Privacy Policy

1. Information we collect

We collect the following types of information from and about users of our Platform:

• 1.1 Account information: personal details provided when creating an account, including your full name, verified email address, phone number, county of residence, and a securely hashed password.
• 1.2 Order and transaction information: details needed to run your orders, including delivery addresses, order history, items purchased, pricing, and records of customer service communications or messages exchanged with Sellers on the Platform.
• 1.3 Payment information: payments are handled by secure third-party gateways. Checkout payments are processed directly by Safaricom M-Pesa, and Seller subscription billing is managed by Paystack. Ekshop does not store, intercept, or log your M-Pesa PIN, card numbers, CVV codes, or bank account credentials.
• 1.4 Usage, technical, and analytics data: automated logs of how you use the Platform, including pages viewed, products clicked, searches made, time spent on items, device identifiers, and similar activity used to improve recommendations.

2. Legal basis and how we use your information

We process personal data only where the Kenya Data Protection Act, 2019 allows it. We use it for:

• Fulfilling orders: processing checkout, confirming payments, passing accurate delivery details to delivery partners, and sending order updates.
• Account security and identity verification: authenticating sign-ins, blocking unauthorized access attempts, and protecting accounts from takeover or fraud.
• Platform communication: sending essential order updates, security advisories, and system alerts. If you opt in to marketing, we also send promotional offers.
• Personalization: analyzing Platform activity to tailor product rankings, local results, and search suggestions.
• Fraud prevention and compliance: detecting and stopping unauthorized activity, payment fraud, bots, and serious violations of our Terms of Service.

3. Information sharing and disclosure

Ekshop follows the principle of data minimization. We do not sell, lease, rent, or trade your personal information to third parties. We share data only with:

• Independent Sellers: your name, delivery phone number, and delivery location, so the Seller can fulfil your order.
• Payment processors: the transaction details Safaricom M-Pesa and Paystack need to authorize payments, without Ekshop holding your credentials.
• Logistics and delivery partners: delivery locations, maps, and names, so couriers can deliver accurately.
• Infrastructure and operational providers: trusted third parties that help us run the Platform, including Google (for transactional email and maps) and encrypted cloud hosting providers.

4. Cookies and tracking technologies

Ekshop uses cookies to make the Platform work well. Essential cookies keep you signed in as you move between pages and remember the items in your cart. Performance and analytics cookies help us measure how the interface performs and improve response times. You can reject or restrict non-essential cookies in your browser settings, though some features may not work as well.

5. Data retention

We keep personal data only as long as needed for the purposes in this Privacy Policy. Account details are held securely while your account is active. Records of closed or inactive accounts, transaction ledgers, and formal communications are kept for the longer periods required by legal, accounting, tax, and regulatory obligations in Kenya.

6. Your rights under the Kenya Data Protection Act, 2019

Under Section 26 of the Kenya Data Protection Act, 2019, you have the rights below. You can exercise them from your account settings or by sending a request to our data protection team:

• Right to be informed: to know clearly why and how your personal data is used.
• Right of access: to request a complete breakdown or digital export of the data linked to your profile.
• Right to rectification: to have outdated, false, or misleading data corrected promptly.
• Right to erasure (deletion): to request deletion of your data where there are no overriding legal grounds to keep it.
• Right to object and restrict: to decline direct marketing, object to automated profiling, or pause processing while a dispute is resolved.

7. Data security

Ekshop applies technical and organizational measures to reduce risks to your data. Passwords are protected with cryptographic hashing, data in transit is encrypted with SSL/TLS, and access within our cloud infrastructure follows least-privilege standards. No platform can promise absolute security, so we encourage you to use a strong password and keep your login details confidential.

8. International data transfers

Because the Platform uses global cloud servers, your information may sometimes be processed or stored outside Kenya. Ekshop ensures that such processing complies with Section 41 of the Data Protection Act, 2019. We only transfer data to jurisdictions with comparable data protection laws, or under standard contractual clauses that commit to equivalent protection for your personal data.

9. Changes to this policy

We may update this Privacy Policy to reflect new technical capabilities or changes in compliance requirements. Material changes will be announced on the Platform or sent to your registered email address before they take effect. The date at the top of this page shows when the current version took effect.

10. Contact and grievances

If you have questions, want to exercise a data right, or wish to raise a concern about how we handle your information, contact our privacy desk:

Ekshop Data Privacy Desk
Email: supportteam@ekshop.store
Nairobi, Kenya

If your inquiry is not handled to your satisfaction, you may escalate your complaint to the Office of the Data Protection Commissioner (ODPC) of Kenya.