Privacy Policy
How we collect, use, and protect your personal data.
Table of Contents
1 Introduction
Maisha Store ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the rights you have over it.
This Policy applies to our website, mobile application, marketplace, and any related services (collectively, the "Platform"). It should be read together with our Terms & Conditions.
2 Who We Are
For the purposes of the Kenya Data Protection Act, 2019, Maisha Store Solutions is the data controller responsible for your personal data.
- Registered name: Maisha Store
- Location: Nairobi, Kenya
- Contact: info@maishastore.co.ke
3 Information We Collect
We may collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity | Full name, username, national ID (for invoicing or regulated products) |
| Contact | Email address, phone number, delivery address, county, town |
| Account | Login credentials, preferences, order history |
| Transaction | Products ordered, amounts paid, payment method, M-Pesa/card references |
| Technical | IP address, browser type, device type, operating system, session data |
| Usage | Pages visited, time spent, click patterns, referring URLs |
| Communications | Messages sent via our contact form, emails, WhatsApp conversations |
| Marketing | Newsletter subscription status, marketing preferences |
4 How We Collect It
We collect personal data in the following ways:
- Directly from you — when you register, place an order, contact us, subscribe to our newsletter, or use our services.
- Automatically — through cookies, server logs, and analytics tools when you browse the Platform.
- From third parties — payment processors (M-Pesa, Visa, Mastercard), logistics partners, and marketing platforms.
5 Why We Use Your Data
We use your personal data to:
- Create and manage your account;
- Process orders, payments, deliveries and returns;
- Provide agronomy advice, training, and customer support;
- Send transactional messages (order confirmations, delivery updates, verification codes);
- Send marketing communications with your consent;
- Detect and prevent fraud, abuse, and security incidents;
- Comply with legal, tax, and regulatory obligations;
- Improve our Platform, products, and services;
- Analyse aggregated trends and usage patterns.
6 Lawful Basis for Processing
Under the Kenya Data Protection Act, 2019, we process your personal data on one or more of the following lawful bases:
- Consent — where you have given us clear, specific consent (e.g. marketing emails);
- Contract — where processing is necessary to fulfil an order or provide a service you requested;
- Legal obligation — where we must retain or disclose data to comply with the law;
- Legitimate interest — where processing supports our operations and does not override your rights (e.g. fraud prevention);
- Vital interest — in rare cases, where processing is needed to protect someone's life.
9 Data Retention
We retain personal data only as long as necessary for the purposes described in this Policy, or as required by law. Indicative periods:
- Account data — while your account is active, and for 12 months after closure;
- Order & transaction records — 7 years (tax and accounting law);
- Marketing preferences — until you unsubscribe or withdraw consent;
- Server logs — typically up to 12 months;
- Support tickets — up to 3 years.
10 How We Protect Your Data
We apply appropriate technical and organisational measures, including:
- HTTPS encryption for all traffic to and from the Platform;
- Hashed passwords (we never store passwords in plain text);
- Role-based access controls on internal systems;
- Regular backups and security monitoring;
- Staff training on data protection and confidentiality.
11 Your Rights
Under the Kenya Data Protection Act, 2019, you have the following rights over your personal data:
Right to be informed
To know what data we collect and how we use it.
Right of access
To request a copy of the personal data we hold about you.
Right to rectification
To correct inaccurate or incomplete data.
Right to erasure
To request deletion of data we no longer need (subject to legal obligations).
Right to object
To object to processing based on legitimate interest or for marketing.
Right to restrict
To limit how we process your data in certain circumstances.
Right to portability
To receive your data in a structured, machine-readable format.
Right to withdraw consent
To withdraw consent at any time, without affecting prior processing.
To exercise any of these rights, email us at info@maishastore.co.ke. We will respond within 30 days as required by law.
12 Children's Privacy
Our Platform is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
13 International Transfers
We primarily store data on servers located in Kenya. Where we transfer data outside Kenya (for example, to cloud service providers), we ensure appropriate safeguards are in place, such as contractual clauses and adequacy assessments, as required by the Kenya Data Protection Act.
14 Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. Material changes will be communicated via email or a prominent notice on the Platform.
15 Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya:
- Website: www.odpc.go.ke
- Email: complaints@odpc.go.ke
We would appreciate the opportunity to resolve your concern directly before you escalate it to the ODPC.
16 Contact Us
For any privacy-related questions or requests, contact us:
- Email: info@maishastore.co.ke
- Phone: +254 111 367 399
- Address: Nairobi, Kenya