Privacy Policy - Bingo Connect

Effective Date: 1st December 2025 Last Updated: 1st December 2025

1. Introduction

Welcome to Bingo Connect ("Bingo," "we," "our," or "us"), operated by Roamstead Limited. We run a multi-service platform providing online shopping, real-time delivery, and professional task services (TaskNow).

We are committed to protecting your privacy and handling your personal data responsibly, in compliance with the Data Protection Act, 2019 (Kenya) and applicable international standards. This policy explains how we collect, use, store, and share your information depending on your role on our platform.

2. Scope

This policy applies to all users of the Bingo platform:

Customers — users ordering goods or services
Vendors — merchants selling goods (Micro, Formal, and High-Risk tiers)
Riders — boda-boda and cyclist delivery partners
Taskers — service providers (skilled and non-skilled) on TaskNow

3. Information We Collect

We collect only what we need — no more. Every piece of information requested serves a specific purpose: verifying your identity (KYC), processing payments, or keeping our platform safe.

A. Information Collected from All Users

Identity Data — Full legal name (must match your ID or M-PESA account)
Contact Data — Phone number (verified via OTP) and email address
Financial Data — M-PESA Till/Paybill numbers or bank account details
Device Data — Device ID, operating system, and unique identifiers (to prevent fraud and multiple accounts)

B. Specific Data by User Role

1. Customers

Location — Primary delivery address and GPS pin
Triggered Verification — If you place high-value orders or flag suspicious activity, we may request a selfie or ID copy for verification

2. Vendors (Merchants)

Depending on your KYC tier (1, 2, or 3), we collect:

Business Proof — Business permit, photos of storefront/interior, signage
Identity — Owner's National ID and liveness selfie
Inventory — Proof of stock (photos with tags) and supplier invoices (for Tier 3)
Location — GPS coordinates of the shop to verify geo-consistency against listed addresses

3. Riders (Boda & Cyclists)

Identity — National ID (front and back) and liveness selfie
Vehicle Data — Logbook (or owner permission letter), insurance cover, number plate photos, bike photos
Background — Next-of-kin details (name, relationship, phone) for emergency and safety traceability
Status — Valid driving license (for motorcyclists)

4. Taskers (TaskNow)

Identity — National ID and liveness selfie
Location — Home/residence GPS pin (to determine service radius)
Skills — Professional certificates or trade licenses (for skilled taskers like plumbers and electricians)
Background — Next-of-kin details

C. Sensitive Personal Data (Biometrics)

For Vendors, Riders, and Taskers (and occasionally Customers), we process Biometric Data in the form of facial recognition (Liveness Checks) to prevent impersonation and identity fraud. By submitting your selfie, you explicitly consent to this processing.

4. How We Use Your Information

We use your data for these specific purposes:

1. Verification & Onboarding (KYC)

Assign Trust Scores and tiers (e.g., verifying whether a vendor is Tier 1 or Tier 3)
Perform OCR (Optical Character Recognition) on IDs to ensure readability and authenticity
Match your registered name against your M-PESA or bank details to prevent payment fraud

2. Service Delivery & Safety

Geo-fencing — Track rider and tasker locations in real-time to ensure they stay on route and prevent no-show fraud
Trust Badges — Grant "Verified" or "Trusted" badges based on order history and document verification
Safety — Share rider and tasker profiles (name, photo, Trust Score) with customers before arrival

3. Fraud Prevention & Monitoring

Behavioral Monitoring — Analyze patterns such as excessive cancellations, refund abuse, or GPS deviations
Device Binding — Ensure a rider or tasker account is only operated from authorized devices
Automated Flags — Identify ID mismatches or inventory irregularities that may lead to temporary account suspension

5. Location Information

Riders and Taskers — We collect precise location data (foreground and background) while you are online, to assign orders and let customers track deliveries
Customers and Vendors — We collect location data to pinpoint delivery addresses and verify shop locations

We do not sell your personal data — period. We only share information in these specific circumstances:

Between Users — Riders see customer delivery details; customers see rider/tasker photos and live locations
Third-Party Service Providers — For identity verification (ID checks), background checks, and payment processing
Legal Obligations — We may share data with law enforcement in cases of proven fraud, theft, or a formal legal request, specifically regarding permanently banned users (as per our Anti-Fraud policy)

7. Data Retention & Deletion

Retention — We keep data only as long as needed to fulfill the purposes outlined in this policy or as required by law (e.g., tax records)
Evidence — We store encrypted copies of uploaded documents, OCR scores, and verification timestamps to maintain an audit trail of our approvals and rejections
Deletion — You may request account deletion through the app. If your account has been flagged for fraud or has outstanding disputes, we review your request against our legal obligations before erasure

8. Data Security

Encryption — All uploaded documents (IDs, logbooks) are encrypted at rest
Access Control — Access to sensitive KYC data is restricted to authorized Trust & Safety agents only
Breach Protocol — We have a response plan to handle any suspected data breach in accordance with the Data Protection Act

9. Your Rights

Under the Kenya Data Protection Act, you have the right to:

Access — Request a copy of the personal data we hold about you
Rectification — Correct false or misleading data (e.g., update a phone number)
Erasure — Request deletion of your data (subject to legal and fraud retention requirements)
Objection — Object to automated decision-making; if you believe your Trust Score was calculated in error, you may request a manual review

To exercise any of these rights, contact us at [email protected].

Roamstead Limited is the data controller responsible for your personal data under this policy.