Privacy Policy

1. Overview

AFFOMARKET ("AFFOMARKET", "we", "us", or "our") operates the website https://affomarket.sabiahq.com and related sourcing, commerce and delivery services in Kenya. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website, create an account, place an order, submit a sourcing request, communicate with our support team, or otherwise use our services (collectively, the "Services").

By using the Services, you consent to the practices described in this policy. If you do not agree with our policies and practices, please do not use our Services. This policy is compliant with the Data Protection Act, 2019 of Kenya and applicable international standards where relevant.

Google Sign-In | How it works

AFFOMARKET uses Google Sign-In to securely authenticate your account and help you access your profile, orders, favorites and other account features. We do not sell your Google account information or use it for advertising.

2. Information we collect

2.1 Information you provide to us

We collect information you directly provide when using our Services, including:

• Account and contact details: full name, email address, phone number, and password when you register an account.
• Sourcing and order details: delivery location, item names, budgets, preferred brands, condition preferences, requirements, and any images you upload to a sourcing request.
• Checkout information: billing and delivery address, recipient contact details, and order notes.
• Customer support communications: messages, chat transcripts, emails, and call notes when you contact us for help.
• Reviews and feedback: product ratings, written reviews, and public testimonials you choose to submit.
• Promotional entries: contact details and preferences submitted for competitions, giveaways or marketing campaigns.

2.2 Information collected automatically

When you interact with our website, we automatically collect certain technical information:

• Device and browser type, operating system, screen resolution, and language.
• IP address, approximate geographic location (country/city-level), and ISP.
• Pages visited, time spent, links clicked, search queries, and referral websites.
• Errors encountered and website performance statistics.

2.3 Information from third parties

From time to time, we may receive information about you from payment processors, identity verification services, delivery partners and public social profiles to the extent permitted by applicable law and only where necessary to perform our contract with you or comply with a legal obligation.

3. How we use information

We use the information we collect for the following purposes:

1. To provide our Services: creating and managing your account, processing and fulfilling orders, sourcing products on your request, arranging delivery, and sending service-related messages.
2. To communicate with you: confirming orders, updating you on sourcing status, responding to enquiries, and providing customer support.
3. To process payments: securely transmitting payment details to our payment processors and preventing fraudulent transactions.
4. To personalise your experience: remembering your preferences, showing relevant products, and tailoring content and recommendations.
5. To improve our Services: analysing usage patterns, testing features, optimising website performance, and conducting surveys and research.
6. To send marketing communications: where you have opted in or where permitted by law, providing news, offers and promotions about our products and services.
7. To protect our rights and users: detecting, investigating and preventing fraud, abuse, security incidents and illegal activities, and enforcing our Terms of Service.
8. To comply with legal obligations: responding to lawful requests, court orders, audits and regulatory requirements under Kenyan law.

3.1 Legal bases for processing

Where applicable, we process personal information on the following legal bases: performance of a contract with you; our legitimate business interests; compliance with a legal obligation; and, where required, your explicit consent — for example, before sending marketing SMS or email campaigns.

4. Sharing information

We do not sell your personal information. We share information only in the following circumstances and with carefully selected third parties:

• Delivery partners: name, phone number, address and order details required to deliver your order to the correct location within Kenya.
• Payment processors: Paystack, M-Pesa, or other authorised payment providers acting as data processors for card and mobile-money transactions.
• Suppliers and sourcing partners: limited, anonymised or pseudonymised product requirements when sourcing items on your behalf — we never share your payment information with suppliers.
• Professional advisors and authorities: lawyers, auditors, insurers, regulators and law enforcement bodies where required by law or to establish, exercise or defend legal claims.
• Business transfers: in the event of a merger, acquisition, reorganisation, or sale of all or part of our business, customer information may be one of the transferred assets.
• With your consent: in any other case, we will ask for your explicit consent before sharing personal information.

5. Data security

We take reasonable and appropriate technical and organisational security measures to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Encrypted connections (TLS/HTTPS) across our website and APIs.
• Hashing and salted storage for account passwords using industry-standard algorithms.
• Role-based access controls and least-privilege principles for staff accounts.
• Regular security reviews, vulnerability scans and penetration testing.
• Secure Supabase-based infrastructure with row-level security on customer data.
• Confidentiality agreements and ongoing data-protection training for our team.

