Kitcha Privacy Policy

1. Introduction, Scope and Acceptance

1.1 Purpose and Scope

This Policy explains how Kitcha Limited processes personal information in connection with accounts, ordering, meal plans, fulfilment, delivery, customer support, corporate services, security and related operations.

In this Policy, "Kitcha," "we," "us" and "our" mean Kitcha Limited. "Processes" and "processing" carry the meaning given in section 3, and extend to collection, receipt, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, alignment, combination, restriction, erasure and destruction. The operations referred to above include subscriptions, food production, quality control, packaging, dispatch, institutional services and fraud prevention.

This Policy is written to be read and understood by the people whose information it describes. It is also written to be complete. Where a matter is capable of being stated expressly, it is stated expressly, so that no customer, regulator, counterparty or court is left to infer what Kitcha does with personal information.

1.2 Who this Policy applies to

This Policy applies to the personal information of:

• Individuals who create, hold, operate or are named on a Kitcha account;
• Individuals who place an order, whether or not they hold an account, including guest and assisted orders where such facilities are offered;
• Individuals who are fed under a plan created by another person, including members of a household, dependants, children fed through a parent or guardian, and employees fed under a corporate or institutional arrangement;
• Individuals named as recipients of a delivery, including persons authorised to receive food on behalf of another;
• Individuals who contact Kitcha customer support, submit a complaint, report an incident, or make a data-protection request, whether or not they are customers;
• Individuals who visit Kitcha websites, install or use Kitcha applications, or otherwise interact with Kitcha digital services;
• Individuals who subscribe to, or who are lawfully sent, Kitcha communications;
• Representatives, contacts, administrators and authorised signatories of corporate and institutional customers.

1.3 What this Policy does not cover

This Policy does not govern:

• The processing of personal information by Kitcha in its capacity as an employer, which is addressed in the Kitcha Employee Data Privacy Notice provided to staff;
• The processing of personal information by an independent third party under that third party's own privacy policy, including a bank, payment provider, device manufacturer, operating system provider, application store, network operator or website that you reach by following a link from a Kitcha service;
• Information that does not identify and cannot reasonably be used to identify a living individual, including aggregated, statistical and anonymised information from which identifiers have been irreversibly removed.

1.4 Acceptance and consent

By creating a Kitcha account, placing an order, enrolling in a plan, submitting information to Kitcha, or otherwise using a Kitcha service, you acknowledge that you have been informed of the matters set out in this Policy.

Acknowledging this Policy is not, by itself, consent to every processing activity described in it. Kitcha relies on consent only where consent is the lawful basis identified for that activity in section 6, and where consent is required, it is obtained separately, specifically, and by a clear affirmative action. Where Kitcha relies on a lawful basis other than consent, withdrawing consent does not affect that processing.

1.5 Relationship to other Kitcha documents

This Policy forms part of a set of public Kitcha documents. Where the subject matter of this Policy overlaps with another document, the following order of precedence applies:

1. Mandatory Nigerian law prevails over every Kitcha document without exception;
2. This Policy controls all questions concerning Kitcha's processing of personal information;
3. The Kitcha Cookie Policy controls cookies, software development kits, local storage and similar technologies, and is incorporated into this Policy by reference;
4. The Kitcha Food Safety, Allergen and Dietary Notice controls product safety and ingredient and allergen information;
5. The Kitcha Terms of Use control matters not specifically controlled by a more specific applicable document;
6. A signed commercial agreement controls the commercial relationship where one applies to a corporate or institutional customer.

2. Controller Identity and Contact

2.1 Data controller

The data controller responsible for the personal information described in this Policy is:

Kitcha Limited
Registration number: RC9540250
Registered office: 11B Oko Awo Street, Victoria Island, Lagos, Nigeria

Kitcha is a vertically integrated food production, fulfilment, logistics and technology company. Kitcha operates its own production factory, its own quality control, packaging and dispatch functions, its own delivery capability, and its own operational technology. Kitcha is not a third-party marketplace and does not list or broker the products of independent sellers to customers.

The consequence of that operating model for this Policy is that Kitcha determines the purposes and means of processing across the whole chain from procurement to delivery, and accepts controller responsibility across that chain, rather than attributing responsibility to third-party vendors.

2.2 Contact channels

Privacy and data-protection contact: admin@kitcha.ng. Customer support and complaints: support@kitcha.ng.

Expanded, those channels are used as follows.

These are the only contact addresses Kitcha publishes for the purposes described. Correspondence sent to an address that is not listed above may not reach the responsible function and may not be treated as validly served.

2.3 Supervisory authority

Kitcha's processing of personal information is subject to the supervision of the Nigeria Data Protection Commission ("NDPC"), established under the Nigeria Data Protection Act 2023 ("NDPA"). You have the right to lodge a complaint with the NDPC at any time, and you are not required to complain to Kitcha first, although section 22 explains why doing so is usually faster.

