Kiambumart Privacy Policy
Effective date: 01 October 2026
1. Introduction
Kiambumart (“Kiambumart“, “we“, “us“, “our“) is an online business directory and marketplace that helps people find, and helps businesses get found, across Kiambu County, Kenya, through our website at [www.kiambumart.com] and any related mobile or web applications (together, the “Platform“).
We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use, share and protect it, and the rights you have. It is written to comply with the Data Protection Act, 2019 (Kenya), the Data Protection (General) Regulations, 2021, and other applicable Kenyan law.
By using the Platform, creating an account, or listing a business, you acknowledge that you have read this Policy. If you do not agree with it, please do not use the Platform.
2. Who is responsible for your data
The data controller is:
Kiambumart: Email: info@kiambumart.com
Data Protection contact: Questions about this Policy or your data can be sent to our data protection contact at info@kiambumart.com.
3. Who this Policy covers
- Visitors and searchers, people who browse or search the directory.
- Business owners and account holders, people who create a profile or listing for a business.
- Buyers and enquirers, people who contact a business through the Platform.
- Anyone who contacts us by email, phone, WhatsApp or social media.
4. Personal data we collect
4.1 Information you give us
| Category | Examples | When |
|---|---|---|
| Account details | Name, email address, phone number, password (stored in encrypted/hashed form) | When you register |
| Business profile details | Business name, category, description, location/address, business phone, email, website, social media links, opening hours, logos, photos, product or service information | When you create or edit a profile or listing |
| Verification details | Business registration or permit details, ID of the account holder where verification is required | When we verify a business |
| Payment details | Plan selected, billing name, mobile money number (e.g. M-Pesa), transaction reference and amount | When you subscribe to a paid plan |
| Communications | Messages, enquiries, reviews, ratings, support requests, survey responses | When you use messaging, review or contact features |
We do not store your M-Pesa PIN or full card details. Payments are processed by third-party payment providers (see section 7).
4.2 Information collected automatically
- Device and technical data: IP address, browser type, operating system, device identifiers, language, and time zone.
- Usage data: pages viewed, search terms, categories browsed, listings clicked, referring pages, and time spent.
- Approximate location: derived from your IP address or, with your permission, your device, to show nearby businesses.
- Cookies and similar technologies: see section 10.
4.3 Information from other sources
- Payment providers confirming that a payment was successful.
- Public sources, such as a business’s public website or social media page, where we help populate or verify a listing.
- Log-in or sharing services, if you choose to sign in through a third-party account.
4.4 Sensitive personal data
We do not intentionally collect sensitive personal data (as defined in the Data Protection Act, such as health, religious or ethnic information). Please do not include such information in listings, reviews or messages.
5. Why we use your data, and our lawful basis
We process personal data only where the law allows.
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account and business profile | Performance of a contract |
| Displaying your business in the directory and search results | Performance of a contract and your consent (you choose what to publish) |
| Processing subscription payments, issuing receipts, managing renewals | Performance of a contract; legal obligation (tax and accounting records) |
| Verifying businesses and preventing fake or fraudulent listings | Legitimate interests; legal obligation |
| Showing relevant results, improving search and Platform performance | Legitimate interests |
| Responding to enquiries, support requests and complaints | Performance of a contract; legitimate interests |
| Sending service messages (account, billing, policy changes) | Performance of a contract; legitimate interests |
| Sending marketing and promotional messages | Your consent (you can withdraw at any time) |
| Security, abuse prevention, dispute resolution and enforcing our Terms | Legitimate interests; legal obligation |
| Complying with laws, court orders and regulatory requests | Legal obligation |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing done before it.
6. What is public
Kiambumart is a directory, so information you put in a business profile or listing is intended to be public. This can include business name, description, address, phone number, email, photos and social media links, along with reviews and ratings you post.
Please think carefully before publishing personal information (for example a personal phone number or home address) in a public listing. Public information can be seen, copied and used by others, including search engines, and we cannot control that once it is public.
Search visibility depends on your plan. Businesses on the free plan have a profile, but appear in search results only as described in our pricing plans. Subscription tier does not change how we protect your personal data.
7. Who we share data with
We do not sell your personal data. We share it only as follows:
- Service providers who work on our behalf, under written agreements requiring them to protect your data: web hosting and cloud storage, payment processors (such as Safaricom M-Pesa and card processors), email and SMS/WhatsApp messaging providers, analytics providers, and customer support tools.
