What we keep, and who sees it.
Plainly: what this site collects, what diners share, and what businesses never see.
Who we are
Tumikia runs QR ordering, payment and operations software for restaurants, bars, hotels, food courts and events, from Nairobi, Kenya. This policy covers this business website, the diner pages your guests open from a table or room QR code, and the staff tools restaurants use.
Questions about your data: [email protected].
What this website collects
When you ask us to call you, we keep what you type into the form:
- Your name, your business name and your phone number.
- Anything you choose to add in the optional steps: a booked time, the number of locations or rooms, what you use today, your biggest problem, when you want to start, and an email address if you ask for a copy.
When you apply for a role, we keep what you put in the application form and anything you attach.
We use these details to contact you about what you asked for.
Diners and guests
Diners never need an account or an app to order. An account is optional, and only needed for loyalty points and history.
A diner's contact details are never shared with a business. Restaurants see aggregates, such as audience sizes and campaign results, and reach their diners through Tumikia: campaigns are sent by Tumikia on the restaurant's behalf.
What a business does see is what it needs to serve the table: the order, the table or room, and the payment recorded against it.
Payments
M-Pesa payments go straight to the restaurant's own till or Paybill and never pass through Tumikia. We record the confirmation code the diner enters, so staff can check it and so a code cannot be used twice.
Card payments on the diner's phone are processed by our card partner. Card details are entered with our card partner, not with Tumikia.
Your rights
Under the Data Protection Act you can ask to see the data we hold about you, to correct it, or to delete it.
To ask, contact [email protected].
How long we keep it
We keep personal data only for as long as we need it for the reason we collected it, or as long as the law requires. After that, we delete it or remove anything that identifies you.
Enquiries from businesses. If you ask us to call you, we keep what you sent for 24 months after our last contact with you. If you become a customer, it becomes part of your account. Job applications. We keep your application and CV for 12 months after the role is filled, so we can contact you about a similar role. If you’d rather we didn’t, ask and we’ll delete it sooner. Diner accounts. We keep your account, points history and saved details for as long as your account is open. You can delete your account at any time from your account page or the Tumikia app. We delete it within 30 days. Orders and payments. Kenyan law requires businesses to keep their transaction records for five years. So we keep each order and its payment record for five years: the amount, the M-Pesa confirmation code or card payment reference, the restaurant, and the date. Keeping the M-Pesa code also stops it from being used twice. If you delete your diner account, your past orders stay in the restaurant’s records, but nothing links them to you any more. Business accounts and staff. We keep a restaurant’s account, its staff accounts and its invoices for as long as the restaurant uses Tumikia, and for five years after it leaves, for tax and accounting. Security and technical logs. We keep them for up to 90 days, to keep the service running and to investigate problems. Backups. Deleted data can remain in our encrypted backups for up to 30 days until they are replaced. Nobody uses it there except to restore the service after a failure.
To ask us to delete your data sooner, contact [email protected]. If the law requires us to keep something, we’ll tell you what and why.
Changes to this policy
When this policy changes, the date at the top changes with it, and every earlier version stays readable from this page.