Privacy Protocol

Jijenge Swiftsoko is a digital marketplace operated in the Republic of Kenya. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our Platform — including our website, mobile applications, and any related services.

This Policy is compliant with the Data Protection Act, No. 24 of 2019 ("DPA") of the Republic of Kenya and the implementing regulations thereunder. We are registered as a data controller with the Office of the Data Protection Commissioner (ODPC) of Kenya.

By using our Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. You may withdraw consent at any time, subject to legal and contractual limitations.

Account & Identity Data: When you register, we collect your name, email address, phone number, and optionally your profile photograph. Sellers additionally provide business name, KRA PIN (for tax compliance), and bank/mobile money account details.

Transaction Data: We collect records of purchases, payments, refunds, and disputes. This includes order amounts, payment method references (not full card numbers — we use tokenised, PCI-DSS compliant payment processors), and delivery addresses.

Usage & Device Data: We automatically collect data about how you interact with the Platform, including pages viewed, search queries, click patterns, device type, operating system, browser, IP address, and approximate geolocation (city-level only).

Communications Data: When you contact our support team, submit reviews, or communicate with Sellers through the Platform, we retain those communications to resolve disputes and improve service quality.

Cookies & Tracking Technologies: We use strictly necessary cookies (essential for Platform function), analytical cookies (anonymised usage statistics), and preference cookies (to remember your settings). We do not use third-party advertising trackers without your explicit consent. You can manage cookie preferences in your account settings.

To fulfil your orders: Processing payments, coordinating delivery, handling returns, and communicating order status updates.

To operate your account: Authentication, account management, Seller onboarding, and personalising your experience.

To improve our Platform: Analysing aggregated, anonymised usage data to improve features, fix bugs, and develop new services.

To comply with the law: Meeting our obligations under Kenyan tax law (through the Kenya Revenue Authority), anti-money laundering regulations, and responding to lawful requests from law enforcement or regulatory authorities.

To communicate with you: Sending order confirmations, security alerts, and — with your consent — promotional offers, product recommendations, and platform updates. You may opt out of marketing communications at any time via the unsubscribe link in any email or by updating your account settings.

To detect and prevent fraud: Monitoring for suspicious activity, protecting Buyers and Sellers from scams, and maintaining platform integrity.

We process your personal data under the following lawful grounds as recognised by the Data Protection Act, 2019:

Contractual necessity: Processing required to perform the contract we have with you (e.g., fulfilling your order).

Legal obligation: Processing required to comply with Kenyan law (e.g., tax reporting to KRA, anti-money laundering checks).

Legitimate interests: Processing for fraud prevention, platform security, and improving our services — where these interests are not overridden by your data protection rights.

Consent: Where we rely on your consent (e.g., marketing emails, non-essential cookies), you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

We do not sell your personal data. We share your data only with trusted parties and only to the extent necessary:

Delivery Partners: Your name, phone number, and delivery address are shared with courier and logistics partners solely to fulfil your order.

Payment Processors: Transaction data is shared with PCI-DSS compliant payment processors (M-Pesa/Safaricom and card processors). We receive only transaction references — we never store full card numbers.

Sellers: When you place an order, the Seller receives your name, order details, and delivery information sufficient to fulfil the order. Sellers do not receive your payment credentials.

Legal Authorities: We may disclose your data when required by a valid court order, summons, or lawful request from a Kenyan regulatory authority such as the Communications Authority, KRA, or law enforcement.

Service Providers: We use carefully vetted third-party providers for hosting, analytics, email delivery, and customer support tooling. All providers are bound by data processing agreements and may not use your data for their own purposes.

We retain your personal data for as long as is necessary for the purpose for which it was collected, subject to longer retention where required by law:

Account data: Retained for the lifetime of your active account and 5 years after closure, consistent with Kenyan statute of limitations for contractual claims.

Transaction records: Retained for 7 years to satisfy tax and anti-money laundering obligations under Kenyan law.

Communications and support records: Retained for 3 years to assist with dispute resolution.

Anonymised usage analytics: Retained indefinitely as they cannot be linked back to any individual.

When retention periods expire, data is securely deleted or anonymised. You may request early deletion of your data (subject to legal retention requirements) by submitting a request to privacy@jijengeswiftsoko.co.ke.

Under the Data Protection Act, 2019, you have the following rights, which you may exercise by contacting our Data Protection Officer (DPO) at privacy@jijengeswiftsoko.co.ke:

Right of Access: Request a copy of the personal data we hold about you.

Right to Rectification: Request correction of inaccurate or incomplete personal data.

Right to Erasure: Request deletion of your personal data where there is no overriding legal basis to retain it.

Right to Restrict Processing: Request that we pause processing of your data in certain circumstances.

Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.

Right to Data Portability: Receive your data in a structured, machine-readable format.

Right to Lodge a Complaint: You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke if you believe your data rights have been violated.

We will respond to all verified requests within 30 days. Complex requests may be extended by a further 60 days with notice. We reserve the right to decline requests that are manifestly unfounded or excessive.

We implement industry-standard technical and organisational security measures to protect your personal data from unauthorised access, accidental loss, alteration, or disclosure. These include: Transport Layer Security (TLS/HTTPS) encryption for all data in transit; AES-256 encryption for sensitive data at rest; role-based access controls limiting staff access to personal data on a need-to-know basis; regular security audits and penetration testing; and multi-factor authentication for Platform staff accounts.

Notwithstanding these measures, no internet transmission is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ODPC within 72 hours of becoming aware of the breach, as required by the DPA.

We use cookies and similar tracking technologies on our Platform. Strictly necessary cookies (which cannot be disabled) are required for core Platform functionality such as authentication and cart management. Analytical cookies (which you may opt out of) help us understand how the Platform is used, using anonymised data processed by privacy-respecting analytics tools.

We do not use cookies to build advertising profiles or share your browsing behaviour with advertising networks. Third-party social media buttons (if present) may set their own cookies — these are governed by the respective third party's privacy policy.

You can manage your cookie preferences through your browser settings or through our in-Platform cookie consent tool. Blocking strictly necessary cookies may impair Platform functionality.

The Platform is not directed to children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@jijengeswiftsoko.co.ke and we will take prompt steps to delete it.

We may update this Privacy Policy from time to time. Material changes that affect how we use your data will be notified via email and a prominent in-Platform notice at least 14 days before taking effect. The date at the top of this page reflects when the policy was last updated.

Your continued use of the Platform after the effective date of any change constitutes your acceptance of the updated policy.

For all data protection queries, access requests, or complaints, contact our Data Protection Officer:

Email: privacy@jijengeswiftsoko.co.ke

Postal address: Data Protection Officer, Jijenge Swiftsoko, Westlands Commercial Centre, Nairobi, Kenya

Alternatively, you may file a complaint directly with the Office of the Data Protection Commissioner (ODPC), P.O. Box 41079-00100, Nairobi, Kenya. Website: odpc.go.ke.

This Privacy Policy was last updated on 12 June 2026 and is effective immediately.