- Other users, to the extent you choose to make information public, or when you send an enquiry to a business (the business receives your message and contact details).
- Professional advisers, such as lawyers, auditors and accountants, under confidentiality duties.
- Authorities and regulators, where required by law, court order, or to protect rights, safety and property, including preventing fraud.
- Business transfers, if we merge with, or are acquired by, another organisation. We will notify you and any successor must honour this Policy.
8. International transfers
Some of our service providers (for example cloud hosting or email tools) may store or process data outside Kenya. Where we transfer personal data out of Kenya, we do so in line with Part VI of the Data Protection Act, ensuring appropriate safeguards or another lawful basis apply, and, where required, obtaining your consent. Data that the law requires to be processed in Kenya is kept in Kenya.
9. How long we keep your data
We keep personal data only as long as needed for the purpose it was collected, and to meet legal requirements.
| Data | Retention |
|---|---|
| Account and profile data | For as long as your account is active, then deleted or anonymised within [90] days of closure |
| Payment and billing records | [7] years, to meet tax and accounting obligations |
| Enquiries and support records | [24] months after the matter is closed |
| Website logs and analytics data | Up to [12–24] months |
| Marketing preferences | Until you withdraw consent |
We may keep some data longer where needed for legal claims, fraud prevention, or to comply with the law.
10. Cookies and similar technologies
We use cookies and similar tools to:
- keep you signed in and remember preferences (essential cookies);
- understand how the Platform is used and improve it (analytics cookies);
- measure the effectiveness of our promotions (marketing cookies, only with your consent where required).
You can control cookies through your browser settings and our cookie banner. Blocking essential cookies may stop parts of the Platform from working.
11. Your rights
Under section 26 of the Data Protection Act, you have the right to:
- Be informed of how your data is used (this Policy).
- Access the personal data we hold about you.
- Object to processing of your data, including for direct marketing.
- Correct inaccurate or incomplete data.
- Delete data that is false, misleading, no longer needed, or unlawfully processed, subject to legal retention duties.
- Data portability, receiving your data in a structured, commonly used format where applicable.
- Withdraw consent at any time.
- Not be subject to decisions based solely on automated processing that significantly affect you. We do not currently make such decisions.
How to exercise your rights: email info@kiambumart.com or use the account settings on the Platform. We may need to verify your identity first. We will respond within the timeframes set by law (generally within 30 days). There is no charge unless a request is manifestly unfounded or excessive.
You can edit or remove most business profile information yourself from your account dashboard.
12. Marketing communications
With your consent, we may send offers, tips and news about Kiambumart by email, SMS or WhatsApp. You can opt out at any time by using the unsubscribe link, replying STOP, or contacting us. You will still receive essential service messages such as billing and account notices.
13. Data security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), hashed passwords, access controls, secure hosting, and staff confidentiality obligations. No system is completely secure, so we also encourage you to use a strong, unique password and not share your login details.
If a personal data breach occurs that is likely to put your rights at risk, we will notify the ODPC within 72 hours of becoming aware of it, and notify affected individuals without unreasonable delay, as the Data Protection Act requires.
14. Children
The Platform is intended for adults aged 18 and over. We do not knowingly collect personal data of children. If you believe a child has given us data, contact us and we will delete it promptly.
15. Reviews, messages and user content
Content you post (such as reviews, photos and messages) must not contain another person’s personal data without a lawful reason, and must follow our Terms of Use. We may remove content that breaches these rules or the law. A review you publish may remain visible with your display name.
16. Third-party links
The Platform may link to websites and social media pages run by others. We are not responsible for their privacy practices, so please read their policies.
17. Changes to this Policy
We may update this Policy from time to time. Material changes will be announced on the Platform and, where appropriate, by email or SMS. The “Last updated” date above shows when it was last revised. Continued use after a change means you accept the updated Policy, except where the law requires fresh consent.
18. Complaints
If you have a concern, please contact us first at info@kiambumart.com so we can try to resolve it. You also have the right to lodge a complaint with the regulator:
Office of the Data Protection Commissioner (ODPC), Kenya Website: www.odpc.go.ke Email: info@odpc.go.ke
19. Contact us
Kiambumart, Email: info@kiambumart.com
Governing law: This Policy is governed by the laws of Kenya