3. Definitions

In this Policy, the following terms have the following meanings. Where a term is defined in the NDPA, the statutory meaning prevails.

Headings are for navigation only and do not limit the text beneath them. Words in the singular include the plural and the reverse. "Including" means "including without limitation." References to a statute include that statute as amended, extended or re-enacted.

4. Information We Process

This section sets out every category of personal information Kitcha processes, with examples and the purpose for which it is held. The summary table is followed by detailed treatment of each category.

4.1 Identity and account information

Kitcha processes the information necessary to establish who holds an Account, to distinguish one Account from another, to contact the Account holder about the service, and to satisfy itself that an Account is being used by the person entitled to use it. This includes:

• Given name, surname and any name by which you ask to be addressed;
• Mobile telephone number and email address, and the verification status of each;
• The unique account identifier assigned by Kitcha systems;
• Authentication attributes, including the fact that a password has been set, the date it was last changed, and records of one-time password issue and use. Kitcha does not store your password in a readable form;
• Account status, including whether the Account is active, restricted, suspended, dormant or closed, and the reason recorded for that status;
• Roles and permissions, including whether the Account holder is an individual, a household organiser, or a corporate or institutional administrator;
• Preferred language, locale and accessibility preferences where offered.

4.2 Orders and transaction information

Every order placed through a Kitcha service creates a transaction record. That record includes:

• The products ordered, their quantity, portion size and configuration;
• The date and time the order was placed, edited, cancelled or cleared, together with the identity of the Account that performed each act;
• The amounts charged, including product price, applicable charges and any taxes collected;
• Payment status, refund status, credit status and reconciliation outcome;
• The delivery window selected and the recipient nominated;
• The production, quality control, packaging, dispatch and delivery events associated with that order, recorded through Kitcha's barcode and digital traceability systems;
• Any complaint, investigation, remedy or dispute associated with that order.

Kitcha's traceability systems record the authorised personnel associated with operational events. Those records identify Kitcha staff, not customers, and exist so that a specific meal can be traced through the whole chain if a question about it arises.

4.3 Meal plan information

Where you operate a plan, Kitcha processes the information necessary to run it, including the plan type and period, the timetable of meals, the allocation of meals to named individuals, the delivery destination selected for each meal, stated preferences and exclusions, pause, skip and change instructions, the budget you have set where you have set one, and the renewal, amendment and cancellation history of the plan.

4.4 Delivery information

To deliver food to the correct place, at the correct time, to the correct person, Kitcha processes:

• Delivery addresses, which may include a home, a workplace, a school or another nominated destination, together with any label you give them;
• Access instructions, gate and entry details, landmarks and directions you provide;
• The name and contact details of the intended recipient, including a recipient who is not the Account holder;
• Delivery window selections and any instruction you give about handover;
• Dispatch, route, arrival, attempt, handover, exception and proof-of-delivery records, which may include the time of each event and the member of the delivery team responsible;
• Location information associated with a delivery in progress, where and to the extent necessary to complete or evidence that delivery;
• Verification events, including the scanning of the code carried on Kitcha packaging at handover.

4.5 Dietary, allergy and health-related information

Kitcha processes the dietary, allergy, intolerance and related information you choose to provide, for each person to be fed. This category is addressed separately and in full in section 7 because of the additional protection it attracts.

4.6 Communications

Kitcha processes the content and metadata of communications between you and Kitcha, including support messages, complaints, incident reports, photographs and other files you attach, feedback and ratings, and the record of what Kitcha did in response. Communications are retained as the evidential record of what was reported, when, and how it was handled.

4.7 Security and device information

Kitcha processes information generated by your use of its digital services for the purposes of security, fraud prevention, abuse prevention, service reliability and diagnosis of faults. This includes authentication and session events, internet protocol address, network and connection information, device and application identifiers, operating system and application version, crash and error diagnostics, and security logs recording access to and activity within Kitcha systems.

4.8 Payment information

Kitcha processes payment status, transaction reference, amount, currency, timing and reconciliation information necessary to confirm that a payment succeeded, to fulfil the associated order, to process refunds and credits, to prevent fraud, and to keep the accounting records required of it by law. Section 9 explains what Kitcha does and does not see.

4.9 Marketing preference information

Kitcha records your consent and opt-out status for each category of non-service communication, the date and channel on which that status was set or changed, and your interactions with communications lawfully sent to you. Kitcha retains records of withdrawal of consent specifically so that it can demonstrate that a withdrawal was made and honoured.

4.10 Information about other people that you provide

Where you provide personal information about another individual, including a member of your household, a dependant, a child, an employee, a colleague or a nominated recipient, you confirm that you are entitled to provide it and that you have informed that individual of the matters set out in this Policy, or that you are lawfully entitled to act for them.

