Privacy policy
1. Who we are
Kitcha Limited, Ikeja, Lagos, Nigeria, is the data controller for the personal data described here. You can reach our data protection contact at admin@kitcha.ng.
2. The law we work under
We process personal data in line with the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission General Application and Implementation Directive 2025. Where we serve people outside Nigeria, other laws such as the UK and EU GDPR may also apply.
3. What we collect
- When you start a plan: your name, email, area of Lagos, household size and, if you give it, an indicative weekly budget.
- When you make a business enquiry: organisation, your name and role, email and phone, approximate covers and location.
- Once you are a customer: delivery addresses, delivery times, dietary requirements, allergies and any health conditions you tell us about, order history and payment records.
- Automatically: IP address, device and browser information, and pages visited. Analytics only run if you consent. See the cookie policy.
4. Health and dietary data
Allergies, intolerances and health conditions are sensitive personal data under the NDPA. We collect them only because you choose to tell us, only so that your meals are prepared safely, and we do not use them for marketing or share them with advertisers.
5. Why we process it, and our lawful basis
- Consent for marketing, analytics cookies and health or dietary information.
- Contract for delivering the meals you order and taking payment.
- Legal obligation for tax, food safety and accounting records.
- Legitimate interest for fraud prevention and improving our service, where that does not override your rights.
6. How area data is used
We use the area you give us to decide the order in which we open parts of Lagos. It is aggregated for planning. We do not sell it and we do not publish anything that identifies you.
7. Who we share it with
Payment processors, delivery and logistics systems, email and hosting providers, and analytics providers where you have consented. Each is bound by a written agreement. We do not sell personal data to anyone.
8. Transfers outside Nigeria
Some providers store data outside Nigeria. Where that happens we rely on the transfer conditions in Part IX of the NDPA, including adequacy, contractual safeguards or your explicit consent.
9. How long we keep it
Waiting list details are kept until you ask us to delete them or for 24 months after our last contact, whichever is sooner. Customer and transaction records are kept for the period required by Nigerian tax and food safety law. Consent records are kept as proof of compliance.
10. Your rights
You may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent at any time, and withdrawal does not affect processing that already happened lawfully. Use the data request page or write to admin@kitcha.ng. We respond within 30 days.
You may also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
11. Security and breaches
We use encryption in transit, access controls and vendor agreements. If a breach occurs that is likely to harm you, we notify the NDPC within 72 hours of becoming aware and will tell you where the law requires it.
12. Children
Kitcha accounts are for adults. Where a plan feeds children in a household or a school, the account holder or the institution provides that information as the responsible adult.
13. Changes
We will post any changes here and update the date at the top. Material changes will be emailed to you.
