TUMALOCK ESCROW PRIVACY POLICY

Effective Date: 29 August 2026
Website: https://www.tumalock.com
Contact: care@tumalock.co.ke | 0711112018

1. INTRODUCTION

Tumalock Escrow values your privacy and is fully committed to protecting your personal data. This Privacy Policy outlines how we collect, store, use, disclose, and safeguard your personal information when you interact with our platform or use any of our services. Our practices comply with the Data Protection Act, 2019 (Kenya) and other applicable regulations.

Tumalock is a Kenyan-based escrow platform that provides a secure and trustworthy payment system between buyers and sellers. We hold funds in a trust account until the buyer confirms receipt of goods or services. This process ensures financial safety and reduces fraud.

By using Tumalock's platform or services, you acknowledge that you have read, understood, and accepted the practices and policies outlined in this Privacy Policy.

2. INFORMATION WE COLLECT

Tumalock collects only the personal data that is relevant and necessary for the operation and facilitation of its secure transaction services. The following personal data may be collected:

Full legal name
National ID or Passport number
Phone number (primary M-Pesa line and alternative contact)
Email address
Geographical location (where applicable)
M-Pesa transaction reference numbers
Usernames and passwords
Device information (IP address, browser type)
Records of communications with Tumalock (SMS, email, call logs)
Transaction metadata (items, price, seller/buyer contacts, timestamps)
Verification records — the fact and timestamp of successful SMS One-Time-Password (OTP) verification of your phone number, along with the current status of your account (pending, active, or suspended). Actual OTP values are not retained after use.
Administrative audit trail — where an administrator changes a verified phone number, verified email, or the suspension status of an account, the action, the administrator’s identifier and the timestamp are logged for security and dispute-resolution purposes.

We may also collect additional information through optional forms or when resolving disputes.

3. HOW WE USE YOUR INFORMATION

We use your information to provide safe and efficient services and improve user experience. Specifically, we use your data to:

Facilitate secure escrow transactions between buyers and sellers
Verify identity and reduce instances of fraud
Communicate updates about your transaction status via SMS and email
Notify both parties (buyer and seller) about payments, deliveries, or delays
Enhance system security and user verification processes
Provide personalized user experiences, services, and customer support
Improve service delivery through analytics and feedback
Send optional promotional messages and platform updates (you may opt out)
Comply with regulatory and legal obligations

4. LEGAL BASIS FOR PROCESSING

Your explicit consent provided during registration or use
Contractual necessity for your transactions
Legal obligations (KRA, KYC, AML compliance)
Legitimate interest such as fraud prevention and service improvement

5. DATA SHARING AND DISCLOSURE

With Tumalock agents or staff involved in processing your transactions
With Safaricom (M-Pesa) or other payment providers
With law enforcement or regulators when required by law
With third-party service providers (under strict confidentiality agreements)
With your explicit consent or as requested by you

6. DATA SECURITY MEASURES

SSL encryption for all communication
Firewalls and role-based access control
Regular security audits and vulnerability assessments
Encrypted data storage and user authentication protocols
SMS One-Time-Password (OTP) verification of phone-number ownership before an account may transact
A second SMS authorization code required from a Tumalock administrator before any sensitive account change (edit of a verified phone or email, suspension, or reinstatement) can be applied
Hashed, single-use, short-lived storage of authorization codes — the plaintext code is never retained

However, no system is completely immune to threats. Users are advised to safeguard their login credentials and OTP codes. Tumalock will never call, WhatsApp, SMS or email you asking for your OTP or password. Anyone who does is attempting to defraud you and should be reported to Tumalock immediately.

7. DATA RETENTION

We retain your personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, comply with our legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Transaction records are typically retained for a minimum of seven (7) years in line with Kenyan financial and record-keeping regulations. Where data is no longer required, it is securely deleted or anonymised.

8. YOUR RIGHTS AS A DATA SUBJECT

Under the Data Protection Act, 2019 (Kenya), you have the right to:

Be informed about how your personal data is used.
Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your data (subject to legal and regulatory limits).
Object to or restrict the processing of your data.
Withdraw consent at any time, where processing is based on consent.
Lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of these rights, contact us using the details in Section 15. We will respond to verified requests within the timelines required by law.

9. COOKIES AND TRACKING TECHNOLOGIES

Our website and services may use cookies and similar technologies to keep you signed in, remember your preferences, analyse traffic, and improve performance. You may disable non-essential cookies through your browser settings; disabling essential cookies may affect the operation of certain features such as login and secure transactions.

10. THIRD-PARTY SERVICES

Tumalock Escrow relies on trusted third-party providers to deliver core services, including Safaricom (M-Pesa) for payment processing, SMS gateways for notifications, cloud hosting providers for data storage, and analytics providers for performance monitoring. These providers process personal data strictly under contract and are not permitted to use it for their own purposes. Their own privacy policies also apply to their processing activities.

11. INTERNATIONAL DATA TRANSFERS

Some of our service providers may host or process data outside Kenya. Where such transfers occur, we ensure appropriate safeguards are in place — such as data processing agreements, encryption in transit and at rest, and reliance on providers that meet recognised international data protection standards — so that your data continues to be protected at a level consistent with the Data Protection Act, 2019.

12. CHILDREN'S PRIVACY

Tumalock Escrow services are not intended for individuals under the age of eighteen (18). We do not knowingly collect or process personal data belonging to minors. If we become aware that personal data relating to a minor has been submitted, we will delete it promptly and, where required, notify the affected party.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our services, our practices, or applicable laws. The updated version will be posted on our website with a revised Effective Date. Where the changes are material, we will take reasonable steps to notify you (for example, by SMS, email, or an in-app notice) before the changes take effect.

14. GOVERNING LAW

This Privacy Policy is governed by and interpreted in accordance with the laws of the Republic of Kenya, including the Data Protection Act, 2019 and the Constitution of Kenya. Any dispute arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Kenya.

15. CONTACT US

Data Protection Officer - Tumalock

Email: care@tumalock.co.ke

Phone: 0711112018

Website: https://www.tumalock.com

TUMALOCK - SIMPLE. SAFE. FAST.
Empowering Secure E-commerce in Kenya.