Privacy Policy

Privacy Policy

Effective Date: 1st April 2026 Last Updated: 1st April 2026

HEFA (“HEFA,” “we,” “us,” or “our”) values your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our website, mobile application, and related services (collectively, the “Services”).

By accessing or using HEFA, you agree to the terms of this Privacy Policy.

1. Who We Are

HEFA is operated by HEFA GROUP LTD, a commerce and logistics platform that connects buyers, merchants, drivers, fleet owners, and administrators through a unified marketplace and delivery system.

If you have questions about this Privacy Policy or how your data is handled, you can contact us at:

Email: customersupport@hefa.biz

Address: Kensia House Next to Pioneer University on Muranga Road, Ngara Second Floor, Room 21B Nairobi, Kenya

1. Information We Collect

We may collect the following categories of information:

a. Information You Provide Directly

When you create an account, place an order, submit forms, or contact support, we may collect:

your name email address phone number password or authentication credentials delivery address profile information merchant, driver, or fleet onboarding details KYC or verification documents you upload messages you send through the platform support requests and feedback

b. Order and Transaction Information

When you buy, sell, or deliver through HEFA, we may collect:

order details cart contents product selections and variants delivery instructions payment reference information transaction history wallet, payout, or balance-related records refund and dispute records

c. Location Information

We may collect location-related information to support marketplace, delivery, and logistics features, including:

delivery address details you enter latitude and longitude associated with delivery or pickup locations live or recent driver location data while a driver is online or handling a delivery approximate device location where permission is granted

d. Device and Technical Information

When you use the Services, we may automatically collect:

IP address browser type device type operating system app version log data usage events session and diagnostic information

e. Files, Images, and Uploaded Content

If you upload content to HEFA, we may collect and store:

profile photos product images business or identity documents delivery or verification-related files other files you choose to upload through the platform

1. How We Use Your Information

We use your information to:

create and manage your account authenticate users and secure access to the platform process orders, deliveries, payouts, and support requests connect buyers, merchants, drivers, and fleet owners calculate delivery fees and logistics-related information facilitate communication between users where applicable review merchant or driver verification submissions provide customer support detect, prevent, and investigate fraud, abuse, security incidents, and policy violations improve our platform, operations, and user experience comply with legal, regulatory, and contractual obligations

1. Mobile Permissions and Device Features

Depending on your device, app version, role, and how you use HEFA, the mobile app may request access to certain device features, including:

Location - to support delivery, pickup, logistics, and related location-based features Camera - to capture photos for profiles, products, documents, or verification workflows Files / Media Access - to upload images, documents, and other supported files Network and Connectivity Information - to improve reliability and app performance Notifications - to send important updates such as order, delivery, account, or support notifications

You can manage many device permissions through your phone settings, but disabling certain permissions may limit some features.

1. Payments and Financial Information

HEFA may facilitate payments, disbursements, wallet records, and payout-related activity. We do not store full sensitive card data unless explicitly stated and lawfully required through a secure payment workflow.

Payment transactions may be handled by third-party payment providers or financial service partners. We may receive limited transaction metadata such as:

payment status reference IDs timestamps amounts payer or recipient identifiers needed for transaction processing, reconciliation, fraud prevention, and support

1. Messaging and User Communications

HEFA may allow communication between users or between users and support. This may include order-related, support-related, or logistics-related messages.

We may process and store such communications to:

deliver the messaging feature support dispute resolution investigate abuse or fraud enforce our policies improve service quality and safety

1. Verification, KYC, and Compliance Data

For merchants, drivers, fleet owners, or other roles requiring verification, we may collect and review information such as:

identification details business information regulatory or tax documents uploaded verification materials account status and review history

We use this data to verify identity, reduce fraud, meet compliance obligations, and decide eligibility for certain platform features such as selling, driving, payouts, or account approval.

1. How We Share Information

We may share information in the following circumstances:

a. With Other Users Where Necessary

To operate the platform, limited information may be shared with relevant users, such as:

buyers receiving merchant or delivery-related information merchants receiving order and customer delivery details needed to fulfill an order drivers receiving pickup and dropoff details needed to complete deliveries

b. With Service Providers

We may share data with trusted vendors and service providers who help us operate HEFA, such as providers supporting:

hosting and infrastructure storage analytics notifications payment processing customer support file or media handling fraud prevention and security

c. For Legal or Safety Reasons

We may disclose information where reasonably necessary to:

comply with applicable law, regulation, court order, or lawful request enforce our Terms or platform policies detect, prevent, or investigate fraud, security incidents, or illegal activity protect the rights, safety, and property of HEFA, our users, or the public

d. Business Transfers

If HEFA is involved in a merger, acquisition, restructuring, asset sale, financing, or similar transaction, your information may be transferred as part of that transaction, subject to applicable law.

1. Data Retention

We retain information for as long as reasonably necessary to:

provide the Services maintain records resolve disputes enforce agreements comply with legal, tax, accounting, fraud prevention, and regulatory obligations

Retention periods may vary depending on the type of data and the purpose for which it was collected.

1. Data Security

We use reasonable technical, administrative, and organizational safeguards to help protect your information against unauthorized access, loss, misuse, alteration, or disclosure.

However, no system is completely secure, and we cannot guarantee absolute security.

1. Your Choices and Rights

Depending on your jurisdiction, you may have rights to:

access certain personal data we hold about you request correction of inaccurate information request deletion of certain information object to or restrict certain processing withdraw consent where processing is based on consent request a copy of your data where applicable

You may also update certain account information directly through your profile or account settings.

To make a request, contact us at customersupport@hefa.biz .

1. Cookies and Similar Technologies

Our website and related services may use cookies, local storage, and similar technologies to:

keep you signed in remember preferences improve site performance understand usage patterns support security and fraud prevention

You can manage some of these through your browser settings, though doing so may affect platform functionality.

1. Children’s Privacy

HEFA is not intended for children under the age required by applicable law to use the platform independently. We do not knowingly collect personal information from children in violation of applicable law.

If you believe a child has provided personal information improperly, contact us so we can take appropriate action.

1. International Data Transfers

Your information may be processed or stored in countries other than your own, depending on the infrastructure and service providers we use. Where applicable, we take reasonable steps to ensure such transfers are handled in accordance with applicable data protection laws.

1. Third-Party Services and Links

HEFA may integrate with or link to third-party services, payment providers, maps, communications tools, or external websites. Their privacy practices are governed by their own policies, not this Privacy Policy.

We encourage you to review their privacy notices where relevant.

1. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we may notify users through the app, website, email, or other appropriate means.

Your continued use of HEFA after such updates means you accept the revised Privacy Policy, to the extent permitted by law.

1. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or your personal information, contact us at:

HEFA GROUP LTD Email: customersupport@hefa.biz

Address: Kensia House Next to Pioneer University on Muranga Road, Ngara Second Floor, Room 21B Nairobi, Kenya