Privacy Policy

1. Introduction

This Privacy Policy explains how Nusoko (“Nusoko,” “we,” “us”) collects, uses, discloses, and protects personal data obtained from users of the Nusoko marketplace platform (“Users,” “you”), in accordance with the Data Protection Act, 2019 (“DPA”) and its regulations, including the Data Protection (General) Regulations, 2021. By accessing or using Nusoko, you acknowledge this Policy; where processing relies on consent, we obtain that consent separately as described below.

2. Scope and Roles: Who Is Responsible for What

Because Nusoko is a multivendor marketplace, more than one party may determine how your personal data is used. This section sets out each party’s role under the DPA so accountability is clear — a distinction general privacy templates typically omit but which is central to how a marketplace must be governed.

Party	Role	What this means
Nusoko	Data Controller for platform-level data (account registration, browsing and usage data, payment records held by Nusoko, marketing communications Nusoko sends, dispute records)	Nusoko determines the purpose and means of processing this data and is accountable to the ODPC for it.
Nusoko	Joint Controller / Processor, depending on the activity, for order data shared with a Vendor or Reseller to enable fulfilment	Nusoko facilitates transfer of the minimum necessary Customer data (name, delivery address, phone number) to the Vendor or Reseller solely to complete an order.
Vendor (including a Supplying Vendor in a reseller arrangement)	Data Controller for the Customer data it receives to fulfil an order, once received	The Vendor determines how it uses that order data and must not repurpose it — for example, for unrelated marketing — without an independent lawful basis and, where required, your consent.
Reseller	Processor / limited-purpose recipient of Customer data relevant to a resold order, where involved in customer communication	May use the data only to support that specific transaction, and must not retain or reuse it beyond that purpose.
Third-party service providers (payment processors, courier and logistics partners, cloud hosting, analytics, advertising, SMS/communication providers)	Data Processors acting on Nusoko’s instructions, or — for certain payment providers — independent controllers under their own regulatory regime	Process personal data only as needed to provide their service to Nusoko or Vendors, under written data processing agreements.

3. Information We Collect

3.1 Information You Give Us

Account information: name, phone number, email address, postal/delivery address, password (stored as a salted hash).
Order and payment information: items ordered, delivery details, payment method and transaction reference. Nusoko does not store full card numbers or PINs — these are handled solely by our licensed payment providers.
Vendor/Reseller verification information: national ID or business registration details, KRA PIN, business address, payout account details.
User content: product reviews, ratings, comments, photos, and messages you send through the Platform (for example, Customer–Vendor chat).
Communications with us: information you provide when you contact Support, submit a dispute, or complete a survey.

3.2 Information We Collect Automatically

Device and technical information: IP address, device type, operating system, browser type, and mobile network information.
Usage information: pages and listings viewed, search queries, items added to cart or wishlist, clickstream data, and time spent on the Platform.
Location information: approximate location derived from your IP address or, where you enable it, precise device location (for example, to show nearby delivery options) — device-level location sharing is always your choice via your device settings.
Cookies and similar technologies: see Section 4.

3.3 Information From Other Sources

Vendors and Resellers: order-related updates they provide (for example, dispatch confirmation).
Payment service providers: confirmation of successful payment or payment failure.
Identity verification providers: where used to verify Vendor or Reseller registration.
Publicly available sources: where relevant to fraud prevention or verifying a business registration.

4. Cookies and Tracking Technologies

4.1 Nusoko and our service providers use cookies, SDKs (in our mobile app), and similar technologies to: keep you logged in; remember your cart and preferences; measure and analyze Platform performance; and, where you consent, personalize content and measure marketing effectiveness.

4.2 Categories of cookies we use:

Strictly necessary — required for the Platform to function (for example, session and security cookies); cannot be switched off.
Performance/analytics — help us understand usage patterns and improve the Platform.
Functional — remember your preferences (for example, language or saved delivery address).
Advertising/personalization — used, only with your consent where required, to show more relevant offers on or off the Platform.

4.3 You can manage cookie preferences through the cookie banner shown on first visit, your browser settings, or your device settings. Disabling strictly necessary cookies may prevent parts of the Platform from working.

5. How We Use Your Information

Service provision — operating, maintaining, and improving the Platform; processing orders; facilitating transactions between you and Vendors/Resellers; providing customer and vendor support.
Communication — sending order updates, service notices, and (with your consent, where required) newsletters, marketing communications, and promotional offers, which you can opt out of at any time (Section 12).
Personalization — recommending products and customizing content based on your activity on the Platform, and, only with consent where required, displaying targeted advertising.
Analytics — understanding how Users interact with Nusoko to improve functionality and user experience.
Fraud prevention and security — detecting and preventing fraud, abuse, and security incidents across the Platform.
Legal compliance — complying with legal obligations (including Kenya Revenue Authority reporting), enforcing our Terms of Service, and protecting the rights, property, or safety of Nusoko, our Users, or others.