Kitcha processes such information for the purpose for which you provided it and for no unrelated purpose. An individual about whom you have provided information retains every right described in section 13 in respect of that information, exercisable directly against Kitcha.

4.11 Information Kitcha does not collect

Kitcha does not knowingly collect, and asks that you do not provide:

• Payment personal identification numbers, passwords, card verification values or one-time passwords, which Kitcha will never request;
• Medical records, clinical notes, diagnostic reports or prescriptions, unless Kitcha has specifically requested a defined document for a defined lawful purpose and has explained that purpose to you;
• Information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, none of which Kitcha requires in order to feed you, except to the extent that a dietary requirement you choose to state necessarily discloses a belief, in which case Kitcha processes it only as a dietary requirement and for no other purpose;
• Biometric identifiers, save where a device-level authentication method you enable on your own device is used to unlock the Kitcha application, in which case the biometric is processed by your device and is not transmitted to or stored by Kitcha.

5. Sources of Information

Kitcha obtains personal information from the following sources and from no others.

• You, when you create an account, order, communicate with Kitcha or submit information.
• Your device/browser/application through technical and security functions.
• Kitcha operational systems when transactions, delivery and support events occur.
• Authorised representatives and lawful third-party providers where information is needed for a disclosed purpose.

Each of those four sources is set out in full below.

5.1 From you

• When you create an Account or update its details;
• When you build, amend, pause or cancel a plan;
• When you place, edit, cancel or clear an order;
• When you enter dietary, allergy or related information for yourself or for another person you are entitled to enter it for;
• When you add or change a delivery address, recipient or access instruction;
• When you fund or withdraw from your wallet, or add or remove a funding method;
• When you contact support, submit a complaint, report an incident, respond to a survey, or make a data-protection request;
• When you set or change a communication preference.

5.2 From your device, browser or application

Through technical and security functions necessary to operate the service, as described in section 4.7 and in the Kitcha Cookie Policy.

5.3 From Kitcha operational systems

When transaction, production, quality control, packaging, dispatch, delivery, handover and support events occur, Kitcha systems generate records associating those events with the relevant order and, through it, with the relevant Account.

5.4 From authorised representatives and lawful third parties

• From an individual authorised to act on your behalf, or on behalf of a household or organisation of which you are a member;
• From a corporate or institutional customer that has arranged feeding for you, in respect of the information necessary to provide that feeding;
• From banks, payment providers and payment infrastructure, in respect of payment status, reference, amount and reconciliation information;
• From communications providers, in respect of the delivery status of a message sent to you;
• From security, fraud-prevention and verification providers, in respect of information needed to confirm identity or to detect and prevent unlawful activity;
• From a regulator, law enforcement agency, court or other competent authority, where information is lawfully provided to Kitcha;
• From a person who reports an incident concerning you, including a member of your household or a recipient of food ordered by you.

Kitcha does not purchase personal information from data brokers, list vendors or information resellers, and does not enrich customer records with personal information acquired from commercial data suppliers.

6. Purposes and Lawful Bases

Kitcha processes personal information on a lawful basis appropriate to the activity. Depending on the processing, this may include contract performance, legal obligation, consent where required, protection of vital interests in an appropriate emergency, legitimate interests that do not override applicable rights, or another lawful basis recognised by Nigerian data-protection law.

The table below states, for each purpose, what Kitcha does and the basis on which it does it. Where the basis is legitimate interests, the interest is named, so that you can assess it and object to it under section 13.

6.1 Purpose limitation

Kitcha does not process personal information for a purpose that is incompatible with the purpose for which it was collected. Where Kitcha proposes to process personal information for a genuinely new purpose, it will identify a lawful basis for that purpose and, where the basis is consent, obtain consent before doing so.

6.2 Data minimisation

Kitcha collects the information it needs to perform the function described and does not require information that is not necessary for that function. Where a field is optional, it is presented as optional, and declining to complete it does not prevent you from using the service, save where the information is genuinely necessary, in which case the consequence of declining is stated at the point of collection.

6.3 Accuracy

Kitcha takes reasonable steps to keep personal information accurate and up to date, and provides facilities for you to correct it yourself. You are asked to keep your contact details, delivery details and dietary information current, because food is produced and delivered on the basis of what is recorded.

6.4 What Kitcha does not do

• Kitcha does not sell personal information;
• Kitcha does not rent, trade or licence personal information to advertisers, data brokers or information resellers;
• Kitcha does not use allergy, dietary or health-related information to target advertising or marketing;
• Kitcha does not use personal information to make a decision producing legal or similarly significant effects solely by automated means, except as described in section 14.

