Privacy Policy

TapTap (https://taptap.africa) is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our NFC wristbands, QR code system, mobile services, and website (collectively, the “Services”).

1. Information We Collect

We may collect the following types of information:

• Personal Identification Information: Name, phone number, email address, and government-issued ID (where required for compliance).
• Payment Information: M-Pesa transaction IDs, wallet balances, and top-up history. We do not store your M-Pesa PIN or full bank account details.
• Event Data: Events you attend, vendors you transact with, wristband ID, and transaction timestamps.
• Device Information: Device model, operating system, browser type, and IP address when you access our website or mobile services.
• Usage Data: Pages visited, features used, and interaction patterns within the Services.

2. How We Use Your Information

We use the information we collect to:

• Process your registration, top-ups, payments, and refunds through the TapTap platform.
• Verify your identity and prevent fraudulent transactions.
• Provide customer support and respond to your inquiries.
• Send transaction confirmations, event updates, and service announcements.
• Improve and optimise our Services through analytics and usage patterns.
• Comply with legal obligations under Kenyan law, including the Data Protection Act, 2019.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds: your consent (which you may withdraw at any time), the performance of a contract (providing the Services you requested), compliance with legal obligations, and our legitimate interests in operating and improving our platform.

4. Information Sharing

We do not sell your personal information. We may share your data only in the following circumstances:

• Event Organisers & Vendors: Limited data (name, wristband ID, transaction amount) is shared with event organisers and vendors to facilitate payments and event operations.
• Payment Processors: M-Pesa (Safaricom PLC) processes your payments. Their use of your data is governed by their own privacy policy.
• Service Providers: Third-party providers who help us deliver the Services (cloud hosting, customer support, analytics) under strict data processing agreements.
• Legal Authorities: When required by law or to protect our legal rights.

5. Account Deletion & Data Retention

You may delete your account at any time from the Settings page of your account portal. Upon deletion:

• Your personal data (name, phone number, email) is permanently erased from our active systems within 30 days.
• Transaction records (amounts, timestamps, event IDs) are retained in anonymised form for seven (7) years to comply with Kenyan tax and anti-money laundering laws.
• Wallet balances are refunded to your M-Pesa account within 14 days of deletion.
• Backup data is purged within 90 days.

6. Children’s Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us immediately so we can delete it.

7. Your Rights

Under the Kenyan Data Protection Act, 2019, you have the right to:

• Access your personal data held by us.
• Correct inaccurate or incomplete data.
• Delete your data (subject to legal retention requirements).
• Object to or restrict processing of your data.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, contact us at support@taptap.africa. We will respond within thirty (30) days as required by law.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS 1.3) and at rest, access controls, and regular security audits. However, no method of transmission over the Internet is 100% secure.

9. Cookies & Tracking

Our website and app use essential cookies and local storage for authentication, session management, and security preferences. We do not use tracking cookies for advertising. You may configure your browser to reject cookies, though this may affect certain functionality (including login persistence).

We also use local storage (localStorage and sessionStorage) to store your app preferences (PIN settings, notification preferences, blur settings). This data never leaves your device.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Services. Continued use of the Services after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.