Privacy Policy

We collect the following categories of personal information:

a) Information You Provide Directly

• Account details: name, email address, phone number, and password when you register.
• Vendor information: business name, shop description, product listings, and M-Pesa details for payouts.
• Order information: delivery address, order history, and payment records.
• Communications: messages you send to us via support channels.

b) Information Collected Automatically

• Usage data: pages visited, search queries, clicks, and time spent on the platform.
• Device and browser data: IP address, browser type, operating system, and device identifiers.
• Cookies and similar technologies: session tokens and preference cookies (see Section 7).

c) Information from Third Parties

• Payment processors: confirmation status and transaction references from M-Pesa / Safaricom (we do not store your full M-Pesa PIN or card details).

We use your personal information to:

• Create and manage your account.
• Process orders, payments, and refunds.
• Connect customers with Vendors and facilitate deliveries.
• Send transactional emails (order confirmations, OTPs, password resets).
• Send platform updates, promotional offers, and newsletters (you may opt out at any time).
• Detect and prevent fraud, abuse, and unauthorised access.
• Comply with legal obligations under Kenyan law.
• Improve the platform through analytics and user feedback.

We process your data on the following legal bases:

• Contract performance: to fulfil orders and provide the services you requested.
• Legitimate interests: to secure the platform, prevent fraud, and improve our services.
• Legal obligation: to comply with Kenyan tax, consumer protection, and data protection laws.
• Consent: for marketing communications, which you may withdraw at any time.

We do not sell your personal information. We may share it with:

• Vendors: your name, phone number, and delivery address are shared with the Vendor fulfilling your order.
• Payment processors: Safaricom (M-Pesa) for payment authorisation.
• Service providers: hosting, email delivery, and analytics partners who process data on our behalf under data processing agreements.
• Law enforcement / regulators: where required by Kenyan law or valid court order.
• Business transfers: in the event of a merger, acquisition, or asset sale, your data may be transferred (we will notify you in advance).

• Account data is retained for as long as your account is active.
• After account deletion, we retain certain records (e.g., transaction history) for up to 7 years as required by Kenyan tax regulations.
• Support correspondence is retained for up to 3 years.
• Usage logs and analytics data are anonymised after 12 months.

We implement appropriate technical and organisational measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit.
• Bcrypt hashing for passwords — never stored in plain text.
• Access controls limiting employee access to personal data on a need-to-know basis.
• Regular security reviews and patching of our infrastructure.

No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@kibandaski.shop.

We use the following types of cookies:

• Essential cookies: required for the platform to function (e.g., session authentication). Cannot be disabled.
• Preference cookies: remember your language and display settings.
• Analytics cookies: help us understand how the platform is used so we can improve it.

You can control non-essential cookies through your browser settings. Disabling essential cookies will prevent you from logging in.

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: request erasure of your personal data (subject to legal retention requirements).
• Restriction: ask us to limit how we process your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting past processing.

To exercise any of these rights, email us at support@kibandaski.shop with the subject line "Data Rights Request". We will respond within 30 days.

Kibandaski is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we discover that a child has provided us with personal data, we will delete it promptly.

Your data is primarily stored on servers located in Kenya or within the African continent. Where we use service providers located outside Kenya, we ensure appropriate data transfer safeguards are in place consistent with the Kenya Data Protection Act, 2019.

Our platform may contain links to third-party websites. This Privacy Policy applies only to Kibandaski. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where required, by sending you an email notification. Your continued use of the platform following any update constitutes acceptance of the revised policy.

If you have questions, concerns, or complaints about this Privacy Policy or how we handle your data, please contact our Data Protection Officer: