Effective date: 20th September, 2026
The data controller responsible for your personal data is:
DUKAMNETI ONLINE SHOPS
Business Name: BN-RPC2MXMX
Republic of Kenya
Email: support@dukamneti.co.ke
This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our services and the choices you have associated with that data. Unless otherwise defined in this Privacy Policy, terms used have the same meanings as in our Terms and Conditions.
We collect the following categories of personal data:
When you register, we collect:
Lawful basis: Performance of a contract — necessary to create and manage your account and provide subscription access.
When you subscribe, payment transactions are processed by our payment providers (PayPal, M-Pesa/Safaricom). We do not store your full card details. We retain records of transaction IDs, subscription status, and payment amounts.
Manual M-Pesa code verification and Subscription Credit. If you submit an M-Pesa transaction code, we ask Safaricom for the details of that transaction and store the response in full. It can include the amount, the date and time, the transaction status and type, the receiving business name, and the paying party's name and phone number (or, for bank payments, the bank's name). When you submit a code while choosing a subscription plan, we also keep your IP address, browser details and advertising cookie identifiers only until that payment has been processed, so we can report your subscription to Meta for advertising measurement; they are then deleted. We also store your Subscription Credit balance and a ledger of credits and purchases. This information is visible only to authorised administrators and is never shown to other users.
Code-entry attempts. We record each M-Pesa code you enter, when you entered it and the result, so we can prevent misuse such as guessing codes. These records are kept with your payment records.
Lawful basis: Performance of a contract; legal obligation (financial record-keeping); legitimate interests (fraud prevention and resolving payment disputes).
Each time you accept our Terms and Conditions and Privacy Policy (at sign-up, when a new version is published, or when you top up Subscription Credit) we record which version you accepted, the date and time, your IP address (including any forwarding chain), and your browser's user agent. We also keep a permanent copy of every version of these documents.
Lawful basis: Performance of a contract; legal obligation; legitimate interests (evidencing the terms that applied to you and defending legal claims).
We automatically collect information about how you use our website, including:
Lawful basis: Legitimate interests — to maintain, improve, and secure the website.
If you opt in to browser push notifications, we store your browser's push subscription token (endpoint URL and encryption keys) to deliver match alerts and tip updates. No personally identifiable information is contained in the token itself.
Lawful basis: Consent — you explicitly enable notifications via the opt-in prompt. You can withdraw consent at any time by disabling notifications in your browser settings.
We use the following types of cookies:
You can configure your browser to refuse all cookies. Disabling strictly necessary cookies will prevent you from logging in or using subscription features.
Lawful basis: Strictly necessary cookies — legitimate interests. Analytics and marketing cookies — consent (where required by applicable law).
| Purpose | Data used | Lawful basis |
|---|---|---|
| Provide and maintain the website | Account, Usage | Contract performance |
| Process subscription payments | Account, Payment | Contract performance |
| Send match alerts and tip updates | Push subscription, Email | Consent |
| Customer support | Account, correspondence | Contract performance / Legitimate interests |
| Improve our services | Usage, Analytics | Legitimate interests |
| Fraud prevention and security | Usage, Account | Legitimate interests / Legal obligation |
| Verify manual M-Pesa payments and manage Subscription Credit | Payment, Account | Contract performance / Legitimate interests |
| Record your acceptance of our terms | Terms acceptance records | Contract performance / Legal obligation / Legitimate interests |
| Comply with legal obligations | Account, Payment | Legal obligation |
We share data with the following processors, who are contractually bound to use it only for the purposes we specify:
Your data may be transferred to and processed in countries outside your own, including the United States, where data protection laws may differ from those in your country. Where we transfer data from the European Economic Area (EEA) or the United Kingdom to third countries, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA), or we transfer to countries with an adequacy decision.
AWS stores data in the EU (eu-central-1, Frankfurt) where possible. For further information on the safeguards in place, contact us at support@dukamneti.co.ke.
We may disclose your Personal Data where required to:
We do not sell your personal data to third parties.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including HTTPS encryption, access controls, and regular security reviews. However, no method of internet transmission or electronic storage is 100% secure.
Depending on your jurisdiction, you have the following rights regarding your personal data. To exercise any of them, email support@dukamneti.co.ke or use our contact form. We will respond within 30 days.
Our website may contain links to third-party sites. We have no control over and assume no responsibility for the content or privacy practices of those sites. We encourage you to review the privacy policy of every site you visit.
Dukamneti Sports does not address anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. Each published update is a new version and we keep a permanent history of every version. We will notify you of material changes by email and/or a prominent notice on our website, and will update the effective date at the top of this page. When a new version is published, you must review and accept it before you can continue to use the website or your account; if you decline, you can sign out. See section 10 of our Terms and Conditions.