Privacy policy

LESNAR AI LTD (Kenya) operates BizMtaani at bizmtaani.com and is the data controller for the personal data described here.

Reach us on 0715 540 653 or hello@lesnarai.co.ke. We have not appointed a data protection officer; the founder answers these questions directly.

A business trading here decides what it sells, at what price, and to whom. For the orders placed with it, that business is the controller of its customers' details and we process them on its behalf. For accounts, applications and the running of the platform itself, we are the controller.

Only what an action needs. Placing an order collects a name, a phone number and, for delivery, an address. An account adds an email address and a password we never store in readable form. Applying to sell or to ride collects the business or licence details on that form. Paying collects the reference and result of the payment, never card numbers or an M-Pesa PIN.

What we hold, and who sees it sets out each of these field by field.

To take, carry and settle an order, and to run an account: the performance of a contract with you. To keep records of payments and orders: our legitimate interest in being able to answer a dispute, and where the law requires those records to be kept. Consent covers the two things that ask for it: a rider sharing their live location, and alerts sent to a device. Both are off until it is given, and both stop when it is withdrawn.

The business you ordered from sees your order and the contact details needed to fulfil it. A rider assigned to a delivery sees the address and phone number for that delivery only, and loses them again when the job is done.

Payments are processed by Paystack, who receive the amount, the reference and the phone number or card details you give them. We never see full card details. Our database is operated by Neon and hosted in the European Union.

We do not sell personal data, and we do not share it for advertising.

Because the database is hosted in the European Union, personal data is transferred outside Kenya. The European Union provides a standard of protection comparable to that required by the Data Protection Act, 2019, and the transfer is necessary for the performance of your contract with us.

Order and payment records are kept for seven years, which is the period Kenyan tax law requires business records to be retained. An account and its saved details are kept until you ask us to delete them. A rider's live position is erased the moment the delivery is handed over, and is never kept as a history of where anybody has been.

Under the Data Protection Act, 2019 you may ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to how we use it, and withdraw a consent you gave. Ask on the number or the address above and we will answer within thirty days.

Some data cannot be deleted on request: an order that has been paid for has to stay in the records above for as long as the law requires them. We will tell you when that applies rather than refusing without a reason.

Passwords are stored hashed. Payment credentials never reach our servers. Each business's data is separated from every other business's in the software, and that separation is tested.

No system is beyond compromise, and we will not pretend otherwise. If personal data here is breached, we will notify the Office of the Data Protection Commissioner and the people affected as the Act requires.

Tell us first, on the number above. If we have not put it right, you may complain to the Office of the Data Protection Commissioner of Kenya, which regulates this.

When this changes we will update the date at the top. If a change materially affects how your data is used, we will say so on the site rather than relying on you to re-read it.