7. Dietary, Allergy and Sensitive Personal Information

7.1 Why this section exists

Some dietary or allergy information may constitute sensitive personal information depending on its content and applicable law. Information that an individual is allergic to a named food, or must avoid a named ingredient for a medical reason, may reveal information about that individual's health. Kitcha treats this category with additional care, and this section states expressly what Kitcha does with it.

7.2 Lawful basis

Where Kitcha processes personal data that is sensitive personal information under applicable law, Kitcha obtains consent where the law requires consent or relies on a lawful statutory exception where one applies.

One such exception is the protection of vital interests, which may apply where a person's life or health is at stake and consent cannot be obtained in time.

You give consent by entering the information into the field provided for it, having been told at that point what it will be used for. Consent is specific to the purpose of producing and delivering food that is safe for the named person.

7.3 What Kitcha does with it

• Selects or excludes recipes and ingredients for the named person;
• Instructs the production factory to prepare that person's food on separate boards and in separate containers to reduce cross-contact;
• Passes the relevant restriction to the kitchen staff and quality control officers who need it in order to produce the meal safely;
• Records the restriction against the relevant order so that it can be verified before dispatch;
• Uses it in the investigation of any reported reaction, illness or incident involving that person.

7.4 What Kitcha does not do with it

• Kitcha does not use it for marketing, advertising, profiling or audience segmentation;
• Kitcha does not disclose it to anyone outside Kitcha except where necessary to respond to a medical emergency, to comply with a legal obligation, or to establish, exercise or defend a legal claim;
• Kitcha does not use it to assess your creditworthiness, employability, insurability or eligibility for any service.

7.5 Access within Kitcha

Kitcha limits access to persons and systems that need the information for the defined service, food-safety or legal purpose.

Access is controlled by role. A member of the kitchen team can see a restriction that affects the meal they are producing. A member of the delivery team does not need a medical reason and is not shown one. Wallet balances are not visible to production or delivery staff.

7.6 What you should not send

Customers should not provide unrelated medical records unless specifically requested for a defined lawful purpose.

Kitcha does not need your diagnosis, your clinical notes, your prescriptions or your test results in order to cook around an allergy. It needs to know what must not be in the food.

7.7 Withdrawal and its consequences

You may withdraw consent to Kitcha's processing of dietary and allergy information at any time, by removing it in the application or by writing to admin@kitcha.ng. Withdrawal takes effect for future processing and does not make unlawful any processing carried out before it.

7.8 Food and nutrition information is not medical advice

Kitcha food, nutrition and wellness information is not medical diagnosis or treatment. Nutritional values published by Kitcha are close estimates derived from its own recipes at the portion size supplied, not laboratory analysis. Unsupported therapeutic or disease-related claims are not made through ordinary Kitcha food service. If you have a medical condition, take advice from a qualified health professional about your diet.

8. Sharing and Service Providers

8.1 Principle

Kitcha discloses personal information only where disclosure is necessary and lawful, only to the extent necessary for the stated purpose, and only to recipients bound by obligations of confidentiality and security appropriate to the information disclosed. Kitcha does not sell personal information.

8.2 Categories of recipient

Kitcha may disclose relevant information to banks, payment providers, hosting/cloud providers, mapping and communications providers, security/fraud providers, delivery/logistics systems, customer-support providers, professional advisers, insurers, regulators, law enforcement or other recipients where disclosure is necessary and lawful.

Each category is set out below with the purpose for which disclosure is made.

8.3 Controls applied to service providers

Where Kitcha engages a provider to process personal information on its behalf, Kitcha requires that the provider:

1. Processes the information only on Kitcha's documented instructions;
2. Applies technical and organisational security measures appropriate to the risk;
3. Imposes confidentiality obligations on the persons it authorises to process the information;
4. Does not engage a further processor without authorisation, and imposes equivalent obligations on any further processor it is authorised to engage;
5. Assists Kitcha in responding to data subject requests and in meeting its security, breach-notification and assessment obligations;
6. Deletes or returns the information at the end of the engagement, subject to any retention required by law.

8.4 Disclosure to law enforcement and regulators

Kitcha discloses personal information to a law enforcement agency, regulator or court where it is legally required to do so, or where disclosure is lawfully permitted and necessary to prevent or investigate a crime, to protect the vital interests of a person, or to establish, exercise or defend a legal claim. Kitcha satisfies itself that a request is properly made and appropriately limited before responding, and discloses only what is within the scope of the request.

8.5 What Kitcha will not disclose

• Kitcha does not disclose your allergy or health-related information to advertisers, data brokers or analytics providers;
• Kitcha does not disclose your contact details to another customer;
• Kitcha does not disclose your wallet balance or transaction history to production or delivery personnel;
• Kitcha does not disclose personal information to a third party for that party's own marketing purposes.

9. Payment Processing

9.1 How payment works

Food is paid for from your Kitcha wallet. Your money is not held by Kitcha. It sits in a real bank account: the wallet runs on Embedly, a Sterling Bank service licensed by the Central Bank of Nigeria. Cards, bank transfers and other funding methods are used to fund the wallet, not to pay for individual meals.

9.2 What Kitcha receives

Kitcha uses third-party payment infrastructure. Kitcha may receive payment status, reference, amount and reconciliation information needed to reconcile an order.

That information is used to confirm that a payment succeeded, release the order for production, process a refund or credit, prevent fraud, and keep the accounting records required of Kitcha by law.

9.3 What Kitcha does not receive or store

Kitcha does not receive or store your full payment card number, card verification value, card personal identification number, banking password or one-time password. Those are handled by the payment provider under its own security obligations and its own regulatory supervision.

9.4 Refunds and credits

Where a refund or credit is due, Kitcha processes it to the wallet from which the payment was made, and records the reason, the amount and the date. You may withdraw the balance of your wallet to your own bank account in accordance with the Terms of Use. The record of the refund is retained as part of the transaction record.

9.5 Payment disputes

Where you raise a dispute with your bank or card provider, Kitcha may be required to provide that institution with transaction records, delivery evidence and correspondence in order to respond. Kitcha provides what is necessary and relevant to the dispute and no more.

10. Cross-Border Processing

10.1 Position

Where personal information is transferred to or accessed from another country, Kitcha uses the lawful transfer mechanism and safeguards required by applicable Nigerian data-protection law.

10.2 Why a transfer may occur

A transfer or foreign access may occur because a service provider engaged by Kitcha stores information, or provides technical support, from outside Nigeria. Examples include cloud hosting infrastructure, communications platforms and security services.

10.3 Safeguards

Before personal information is transferred outside Nigeria, Kitcha satisfies itself that one of the following applies:

1. The recipient country, sector or organisation is subject to a determination of adequate protection under the NDPA;
2. The transfer is governed by contractual terms imposing protection equivalent to that required under Nigerian law, including binding security, confidentiality, sub-processing and assistance obligations;
3. The transfer is necessary for the performance of a contract with you, or for the performance of a contract concluded in your interest;
4. The transfer is necessary to establish, exercise or defend a legal claim, to protect vital interests, or for another lawful ground recognised under the NDPA;
5. You have given consent to the transfer having been informed of the risks.

10.4 Your right to ask

You may ask Kitcha whether your personal information is transferred outside Nigeria and on what basis, by writing to admin@kitcha.ng. Kitcha will tell you the mechanism relied on.

11. Security

11.1 Measures

Kitcha applies technical and organisational measures appropriate to risk, including access controls, authentication, monitoring and incident response.

Those measures include:

• Encryption of personal information in transit between your device and Kitcha systems;
• Access control by role, so that a person can reach only the information their function requires;
• Authentication controls on customer accounts, including one-time passwords for sensitive actions;
• Logging of access to and material changes within Kitcha systems, recording who did what and when;
• Segregation of duties in operational and financial processes, so that a single person cannot both perform and approve a sensitive action;
• Monitoring for unusual access patterns, credential abuse and fraud indicators;
• A documented Personal Data Breach Response Procedure, as described in section 18;
• Confidentiality obligations imposed on personnel and on service providers;
• Review of security controls, including when systems change materially.

11.2 Honest limitation

11.3 Your responsibilities

Customers remain responsible for credentials, devices and account access under their control. In practice this means:

• Keeping your password, one-time passwords and recovery details to yourself;
• Using a password you do not use on any other service;
• Keeping the phone number and email address on your Account current, because they are how Kitcha reaches you and how account recovery works;
• Securing the devices on which you are signed in, and signing out of devices you no longer control;
• Using a household, family or organisational access feature where one is offered, rather than sharing your own credentials;
• Telling Kitcha promptly if you believe your Account has been accessed by someone else, or if you see an order you did not place.

12. Retention and Deletion

12.1 Principle

Kitcha does not retain personal information indefinitely. Personal information is retained for as long as it is needed for the purpose for which it was collected, and then deleted or anonymised, unless a lawful exception requires or permits it to be kept for longer.

12.2 While an account is active

While an account is active, Kitcha retains information reasonably necessary to provide services, maintain relevant history, support transactions, protect food/service safety, maintain security and comply with lawful obligations. This includes the order and plan history you rely on in order to repeat, adjust and account for what you have bought.

12.3 Dormancy

An account becomes dormant after more than six months without qualifying activity. Kitcha may then begin its ordinary account-data deletion lifecycle under its retention and disposal controls, subject to lawful exceptions and system dependencies.

