Privacy Policy

1. Data Controller

Kamukunji.com Limited ("Kamukunji", "we", "our", or "us") is the data controller for all personal data collected through the kamukunji.com website and associated mobile applications (collectively, the "Platform").

Registered address: Nairobi, Kenya. Data Protection Officer contact: privacy@kamukunji.com

2. Scope of This Policy

This Privacy Policy applies to all natural persons who: (a) browse or use the Platform, (b) create an account, (c) place an order, (d) apply to become a seller, or (e) contact our support team. It does not apply to third-party websites linked from the Platform.

3. Categories of Personal Data We Collect

3.1 Data You Provide Directly

• Identity data: full name, username, date of birth.
• Contact data: email address, phone number, physical delivery address.
• Authentication data: hashed passwords, one-time passcodes (OTPs).
• Transaction data: items ordered, quantities, prices, M-Pesa transaction reference numbers, card-last-four digits.
• Profile data: wishlist items, product reviews, communication preferences.
• Seller application data (waitlist): shop name, business registration type, product categories, monthly sales estimates, business description.

3.2 Data Collected Automatically

• Device data: browser type and version, operating system, device model, screen resolution.
• Network data: IP address, approximate geolocation (country and city level derived from IP), time zone.
• Usage data: pages visited, search queries, products viewed, time spent per page, click events, cart additions and removals, checkout funnel steps.
• Session data: session token identifiers stored in browser cookies and localStorage.
• Performance data: page load times, API response times, JavaScript error logs.

3.3 Data From Third Parties

• Safaricom: M-Pesa payment confirmation, phone number used for STK push.
• Payment processors: Card authorisation status, card type, issuing bank (we receive tokenised references only — never raw card numbers).
• Supabase: Authentication events and infrastructure logs (our backend database and auth provider).

4. Legal Basis for Processing (Kenya DPA 2019 & GDPR-equivalent)

• Contract performance: Processing necessary to fulfil your order, manage your account, and provide customer support.
• Legitimate interests: Fraud detection and prevention, platform security, product recommendations, aggregate analytics to improve the Platform.
• Legal obligation: Record-keeping for tax compliance, responding to court orders or regulatory requests.
• Consent: Marketing emails and push notifications. You may withdraw consent at any time via Account → Notifications or by emailing privacy@kamukunji.co.ke.

5. How We Use Your Personal Data

• Order fulfilment: Processing payments, communicating dispatch and delivery status, issuing invoices.
• Account management: Authentication, password resets, security alerts.
• Customer support: Responding to queries, resolving disputes, processing returns.
• Personalisation: Showing relevant products based on browsing and purchase history.
• Marketing communications (consent-based): Promotional emails, SMS offers, push notifications.
• Fraud and risk management: Detecting anomalous transaction patterns, blocking fraudulent accounts.
• Platform improvement: A/B testing, error diagnosis, performance monitoring.
• Legal compliance: VAT records, KRA reporting obligations, regulatory enquiries.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

6.1 Service Providers (Data Processors)

• Supabase Inc. (USA): Database hosting, authentication infrastructure. Data processed under a Data Processing Agreement (DPA) with standard contractual clauses.
• Safaricom PLC (Kenya): M-Pesa payment processing.
• Delivery partners: Name, phone, and delivery address shared with courier companies solely to fulfil your order.
• Email service providers: Name and email address for transactional and marketing emails.
• SMS gateway providers: Phone number for OTPs and order notifications.

6.2 Legal Disclosures

We may disclose personal data if required by Kenyan law, a court order, the Office of the Data Protection Commissioner, or other competent public authority.

6.3 Business Transfers

In the event of a merger, acquisition, or asset sale, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

7. Cookies and Similar Technologies

7.1 Types of Cookies We Use

• Strictly necessary cookies: Session tokens, CSRF protection tokens. Cannot be disabled without breaking the Platform.
• Functional cookies: User preferences (language, currency, recently viewed products). Stored in localStorage.
• Analytics cookies: Aggregate usage statistics. No personally identifiable cross-site tracking.
• Performance cookies: Page load timing, error sampling.

7.2 Managing Cookies

You may clear cookies via your browser settings. Disabling strictly necessary cookies will prevent login and checkout from functioning. We do not use third-party advertising cookies or fingerprinting techniques.

8. Data Retention

• Account data: Retained for the lifetime of the account plus 7 years after closure (KRA tax record requirements).
• Order and transaction data: 7 years from the date of the transaction.
• Browsing and usage logs: 90 days on our servers; anonymised aggregates retained indefinitely.
• Support correspondence: 2 years from the date of resolution.
• Seller waitlist submissions: Until seller accounts launch or 3 years, whichever is sooner.
• Authentication logs (login events, password resets): 12 months.

9. International Data Transfers

Our primary database is hosted by Supabase in the European Union (Frankfurt, Germany). Transfer of your data outside Kenya is conducted under the Kenya DPA 2019 cross-border transfer provisions, supported by Standard Contractual Clauses (SCCs) where applicable.

10. Security Measures

• All data in transit is encrypted using TLS 1.2 or higher.
• All data at rest in our Supabase database is encrypted using AES-256.
• Passwords are hashed using bcrypt with a minimum cost factor of 12.
• Database access is restricted to authenticated service accounts via row-level security (RLS) policies.
• Payment card data is never stored on our servers; PCI-DSS tokenisation is handled by our payment processors.
• Security vulnerabilities may be reported to security@kamukunji.co.ke.

11. Your Rights Under the Kenya Data Protection Act 2019

As a data subject, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your data, subject to legal retention obligations.
• Right to restriction of processing: Ask us to limit how we use your data while a complaint is investigated.
• Right to data portability: Receive your data in a structured, machine-readable format (JSON or CSV).
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making: We do not make solely automated decisions with legal or significant effects on individuals.

To exercise any of these rights, email privacy@kamukunji.co.ke with subject line "Data Subject Request". We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

12. Children's Privacy

The Platform is not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us immediately at privacy@kamukunji.co.ke and we will delete the account and associated data.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users by email at least 14 days before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Platform after changes become effective constitutes acceptance.

14. Contact

For any privacy-related enquiries, contact our Data Protection Officer:

• Email: privacy@kamukunji.co.ke
• Postal: Kamukunji.com Limited, Data Protection Officer, Nairobi, Kenya
• Response time: Within 30 calendar days