Home About us Privacy policy Terms and condition Contact us Store login Store employee login Browse web

Privacy policy

Home / Privacy policy

PRIVACY POLICY

Last updated: 16 August 2026

This Privacy Policy explains how OYO SOLUTIONS LIMITED, trading as Soko Grocery Delivery ("Soko", "we", "us" or "our"), collects, uses, discloses, stores and protects personal data when you use the Soko customer mobile application, sokogrocery.co.tz, our related websites, customer support and delivery services (together, the "Services").

We are the data controller for the personal data described in this Policy. Our contact details are provided in section 16 below. This Policy should be read together with our Terms and Conditions and any permission notice shown by your device.

1. Scope

This Policy applies to customers, visitors and people who contact Soko. Certain parts also explain customer-facing tracking of delivery personnel. Soko's store, delivery-partner and employee applications may provide additional notices for the information they collect from their users.

2. Personal data we collect

Depending on how you use the Services, we may collect the following:

  • Account and identity data: your name, email address, mobile number, Soko account identifier, profile picture, login method and account status. If you choose Facebook or Apple sign-in, we receive the account information that the provider makes available with your permission. We do not receive your Facebook or Apple password.
  • Order and transaction data: cart contents, products, stores, quantities, prices, discounts, order identifier, order history, payment method, payment status and reference, wallet or loyalty activity, refunds, delivery instructions and records needed to fulfil, support and account for an order.
  • Delivery and location data: saved delivery addresses, contact person details, delivery zone and precise or approximate location when you grant device permission or choose a location on the map. Customers may also see a delivery person's location while an active delivery is being completed.
  • Device and technical data: device type, operating system, app version, language, time zone, IP address, browser type, app-installation or device identifiers, push-notification token, cookie or local-storage identifiers, network and diagnostic information, and security or error logs.
  • Usage and advertising-measurement data: app screens and web pages viewed, searches, stores and products viewed, items added to or removed from a cart, checkout activity, order placement, completed purchases, campaign or referral information and interaction with Soko advertising.
  • Communications and content: messages to customer support, survey or feedback responses, ratings and reviews, and images, microphone or speech input that you choose to provide through an app feature.

Payment providers process payment credentials such as card details, mobile-money credentials or PINs under their own privacy terms and security controls. Soko receives the payment status, reference and other information needed to process and reconcile the order. Please do not send payment PINs or passwords to Soko.

3. How we collect personal data

We collect personal data:

  • directly from you when you register, place an order, contact us or use a feature;
  • automatically from the app, website, cookies, SDKs, server logs and similar technologies;
  • from payment providers, stores, delivery partners and support providers involved in your order;
  • from Apple, Facebook or another identity provider when you choose its sign-in service; and
  • from advertising and analytics providers that report campaign or referral information to us.

4. How and why we use personal data

We use personal data to:

  • create and secure accounts, authenticate users and remember preferences;
  • show available stores and products and confirm that an address is in a Soko service zone;
  • process payments, fulfil and deliver orders, provide order tracking, and handle refunds or disputes;
  • send transactional messages, delivery updates and push notifications;
  • provide customer support and respond to requests;
  • prevent fraud, misuse and security incidents and enforce our terms;
  • understand app and website performance and improve Soko's products and operations;
  • measure whether Soko advertising leads to app activity and paid orders, improve advertising efficiency and prepare aggregated campaign reports;
  • send marketing communications where permitted and manage opt-outs; and
  • meet tax, accounting, regulatory, legal and record-keeping obligations.

Depending on the activity and applicable law, we process personal data because it is necessary to provide the Services or perform a contract with you, because we have your consent, to comply with a legal obligation, or for our legitimate business interests where those interests are not overridden by your rights. These interests include operating and improving Soko, keeping the Services secure, preventing fraud and measuring the effectiveness of Soko's advertising.

5. Firebase Analytics and Google Analytics

We use Google Firebase Analytics in the customer app and Google Analytics on our website to understand how the Services are used. These services may collect app-installation identifiers, device and technical information, approximate location derived from technical data, and events such as login, screen or page views, searches, product views, cart activity, checkout, order placement and paid purchases. When you are signed in, Soko may assign its internal account identifier as an analytics user ID so that activity can be understood across sessions. We do not send your name, email address or phone number as the Google Analytics user ID.

Firebase Analytics is used for product and service measurement. We disable Firebase advertising-personalisation signals in the app. Firebase product analytics may continue even if you decline Apple's App Tracking Transparency request because ATT relates to tracking across companies for advertising, not all first-party product analytics. Logging out removes the Soko account ID from active analytics association, but the app-installation identifier may remain on that device so that an installation is not incorrectly counted as a new app every time someone logs out.

Google processes this data under its own terms and privacy documentation. For more information, see Firebase Privacy and Security and the Google Privacy Policy.

6. Meta App Events

Where enabled, we use Meta App Events (the Meta/Facebook SDK) to measure actions in the Soko app, such as viewing a product or store, adding an item to a cart, beginning checkout, placing an order and completing a paid purchase. Meta may use permitted device or advertising identifiers, the Soko account identifier, event details and campaign information to match activity to a Meta account, attribute conversions, prepare campaign reports, optimise Soko advertising and, subject to your settings and applicable law, personalise advertising.

Meta App Events is disabled until the app has confirmed that you are using Soko in a supported service zone. On iOS, it is enabled only after you allow tracking through Apple's ATT prompt. If you decline, Meta App Events and advertiser-ID collection remain disabled in the iOS app. Declining does not prevent you from browsing, ordering or using paid features.

Facebook Login is a separate authentication feature. Choosing Facebook Login does not itself mean that you have granted ATT permission for advertising tracking.

7. Apple's App Tracking Transparency

On supported Apple devices, ATT asks whether Soko may link information from the app with information from other companies' apps, websites or offline properties for advertising measurement or targeted advertising. We request ATT permission before enabling Meta tracking in the iOS app. You may decline without losing access to the Service and may change your choice later in iOS Settings > Privacy & Security > Tracking.

An ATT choice does not stop processing that is necessary to create an account, fulfil an order, prevent fraud or provide customer support. It also does not by itself disable Firebase product analytics as described above. For data originating from the iOS app, we do not use server-side advertising measurement or hashed contact information to circumvent a decision not to allow tracking.

8. Hashed server-side advertising measurement

When an eligible order is confirmed as paid, Soko may use Meta's Conversions API to send a server-side purchase event for advertising attribution, aggregated reporting and campaign optimisation. This is particularly useful when payment is confirmed after the order was placed, such as an eligible cash-on-delivery or offline-payment order.

The server-side event may include:

  • the order identifier used as a conversion event identifier;
  • the event time, purchase value, currency and action source;
  • product identifiers, quantities, categories or store/content information; and
  • matching data such as email address, phone number, first and last name, Soko account identifier and country, after normalisation and one-way SHA-256 hashing by Soko before transmission.

Hashing reduces the disclosure of contact details in plain text, but hashed data is still personal data and is not anonymous: Meta may compare a hash with corresponding information in its systems to identify a match. We do not include payment-card details, mobile-money PINs or your full delivery address in this server-side advertising event. Meta states that contact information supplied for matching is deleted after the matching process, while event data may be used and retained under the Meta Business Tools Terms.

Meta's Conversions API is not used to bypass ATT, device privacy settings or applicable data-protection requirements. More information is available in the Meta Privacy Policy and Meta Business Tools Terms.

9. Website cookies, pixels and similar technologies

Our website uses cookies and local storage for account sessions, security, preferences and shopping-cart functions. It may also use Google Analytics, Google Tag Manager and the Meta Pixel to collect page, campaign and shopping events for analytics and advertising measurement. These technologies may read or set identifiers in your browser where permitted.

You can restrict or delete cookies using your browser controls, although necessary cookies are required for some website functions. You can also use Google's Analytics opt-out tool and review your activity settings on Meta. These controls apply to the relevant provider and do not delete your Soko account.

10. When we disclose personal data

We may disclose personal data only as reasonably necessary to:

  • stores, delivery personnel and other fulfilment partners handling your order;
  • payment, messaging, hosting, mapping, support, security and technical-service providers;
  • Google and Meta for the analytics and advertising-measurement purposes described above;
  • professional advisers, auditors, insurers and potential transaction partners under appropriate confidentiality duties;
  • regulators, courts, law-enforcement bodies or other authorities when required by law or necessary to protect rights and safety; or
  • a buyer or successor in connection with a merger, financing, restructuring or transfer of all or part of our business, subject to applicable safeguards.

We do not sell personal data. Our service providers and partners may process data only for the purposes described in this Policy, their applicable terms and the instructions or permissions governing the relevant service.

11. International data transfers

Some technology providers, including Google and Meta, may process personal data in countries outside Tanzania. Privacy and data-protection laws in those countries may differ from Tanzanian law. We handle cross-border transfers in accordance with applicable Tanzanian requirements, including data-minimisation, contractual, technical and organisational safeguards and regulatory permit or authorisation requirements where applicable.

12. Data retention

We retain personal data only for as long as reasonably necessary for its purpose:

  • account and profile data are normally kept while the account remains active;
  • order, payment-status, refund, tax and accounting records are kept for the period required by law and for fraud prevention, reconciliation and dispute handling;
  • customer-support records are kept for as long as needed to resolve and document the matter;
  • Firebase and Google Analytics event-level data are retained according to the retention settings configured for our analytics property; aggregated reports may remain for longer;
  • Meta states that Business Tools event data may be retained for up to two years under its terms; and
  • our server-side conversion-delivery ledger may be retained with the related transaction record to prevent duplicate reporting and maintain an audit trail.

We may retain information for longer where required by law, a legal hold, an unresolved dispute, fraud prevention or security needs. When retention is no longer necessary, we delete, anonymise or securely isolate the data. Limited copies may remain temporarily in protected backups until their normal deletion cycle is completed.

13. Your choices and rights

Subject to applicable law and any lawful limitations, you may have the right to be informed, access your personal data, correct inaccurate data, request deletion, restrict or object to processing, receive portable data, withdraw consent, object to direct marketing, obtain information about automated processing, and complain about our handling of personal data.

You can exercise choices by:

  • changing location, camera, microphone, notification or tracking permissions in your device settings;
  • using iOS tracking settings and the browser or provider controls described above;
  • using an unsubscribe link or contacting us to stop direct marketing;
  • editing information in your Soko profile;
  • using Delete Account in your profile to request account deletion; or
  • emailing info@sokogrocery.co.tz.

We may need to verify your identity before fulfilling a request. Deleting an account does not require us to erase transaction or legal records that we must retain, and it may not remove data that has already been irreversibly aggregated or anonymised. You may also complain to Tanzania's Personal Data Protection Commission (PDPC).

14. Children

Soko membership and ordering are not intended for people under 18 years of age. We do not knowingly allow a child under 18 to create a customer account or use a child's personal data for targeted advertising. If you believe a child has provided personal data to us, please contact us so that we can investigate and take appropriate action.

15. Security

We use reasonable technical and organisational measures designed to protect personal data, including access controls, authentication, encryption in transit, confidentiality obligations and monitoring appropriate to the risk. No internet transmission or storage system can be guaranteed to be completely secure. Please protect your account credentials and contact us promptly if you suspect misuse.

16. Contact us

For privacy questions, objections, consent withdrawal or data-rights requests, contact:

OYO SOLUTIONS LIMITED
Soko Grocery Delivery - Privacy Contact
P.O. Box 33631
Dar es Salaam, Tanzania
Email: info@sokogrocery.co.tz
Website: https://sokogrocery.co.tz

17. Changes to this Policy

We may update this Policy when our Services, providers or legal obligations change. We will post the revised version with a new "Last updated" date and, where required, provide an additional notice or request fresh consent before a material new use of personal data takes effect.