6. Lawful Basis for Processing

We rely on the following DPA-recognised lawful bases, depending on the activity: contractual necessity (creating your account, processing orders, enabling delivery); consent (marketing communications and optional personalization/advertising features, withdrawable at any time); legal obligation (for example, tax reporting or responding to a lawful authority request); and legitimate interests (for example, fraud prevention, platform security, and service improvement), balanced against your rights and freedoms.

7. How We Share Your Information

We do not sell your personal data to third parties for their own independent marketing purposes. We share it only as follows:

With Vendors and Resellers — limited to what’s necessary to fulfil your order (name, delivery address, phone number, order details).
With payment service providers — to process payments and refunds.
With courier and logistics partners — to deliver your order.
With cloud hosting, analytics, and communication service providers — under written data processing agreements, solely to operate and improve the Platform.
With advertising partners — only where you have consented to personalized advertising, and only to the extent necessary to measure or deliver that advertising.
In a business transfer — in the event of a merger, acquisition, or sale of assets, your information may be transferred to a successor entity, who will be bound by this Policy (or a materially similar one) unless you are notified otherwise.
For legal reasons — where required by law, government request, or court order, or to protect the rights, property, or safety of Nusoko, our Users, or others.
With your consent — for any other purpose not covered above, we will ask first.

8. Cross-Border Data Transfers

Where personal data is transferred outside Kenya — for example, to a cloud hosting provider — Nusoko ensures the transfer meets DPA requirements, such as transferring to a jurisdiction with adequate data protection safeguards recognised by the ODPC, or under appropriate contractual safeguards or your consent where required, consistent with Section 48 of the DPA and its regulations.

9. Data Retention

We retain personal data only as long as necessary to fulfil the purposes described in this Policy, applicable statutory retention requirements (for example, tax and accounting records under Kenyan law), and dispute or fraud investigation needs, after which it is securely deleted or anonymised. [Specific retention schedules per data category to be finalised with counsel and Nusoko’s Data Protection Officer.]

10. Data Security

Nusoko applies appropriate technical and organisational measures — including encryption in transit, access controls, and staff data protection training — to protect your information against unauthorized access, alteration, disclosure, or destruction, and requires Vendors, Resellers, and processors to apply comparable safeguards to any data they receive. No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

11. Your Rights Under the DPA

As a data subject, you have the right to:

be informed of the use of your personal data;
access your personal data;
request correction of inaccurate or outdated data (also available by logging into your account);
request deletion of your data, subject to legal or legitimate business retention requirements;
object to processing, including for direct marketing;
data portability — request a copy of your personal data in a structured, commonly used, machine-readable format;
withdraw consent at any time, where processing is based on consent; and
lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

Requests can be made to [privacy@nusoko.co.ke] and will be handled within the timeframe required by the DPA.

12. Your Marketing Choices

You can opt out of promotional emails or SMS at any time by following the unsubscribe/opt-out instructions in the communication itself, adjusting your notification preferences in your account settings, or contacting [privacy@nusoko.co.ke]. Opting out of marketing does not affect transactional messages (for example, order and delivery updates) necessary to service your account.

13. Data Protection Officer

Nusoko has appointed a Data Protection Officer as required under the DPA. Contact: [privacy@nusoko.co.ke].

14. Data Breach Notification

In the event of a data breach likely to result in a risk to data subjects, Nusoko will notify the ODPC and affected individuals within the timeframes required by the DPA, and requires Vendors and Resellers to promptly report any breach involving Customer data they hold to [privacy@nusoko.co.ke].

15. Children’s Privacy

The Platform is not intended for use by individuals under 18. We do not knowingly collect personal data from children under 18 without the appropriate parental or guardian consent required by the DPA. If we become aware that a child under 18 has provided us with personal data without such consent, we will take steps to delete it.

16. Vendor & Reseller Obligations

Vendors and Resellers must handle Customer personal data they receive strictly in accordance with the data processing clauses in the Vendor Agreement and this Policy, including using it solely for order fulfilment and related support, and not for independent marketing without a lawful basis.

17. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by email and/or in-app notice, with the effective date shown at the top of this document. Your continued use of Nusoko after the effective date constitutes acceptance of the changes, without prejudice to any consent-based processing, which we will always ask you to reconfirm.

18. Contact Us

Privacy queries and data subject requests: [privacy@nusoko.co.ke]

This Policy is incorporated by reference into, and should be read together with, the Nusoko Terms of Service and Vendor Agreement.