Kitcha's internal retention and disposal schedule is an internal control document and is not published, because publishing a fixed table would either overstate what any system can guarantee or understate what the law requires Kitcha to keep. What is published is this: the purpose test in 12.1, the dormancy trigger in this section, the statutory grounds in 12.5, and your right under section 13 to ask what is held about you and to ask for it to be erased.

12.4 Erasure requests

When a customer submits a valid erasure request, Kitcha initiates the applicable deletion process without undue delay. Closing an account or requesting erasure does not require Kitcha to destroy information that must lawfully remain for a current transaction, reconciliation, fraud prevention, food-safety or security investigation, regulatory requirement, legal hold, or establishment, exercise or defence of legal claims. In those circumstances Kitcha limits retained information to what is reasonably necessary and deletes or anonymises it when the lawful purpose ends.

Each of those grounds is set out below.

1. A current transaction, including an order in production or in transit, or a payment not yet reconciled;
2. Reconciliation of payments, refunds and credits;
3. Fraud prevention, including the prevention of repeat fraud;
4. A food-safety or security investigation, including tracing a batch;
5. A regulatory requirement, including accounting, tax and financial record-keeping obligations;
6. A legal hold, where Kitcha is required to preserve evidence;
7. The establishment, exercise or defence of legal claims.

In those circumstances Kitcha limits retained information to what is reasonably necessary and deletes or anonymises it when the lawful purpose ends.

12.5 Statutory retention grounds

Kitcha is required by law to keep certain records for defined minimum periods. These requirements arise from law, not from Kitcha policy, and they apply to any business of Kitcha's type. They include obligations arising under the Companies and Allied Matters Act 2020 in respect of corporate and accounting records, under Nigerian tax law in respect of tax records and supporting documentation, and under anti-money-laundering and counter-terrorism-financing legislation in respect of customer due diligence and transaction records. Where different periods apply to the same record, Kitcha applies the longest applicable period.

12.6 What erasure actually means

Where Kitcha erases personal information, it is removed from live systems. Where a record must be kept under 12.4 or 12.5, Kitcha reduces it to what the lawful purpose requires. Where the identifying elements are not required for that purpose, they are removed or replaced so that the retained record can no longer be attributed to you without additional information held separately.

Backups are overwritten on their own cycle. Information erased from live systems may persist in a backup until that backup is overwritten in the ordinary course. Kitcha does not restore a backup in order to reinstate information you have asked to be erased.

13. Data Subject Rights

13.1 Your rights

Subject to applicable law, you have the following rights in respect of personal information Kitcha holds about you:

1. Access to personal information and relevant processing information, including the purposes of processing, the categories of information concerned, the recipients or categories of recipient to whom it has been or will be disclosed, the envisaged retention period or the criteria used to determine it, the source of the information where it was not collected from you, and the existence of your other rights.
2. Rectification of inaccurate information, and completion of information that is incomplete, including by providing a supplementary statement.
3. Erasure where applicable, including where the information is no longer necessary for the purpose for which it was collected, where you withdraw the consent on which processing was based and there is no other lawful basis, or where the information has been processed unlawfully.
4. Restriction where applicable, including while the accuracy of information is being verified, or while an objection under this section is being considered. Where processing is restricted, Kitcha continues to store the information but does not otherwise process it except with your consent or for the establishment, exercise or defence of legal claims.
5. Objection to processing where applicable, including direct marketing where applicable. Where you object to direct marketing, Kitcha stops without needing to weigh anything. Where you object to processing based on legitimate interests, Kitcha stops unless it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
6. Data portability where applicable, meaning the right to receive personal information you provided to Kitcha in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
7. Withdrawal of consent where processing depends on consent. Withdrawal is as easy as giving consent, takes effect for the future, and does not affect the lawfulness of processing before it.
8. Rights concerning certain automated decision-making where applicable, as described in section 14.
9. The right to complain to the NDPC or another competent authority where applicable.

13.2 How to make a request

Requests should be sent to admin@kitcha.ng. Kitcha may reasonably verify identity. Where a request is refused or partially fulfilled because a lawful exception applies, Kitcha will explain the basis to the extent the law permits.

A request may also be made through the data request facility published on the Kitcha website. To help Kitcha respond accurately, a request should state:

• Which right you are exercising;
• The account, phone number or email address the request relates to;
• Where the request concerns particular information, enough detail to identify it;
• Where you are acting for another person, evidence of your authority to do so.

13.3 Verification of identity

Kitcha may reasonably verify identity before acting on a request. This exists to protect you: acting on an unverified request is how one person obtains another person's information. Verification is proportionate to the sensitivity of the request, and Kitcha does not use information supplied for verification for any other purpose.

13.4 Timeframe

Kitcha responds to a valid request without undue delay and within the period required by applicable law. Where a request is complex, or where a number of requests have been made, Kitcha may extend the period to the extent the law permits, and will tell you within the original period that it has done so and why.

13.5 Cost

Kitcha does not charge for responding to a request. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, Kitcha may charge a reasonable fee reflecting its administrative costs, or decline to act, and will explain which and why.

13.6 Refusal or partial fulfilment

Where a request is refused or partially fulfilled because a lawful exception applies, Kitcha will explain the basis to the extent the law permits. Kitcha will also tell you that you may complain to the NDPC and that you may seek a judicial remedy.

Circumstances in which a request may be refused or limited include where fulfilling it would:

• Adversely affect the rights and freedoms of another person, including by disclosing that person's personal information;
• Prejudice the prevention, detection, investigation or prosecution of a crime;
• Prejudice an ongoing food-safety or security investigation;
• Require destruction of information Kitcha is legally required to retain, as described in section 12;
• Compromise information subject to legal professional privilege or to a legal hold.

13.7 Rights of people you have entered information about

An individual whose information you have entered, including a member of your household or a nominated recipient, may exercise these rights directly against Kitcha in respect of their own information. Kitcha will verify their identity in the ordinary way and will respond to them directly.

13.8 Complaint to the supervisory authority

You may lodge a complaint with the Nigeria Data Protection Commission at any time, whether or not you have complained to Kitcha first. Exercising that right does not limit any other legal remedy available to you.

14. Automated Processing and Profiling

14.1 Where automation is used

Kitcha may use automated systems for routing, fraud detection, security, forecasting, personalisation and support triage.

In practice this includes:

• Grouping deliveries into efficient routes and estimating arrival times;
• Forecasting how much of each dish to produce, so that food is not wasted and orders can be met;
• Flagging unusual account or payment activity for human review;
• Suggesting dishes, plans or timings based on what you have ordered before;
• Sorting and prioritising incoming support messages so that urgent matters, particularly those concerning food safety, reach a person quickly.

14.2 Human involvement

Decisions that materially affect you are not taken by an automated system alone. Restricting an account, refusing a refund, rejecting a claim or declining service are taken or confirmed by a person, who considers the individual circumstances. Automated systems flag; people decide.

14.3 Your rights

Where applicable law gives rights concerning solely automated decisions with significant effects, Kitcha applies the relevant safeguards and review process.

Those safeguards include the right to be informed that such a decision has been made, to express your point of view, to obtain human intervention, and to contest the decision. To exercise them, write to admin@kitcha.ng.

14.4 Limits on profiling

• Kitcha does not profile customers on the basis of allergy, health or health-related dietary information;
• Kitcha does not sell profiles or make them available to third parties;
• Kitcha does not use profiling to set different prices for the same product for different customers.

15. Children and Household Feeding

15.1 The arrangement

Kitcha may provide food to children through a parent, guardian, household, school, institution or other authorised ordering arrangement.

Children do not hold Kitcha accounts. A child is fed because an adult with authority has arranged it.

15.2 Responsibility of the person ordering

The account holder or organisation placing the order remains responsible for the transaction and information it is authorised to provide. If you enter a child's name, school address, allergy or dietary information, you confirm that you are entitled to do so.

15.3 Consent

Where Kitcha relies on consent to process a child's personal data, Kitcha obtains parent or legal-guardian consent and applies the age and consent verification required by applicable law.

15.4 Minimisation for children

Kitcha collects the minimum necessary to feed a child safely: the name to put on the meal, the place and time to deliver it, and any allergy or dietary requirement. Kitcha does not market to children and does not build marketing profiles of children.

15.5 If a child has created an account

If Kitcha becomes aware that an account has been created by a child, Kitcha will restrict the account, delete the personal information collected through it except where retention is required by law, and contact the parent or guardian where contact details are available. Contact admin@kitcha.ng if you believe this has happened.

16. Cookies, SDKs and Similar Technologies

Cookies, SDKs, local storage and similar technologies are governed by Kitcha's Cookie Policy. Where consent is required, Kitcha provides the applicable preference control. The Cookie Policy forms part of this Policy.

In summary, and without displacing the Cookie Policy:

• Technologies strictly necessary to operate the service, including those that keep you signed in and protect against fraud, are used without consent because the service cannot function without them;
• Technologies used to measure how the service is used are optional and are used only where you have consented;
• You may change your choice at any time through the cookie preference control published on the Kitcha website;
• Withdrawing consent does not affect the lawfulness of use before withdrawal.

17. Marketing and Communications

17.1 Service messages

Kitcha sends messages necessary to operate the service, including order confirmations, delivery notifications, changes to your plan, payment and refund confirmations, security alerts, food-safety notices and notices about changes to this Policy. These are not marketing and you cannot opt out of them while you hold an account, because they are how Kitcha performs the contract and meets its obligations to you.

17.2 Marketing messages

Kitcha sends marketing communications only where you have consented. Consent is recorded against the channel and the category, and can be withdrawn at any time.

