Tumalock Deal values your privacy and is fully committed to protecting your personal data. This Privacy Policy outlines how we collect, store, use, disclose, and safeguard your personal information when you interact with our platform or use any of our services. Our practices comply with the Data Protection Act, 2019 (Kenya) and other applicable regulations.
Tumalock is a Kenyan-based escrow platform that provides a secure and trustworthy payment system between buyers and sellers. We hold funds in a trust account until the buyer confirms receipt of goods or services. This process ensures financial safety and reduces fraud.
By using Tumalock's platform or services, you acknowledge that you have read, understood, and accepted the practices and policies outlined in this Privacy Policy.
2. INFORMATION WE COLLECT
Tumalock collects only the personal data that is relevant and necessary for the operation and facilitation of its secure transaction services. The following personal data may be collected:
Full legal name
National ID or Passport number
Phone number (primary M-Pesa line and alternative contact)
Email address
Geographical location (where applicable)
M-Pesa transaction reference numbers
Usernames and passwords
Device information (IP address, browser type)
Records of communications with Tumalock (SMS, email, call logs)
We may also collect additional information through optional forms or when resolving disputes.
3. HOW WE USE YOUR INFORMATION
We use your information to provide safe and efficient services and improve user experience. Specifically, we use your data to:
Facilitate secure escrow transactions between buyers and sellers
Verify identity and reduce instances of fraud
Communicate updates about your transaction status via SMS and email
Notify both parties (buyer and seller) about payments, deliveries, or delays
Enhance system security and user verification processes
Provide personalized user experiences, services, and customer support
Improve service delivery through analytics and feedback
Send optional promotional messages and platform updates (you may opt out)
Comply with regulatory and legal obligations
4. LEGAL BASIS FOR PROCESSING
Your explicit consent provided during registration or use
Contractual necessity for your transactions
Legal obligations (KRA, KYC, AML compliance)
Legitimate interest such as fraud prevention and service improvement
5. DATA SHARING AND DISCLOSURE
With Tumalock agents or staff involved in processing your transactions
With Safaricom (M-Pesa) or other payment providers
With law enforcement or regulators when required by law
With third-party service providers (under strict confidentiality agreements)
With your explicit consent or as requested by you
6. DATA SECURITY MEASURES
SSL encryption for all communication
Firewalls and role-based access control
Regular security audits and vulnerability assessments
Encrypted data storage and user authentication protocols
However, no system is completely immune to threats. Users are advised to safeguard their login credentials and promptly report any suspicious activity.