1. Data Controller
Kamukunji Market Limited (“Kamukunji Market”, “we”, “us”, or “our”) operates as the Data Controller responsible for the processing and protection of personal data collected through the Kamukunji Market website, mobile applications, APIs, and associated online services.
We operate in full compliance with the Kenya Data Protection Act, 2019 (Act No. 24 of 2019) and the regulations promulgated thereunder by the Office of the Data Protection Commissioner (ODPC).
2. Information We Collect
We collect personal information necessary to offer, secure, and personalize our community marketplace:
a. Account & Identity Information
When you register an account, set up a shop, or apply as a vendor: full name, email address, M-Pesa registered mobile phone number, username (subject to our reserved names guidelines), profile photo, and password hash.
b. Vendor Verification & KYC Data
For verified sellers, physical shop owners, and delivery staff: National Identity Card (ID) or Passport number, business registration certificates (CR12 / Business Permit), and verified shop address/county location.
c. Listings, Bids & Communications
Listing descriptions, product photographs, auction bid records, buyer-seller chat messages on our platform, customer support queries, reviews, and transaction feedback.
d. Technical, Device & Location Data
IP address, device model, operating system, browser type, referral URLs, approximate geographic location (at county or town level) to display local deals, and usage logs.
3. How & Why We Use Your Data
In adherence to the principles of lawfulness, fairness, and transparency, we only process your personal data under the following legal bases:
- Contractual Necessity: To create your account, publish listings, facilitate buyer-seller interactions, run live auctions, and manage vendor storefronts.
- Fraud Prevention & Platform Security: To detect scam listings, block impersonation of official brands, prevent multi-accounting, and enforce strict community safety policies.
- Legal Compliance: To comply with consumer protection statutes, tax reporting requirements, anti-fraud directives, and lawful court orders.
- Legitimate Interest & Consent: To send service notifications, security alerts, and SMS/email updates you have opted into.
4. Disclosure & Third Parties
We do not sell, rent, or trade your personal data to commercial advertisers.
We only share data with the following authorized entities where strictly necessary:
- Counterparty Users: When you list an item or start a chat, your public vendor name, county, and contact number (if opted in) are visible to prospective buyers.
- Payment Gateways & Telecoms: Encrypted transaction data shared with licensed payment providers (e.g., Safaricom M-Pesa, bank settlement partners) to process payments or verification.
- Verified Couriers & Delivery Partners: Recipient delivery address, name, and phone contact for logistics fulfillment when dispatching goods.
- Regulatory & Law Enforcement Authorities: When legally compelled under Kenyan law (such as the National Police Service, DCI, or Kenya Revenue Authority) following due process.
5. Storage, Security & Retention
All passwords are encrypted with industry-standard bcrypt hashing. Communications with our servers use HTTPS/TLS 1.3 encryption. We implement role-based access control (RBAC) ensuring only authorized personnel access restricted data.
We retain account records for as long as your account remains active. If you request account closure, we retain essential transaction and audit records for up to 7 years to satisfy Kenyan tax, accounting, and anti-fraud statutory obligations, after which data is securely erased or anonymized.
6. Your Rights under the Kenya Data Protection Act, 2019
As a data subject in Kenya, you have clear statutory rights under Section 26 of the Data Protection Act:
Right to be Informed
You have the right to know how your personal data is collected, stored, and utilized.
Right of Access
You can request a copy of the personal data held about you by submitting an access request.
Right to Rectification
You can request correction of inaccurate, outdated, or incomplete data at any time.
Right to Erasure
You may request deletion of your personal records where there is no legal reason to retain them.
Right to Object
You can object to processing your data for direct marketing or automated profiling.
Right to Data Portability
You can receive your personal data in a structured, commonly used machine-readable format.
To exercise any of these rights, contact our Data Protection Officer at privacy@kamukunji.market. If you feel your complaint has not been addressed, you hold the legal right to file a dispute with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
8. Protection of Minors
Kamukunji Market is strictly intended for individuals aged 18 years or older. We do not knowingly collect personal data from minors. If we discover that an account has been registered by a minor without verified legal parental authorization, the account and related listings will be promptly deactivated.
9. Contact Our Data Protection Officer
Data Protection Office — Kamukunji Market Limited
Email: privacy@kamukunji.market / dpo@kamukunji.market
Physical Address: Kamukunji Business Centre, Nairobi, Kenya
Telephone: +254 700 000 000
ODPC Registration Ref: ODPC/REG/2026/KMK