17.3 How to stop marketing

• Use the unsubscribe control in any marketing email;
• Change your communication preferences in the Kitcha application;
• Reply to a marketing text message with the stop instruction it carries;
• Write to admin@kitcha.ng.

Withdrawal takes effect as soon as Kitcha can give effect to it. A message already in transit may still arrive.

17.4 Record of withdrawal

When you withdraw consent, Kitcha retains a record that you did so, and when. That record exists so that Kitcha can demonstrate it honoured your withdrawal and so that you are not contacted again in error. It is retained under section 12 and is not used to contact you.

18. Personal Data Breaches

18.1 Procedure

Kitcha maintains a Personal Data Breach Response Procedure. Qualifying breaches are assessed for containment, notification, remediation and evidence preservation in accordance with the applicable statutory requirements and current regulatory framework.

What that procedure requires in practice is set out below.

18.2 What Kitcha does

1. Contains the incident and preserves the evidence needed to understand it;
2. Assesses the nature of the breach, the categories and approximate number of data subjects and records concerned, and the likely consequences;
3. Notifies the NDPC where the breach is of a kind that requires notification, within the period the law requires;
4. Notifies affected individuals where the breach is likely to result in a high risk to their rights and freedoms, describing in clear language what happened, the likely consequences, the measures taken, and what those affected should do;
5. Remediates the cause and records the incident, its effects and the action taken.

18.3 Reporting a suspected breach to Kitcha

If you believe personal information held by Kitcha has been compromised, or that you have received a communication purporting to come from Kitcha that is not genuine, report it to admin@kitcha.ng. Include what you saw, when, and any message or address involved. Kitcha treats these reports as urgent.

19. Third-Party Links and Services

Kitcha services may link to websites, applications or services operated by other organisations, including application stores, mapping services and payment interfaces. Those services are governed by their own privacy policies, not by this one. Kitcha does not control them and is not responsible for their handling of personal information.

Where a third-party service is presented to you separately for your own direct use, that provider's terms may apply to that use in addition to Kitcha's. Using a third-party provider does not transfer to that provider any obligation that applicable law places on Kitcha as controller.

20. Changes, Versioning and Notice

20.1 Changes

Kitcha may update this Policy to reflect legal, operational, service or technology changes. Material changes are versioned and communicated through reasonable means.

The mechanics of versioning and notice are set out below.

20.2 Versioning

This Policy carries the date on which it was last updated, shown at the head of the document. Kitcha retains superseded versions so that the version in force at any past date can be identified, which matters where a question arises about what applied at the time of a particular transaction.

This Policy applies to Kitcha's processing of personal information as a whole and is not limited to processing that began after any particular date. The current version states how Kitcha handles personal information now, including information collected before the current version was published. Superseded versions remain retrievable so that the statement in force at a past date can be established, but the absence of a commencement date does not create a period in which no policy applied.

20.3 How you will be told

• Non-material changes take effect when published, and the last-updated date changes;
• Material changes are notified through a reasonable channel, which may include email, a notice in the Kitcha application or a notice on the website, before they take effect;
• Where a change requires your consent, Kitcha asks for it separately and does not treat continued use as consent.

20.4 No retrospective effect

A change to this Policy does not retroactively remove a right that has already accrued to you, and does not retrospectively authorise processing that was not lawful when it occurred.

21. Applicable Law and Statutory Rights

This Policy operates primarily under the Nigeria Data Protection Act 2023 and applicable NDPC instruments, together with other laws relevant to Kitcha processing activities.

Those other laws include, as relevant to the activity in question, consumer protection legislation and the guidance of the Federal Competition and Consumer Protection Commission, the Companies and Allied Matters Act 2020, Nigerian tax legislation, anti-money-laundering and counter-terrorism-financing legislation, the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, and the regulatory framework applicable to the licensed financial institutions through which payments are made.

Nothing in this Policy excludes, limits or purports to waive a right conferred on you by law which cannot lawfully be excluded, limited or waived. Where any provision of this Policy is inconsistent with such a right, the right prevails and the provision is read down to the minimum extent necessary, with the remainder of this Policy continuing in full force.

22. Complaints, Escalation and Contact

22.1 Raising a concern with Kitcha

If you are unhappy with how Kitcha has handled your personal information, write to admin@kitcha.ng. Say what happened, when, and what you would like Kitcha to do. A person reads it.

22.2 Escalation

If you are not satisfied with the response, say so in reply and ask for the matter to be escalated. It will be reviewed by someone who was not responsible for the original response.

22.3 Complaint to the NDPC

You may complain to the Nigeria Data Protection Commission at any point. You do not have to exhaust Kitcha's process first, and complaining to Kitcha does not limit your right to complain to the NDPC or to seek a judicial remedy.

22.4 Contact