil orders), legitimate interest (to improve our services and prevent fraud), consent (for marketing communications), and legal obligation (to comply with tax, consumer protection, and data-related laws in Kenya and the EU/EEA where applicable).
4. Who Receives Your Data
Vendors: We share your name, telephone number, and delivery address with the Vendor fulfilling your order so they can prepare and deliver your products. Delivery riders: Riders receive your delivery address and contact details solely for the purpose of completing the delivery. Payment processors: Safaricom M-Pesa and any other integrated payment gateway receive transaction data necessary to process your payment. Service providers: We may engage cloud hosting, analytics, and customer support tools operated by third parties under strict data processing agreements. Authorities: We will disclose personal data if required by law, regulation, court order, or governmental authority.
5. International Transfers
Your data may be transferred to and stored on servers located outside Kenya, including in The Netherlands and other jurisdictions where our service providers operate. Where such transfers occur, we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent protections.
6. Data Retention
We retain your personal data for as long as your account remains active and for a reasonable period thereafter to fulfil legal, accounting, or reporting obligations. Transaction records are kept for a minimum of seven (7) years in accordance with Kenyan tax law. You may request deletion of your account data at any time, subject to our retention obligations.
7. Your Rights
Depending on your jurisdiction, you may have the right to: access your personal data; correct inaccurate data; request erasure of your data; restrict or object to processing; receive your data in a portable format; and withdraw consent for marketing at any time. To exercise any of these rights, email us at privacy@mimaji.co.ke. We will respond within thirty (30) days.
8. Security Measures
We implement industry-standard technical and organisational measures to protect your data, including encrypted data transmission (TLS/SSL), access controls, regular security audits, and staff training. Despite these precautions, no transmission over the internet or electronic storage method is entirely secure, and we cannot guarantee absolute security.
9. Age Restriction
MiMaji is not designed for use by persons under the age of eighteen (18). We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data, we will take steps to delete that information.
10. External Links
The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policies of any site you visit.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the revised policy on the Platform and updating the “Last updated” date. Continued use after such changes constitutes acceptance.
12. Contact the Data Controller
Reef Support B.V. Email: privacy@mimaji.co.ke Phone: +254 758 434 076 Website: www.mimaji.co.ke
MiMaji Privacy Policy
Last updated: 17 March 2026
Data controller: Reef Support B.V., The Netherlands
Reef Support B.V. ("we", "us", "our") operates the MiMaji platform at mimaji.co.ke and through the MiMaji mobile application. We take the security and confidentiality of your personal data seriously. This Privacy Policy describes what information we gather, the purposes for which we use it, with whom we share it, and the choices available to you.
1. Data We Gather
Account data: When you register, we collect your full name, telephone number, email address, and delivery address(es). Transaction data: We record details of each order you place, including product selection, order value, payment reference, delivery status, and timestamps. Technical data: We automatically collect your IP address, browser type, device model, operating system, screen resolution, and approximate geolocation (derived from IP or GPS where you grant permission). Communications: If you contact us via email, WhatsApp, or in-app chat, we retain the content of those exchanges. Feedback & reviews: Ratings and written reviews you submit about Vendors or delivery riders.
2. Why We Process Your Data
We process your personal data for the following purposes: (a) to create and administer your account; (b) to process, dispatch, and track your orders; (c) to facilitate M-Pesa payments and issue refunds where applicable; (d) to communicate with you regarding your orders, account, or support queries; (e) to send you promotional offers, newsletters, or product updates (only with your explicit opt-in consent); (f) to analyse usage patterns and improve Platform functionality; (g) to detect, prevent, and investigate fraud or misuse; (h) to comply with legal obligations.
3. Legal Bases
We rely on the following legal bases: contractual necessity (to fulfil orders), legitimate interest (to improve our services and prevent fraud), consent (for marketing communications), and legal obligation (to comply with tax, consumer protection, and data-related laws in Kenya and the EU/EEA where applicable).
4. Who Receives Your Data
Vendors: We share your name, telephone number, and delivery address with the Vendor fulfilling your order so they can prepare and deliver your products. Delivery riders: Riders receive your delivery address and contact details solely for the purpose of completing the delivery. Payment processors: Safaricom M-Pesa and any other integrated payment gateway receive transaction data necessary to process your payment. Service providers: We may engage cloud hosting, analytics, and customer support tools operated by third parties under strict data processing agreements. Authorities: We will disclose personal data if required by law, regulation, court order, or governmental authority.
5. International Transfers
Your data may be transferred to and stored on servers located outside Kenya, including in The Netherlands and other jurisdictions where our service providers operate. Where such transfers occur, we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent protections.
6. Data Retention
We retain your personal data for as long as your account remains active and for a reasonable period thereafter to fulfil legal, accounting, or reporting obligations. Transaction records are kept for a minimum of seven (7) years in accordance with Kenyan tax law. You may request deletion of your account data at any time, subject to our retention obligations.
7. Your Rights
Depending on your jurisdiction, you may have the right to: access your personal data; correct inaccurate data; request erasure of your data; restrict or object to processing; receive your data in a portable format; and withdraw consent for marketing at any time. To exercise any of these rights, email us at privacy@mimaji.co.ke. We will respond within thirty (30) days.
8. Security Measures
We implement industry-standard technical and organisational measures to protect your data, including encrypted data transmission (TLS/SSL), access controls, regular security audits, and staff training. Despite these precautions, no transmission over the internet or electronic storage method is entirely secure, and we cannot guarantee absolute security.
9. Age Restriction
MiMaji is not designed for use by persons under the age of eighteen (18). We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data, we will take steps to delete that information.
10. External Links
The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policies of any site you visit.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the revised policy on the Platform and updating the “Last updated” date. Continued use after such changes constitutes acceptance.
12. Contact the Data Controller
Reef Support B.V. Email: privacy@mimaji.co.ke Phone: +254 758 434 076 Website: www.mimaji.co.ke