Despite these measures, no data transmission over the internet or storage system is 100% secure. We cannot guarantee absolute security of information transmitted to or from our Services. You transmit information at your own risk and are responsible for keeping your account password secure and confidential.

6. Data retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting obligations. Our general retention schedule is as follows:

• Account information: retained for the lifetime of the account plus seven (7) years after closure or dormancy, in line with Kenyan tax and consumer-protection requirements.
• Orders and sourcing requests: at least seven (7) years from the date of the last order or request activity to comply with statutory record-keeping.
• Payment records: retained in line with payment-processor and tax-authority requirements (minimum 5–7 years).
• Marketing consents: until opt-out or withdrawal of consent, plus record of withdrawal retained for three (3) years.
• Anonymous analytics: up to twenty-four (24) months, after which it is aggregated or deleted.

7. Your rights

Under the Data Protection Act, 2019 and other applicable laws, you have a number of rights in relation to your personal information. These include:

1. Right of access: You may request a copy of the personal information we hold about you together with details of how it is processed.
2. Right to rectification: You may ask us to correct inaccurate or incomplete information about you.
3. Right to erasure ("right to be forgotten"): You may request deletion of your personal information, subject to our need to retain it for legal or legitimate business purposes.
4. Right to restriction of processing: In certain circumstances you may ask us to suspend processing of your personal data.
5. Right to data portability: Where information is processed by automated means on the basis of consent or contract, you may request transfer of that information to another controller in a machine-readable format.
6. Right to object: You may object to processing based on our legitimate interests or for direct-marketing purposes at any time, free of charge.
7. Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
8. Right to complain: If you believe our processing of your information infringes the Data Protection Act, you may complain to the Office of the Data Protection Commissioner (ODPC), Kenya or contact us directly.

To exercise any of these rights, please email us at support@affomarket.co.ke with your full name, registered email, and a clear description of your request. We will respond to legitimate requests within thirty (30) days, extendable by a further sixty (60) days where the request is complex or voluminous. Identity verification may be required before disclosing or amending information, in order to protect your data.

8. Cookies and similar tracking technologies

We use cookies — small text files stored on your device — and similar technologies such as local storage to enhance your experience on our website. The categories of cookies we use include:

• Strictly necessary cookies: Required for core functionality such as login sessions, shopping cart persistence, CSRF protection, and navigation. These cannot be disabled if you wish to use the Services.
• Preference / functionality cookies: Remember your display preferences such as language and region, and past searches to personalise your experience.
• Analytics cookies: Help us understand how visitors use the website — which pages are popular, how users navigate, where errors occur — so we can continuously improve.
• Marketing cookies: Used only with consent to serve relevant advertisements on third-party platforms (Facebook, Google, Instagram) and measure campaign performance.

You can manage or delete cookies through your browser settings. Please note that deleting or blocking certain cookies may impair features of the website. For more details, please refer to your browser's help documentation or contact us.

9. Third-party services and links

Our website may embed content, widgets, and links operated by third parties, including:

• Paystack, M-Pesa and other payment gateways (when you checkout).
• Google Analytics and similar analytics tools.
• Meta, X, TikTok and Instagram pixels and social-share buttons.
• Embedded YouTube videos or Google Maps content.

These third parties have their own privacy policies and practices over which we exercise no control. When you leave our website or interact with third-party content, their policies govern your information. We encourage you to review the privacy policies of every website you visit. We are not responsible for the practices or content of any linked third-party website or service.

10. Children's privacy

Our Services are not intended for children under the age of eighteen (18) and we do not knowingly collect personal information from children. If you are a parent or guardian and you believe we have collected information from a child, please contact us immediately at support@affomarket.co.ke. We will take reasonable steps to promptly remove such information from our records and, where applicable, close any account that was opened by a minor.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal or regulatory requirements, or for operational and commercial reasons. When we make material changes, we will:

• Revise the "Last updated" date at the top of this page.
• Notify you by prominent notice on the website homepage for a reasonable period.
• Where the changes significantly affect your rights, email registered account holders at least thirty (30) days before the changes take effect.

Your continued use of the Services after the effective date of the revised policy constitutes acceptance of the changes. We encourage you to review this page periodically for the latest information on our privacy practices.

12. Contact us

If you have questions, concerns, complaints or requests regarding this Privacy Policy or our handling of your personal information, please contact our Data Protection representative via any of the channels below: