Last updated: [Date]
Privacy Policy
Introduction
Commarkly (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have under the Data Protection Act, 2019 of Kenya (the “Act”) and its regulations.
This policy applies to personal data we collect through commarkly.com (the “Site”), our [mobile app], and when you contact us or use our services ([describe services]).
Who We Are
For the purposes of the Act, Commarkly is the data controller of your personal data.
- Registered address: [Address, Nairobi, Kenya]
- Email: hello@commarkly.com
- Phone: +254 714 874 155
- ODPC registration number: [Number, if registered]
- Data Protection Officer: [Name and contact details, if appointed]
Personal Data We Collect
Depending on how you interact with us, we may collect the following:
| Category | Examples | How we collect it |
|---|---|---|
| Identity data | Name, username, date of birth, national ID or passport number (only where legally required) | You provide it directly |
| Contact data | Email address, phone number, billing and delivery address | You provide it directly |
| Account data | Login credentials, preferences, order and purchase history | You provide it or we generate it |
| Payment data | Payment method details, M-Pesa number, transaction records | You provide it; processed by our payment providers |
| Technical data | IP address, browser type, device information, time zone, operating system | Collected automatically |
| Usage data | Pages visited, links clicked, time on page, referring site | Collected automatically through cookies and similar technologies |
| Communications data | Messages, enquiries, feedback, survey responses | You provide it directly |
| Marketing data | Your marketing and communication preferences | You provide it or we record it |
Sensitive personal data
We do not intentionally collect sensitive personal data (such as health information, biometric data, religious or political beliefs, or ethnic origin) unless it is necessary for our services. [If you do collect it, state what, why, and the additional safeguards.] Where we do collect it, we will do so only with your explicit consent or where the law permits.
Children’s data
Our Site and services are not directed at children under 18, and we do not knowingly collect their personal data without the consent of a parent or guardian. If you believe a child has given us personal data without that consent, please contact us and we will delete it promptly.
How and Why We Use Your Personal Data
We process personal data only where we have a lawful basis under the Act. The table below sets out the purposes and the basis we rely on.
| Purpose | Lawful basis |
|---|---|
| To create and manage your account | Performance of a contract |
| To process orders, payments and deliveries | Performance of a contract |
| To provide customer support and respond to enquiries | Performance of a contract; legitimate interests |
| To send you service notices and policy updates | Legal obligation; legitimate interests |
| To send marketing communications | Your consent |
| To place non-essential cookies and analytics | Your consent |
| To improve our Site, products and services | Legitimate interests |
| To prevent fraud and keep our systems secure | Legitimate interests; legal obligation |
| To comply with tax, accounting and other legal duties | Legal obligation |
We will use your personal data only for the purposes we collected it for, unless we reasonably consider that we need to use it for another compatible purpose and tell you why. We do not make decisions about you based solely on automated processing that significantly affects you. [Confirm this is accurate for your business.]
Consent
Where we rely on your consent, it will be freely given, specific, informed and unambiguous, and we will ask for it through a clear action such as ticking a box or pressing an accept button. You can withdraw your consent at any time by contacting us or using the settings in your account or the unsubscribe link in our messages. Withdrawing consent does not affect processing carried out before you withdrew it, and may mean we can no longer provide certain services.
Cookies and Similar Technologies
We use cookies and similar technologies on the Site. Please see our Cookie Policy for details of what we use and how to manage your choices. Non-essential cookies are set only with your consent.
Marketing
With your consent, we may send you news, offers and updates by email, SMS or other channels. You can opt out at any time by clicking “unsubscribe”, replying “STOP” to an SMS, or emailing us. We will never sell your personal data to third parties for their own marketing.
Who We Share Your Personal Data With
We share personal data only where necessary and under appropriate safeguards. Recipients may include:
- Service providers (data processors) who act on our instructions, such as hosting providers, payment processors ([e.g. Safaricom M-Pesa, card processors]), delivery partners, email and SMS platforms, and analytics providers.
- Professional advisers such as lawyers, auditors, accountants and insurers.
- Government and regulatory authorities, including the Kenya Revenue Authority and the ODPC, where we are legally required to disclose.
- Business transferees, if we sell or restructure the business, in which case the new owner must honour this policy.
- Others, with your consent or at your direction.
We require all processors to protect your data, to use it only for our specified purposes, and to process it in line with the Act.
Transfers Outside Kenya
Some of our service providers are located outside Kenya, including in [countries, e.g. the United States, the European Union]. We transfer personal data abroad only where the Act permits: for example, where the destination country has adequate data protection safeguards, where we have put appropriate safeguards in place such as contractual clauses, or where you have given consent after being informed of the risks. [Where required, we also process certain categories of data only within Kenya.] You can contact us for more information about the safeguards we use.
How Long We Keep Your Personal Data
We keep personal data only for as long as necessary for the purposes described in this policy, including to meet legal, tax, accounting and reporting requirements. As a guide:
| Data | Retention period |
|---|---|
| Account data | For as long as your account is active, then [x months/years] |
| Transaction and invoice records | [7 years], to meet tax and accounting obligations |
| Marketing preferences | Until you withdraw consent, then a suppression record |
| Enquiries and support messages | [24 months] after the matter is closed |
| Technical and usage data | [26 months] |
When data is no longer needed, we delete it or anonymise it so that you can no longer be identified.
How We Protect Your Personal Data
We apply appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access, alteration and disclosure. These include [encryption of data in transit, access controls and authentication, regular security testing, staff training, and confidentiality obligations for staff and processors]. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the ODPC within 72 hours of becoming aware of it and will inform affected individuals without unreasonable delay.
Your Rights
Under the Data Protection Act, 2019, you have the right to:
- Be informed about how your personal data is used (the purpose of this policy).
- Access the personal data we hold about you.
- Correct inaccurate or incomplete personal data.
- Delete personal data that is misleading, out of date or no longer needed, where the law allows.
- Object to the processing of your personal data, including for direct marketing.
- Data portability: receive your personal data in a structured, commonly used format and have it transmitted to another controller where technically feasible.
- Withdraw consent at any time, where we rely on consent.
- Not be subject to automated decision-making that produces legal or similarly significant effects on you, subject to exceptions in the Act.
To exercise any of these rights, contact us using the details in section 2. We may need to verify your identity before acting on a request. We will respond within the period required by law, and we do not normally charge a fee unless a request is clearly unfounded or excessive.
Complaints
We would like the chance to resolve any concern first, so please contact us at hello@commarkly.com. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya at any time:
Office of the Data Protection Commissioner [Address and website: confirm current details at the ODPC website]
Third-Party Links
The Site may contain links to other websites, plug-ins and applications operated by third parties. We do not control them and are not responsible for their privacy practices. We encourage you to read the privacy policy of every site you visit.
Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version on the Site with a new “Last updated” date and, where changes are significant or the law requires it, notify you directly or seek your consent again.
Contact Us
If you have questions about this policy or how we handle your personal data, please contact:
Commarkly [Registered address] Email: hello@commarkly.com Phone: +254 714 874 155 [Data Protection Officer, if applicable]