Draft. This page is being reviewed by a Kenyan advocate and may change before SokoSwift Kenya opens.
This policy explains what personal data SokoSwift Kenya collects, why, and your rights under Kenya’s Data Protection Act 2019. We are the data controller for the personal data described here, and we are registered (or applying to register) with the Office of the Data Protection Commissioner (ODPC).
What we collect
- Account details: your name, phone number and/or email address, account type, and business details if you have a business account.
- Profile details you choose to add: photo or logo, town or area, bio and website.
- Your ads: titles, descriptions, photos, prices and location.
- Messages you send and receive on SokoSwift Kenya.
- Payments: for paid extras, the M-Pesa number you paid from, the amount, and Safaricom’s receipt number. We never see your M-Pesa PIN.
- Verification: if you ask to be verified, the last 4 digits of your ID number, or your business registration number or KRA PIN. We look at documents on a call but don’t keep copies.
- Reports and contact form messages you send us.
- Technical data: basic logs such as IP address and browser type, used to keep the service secure.
- Visit statistics: which pages are viewed and your device type, counted without cookies and without identifying you.
We don’t collect sensitive personal data such as health, religion or ethnicity, and we ask you not to put it in ads or messages.
Why we use it, and our lawful basis
- To run your account and show your ads: to perform our agreement with you.
- To send sign-in emails and alerts by email (or SMS, where we offer it), such as new message alerts and reminders before ads expire: to perform our agreement. You can switch alerts off in Settings. We don’t send marketing messages without your consent.
- To take payments for paid extras, and keep records the law requires: our agreement and legal obligations.
- To keep the marketplace safe: preventing fraud, reviewing reports, verifying sellers and enforcing our rules: our legitimate interests, and legal obligations.
- To answer your questions when you contact us, and to improve the site from anonymous statistics: our legitimate interests.
What other people can see
Your ads, display name or business name, profile photo, town and member-since date are public. Your email address is never shown. Your phone number is only shown if you switch on the Call or WhatsApp button, and then only to signed-in members.
Who we share it with
We don’t sell your data. We use trusted providers to run the service:
- Supabase (database, sign-in and photo storage)
- Vercel (website hosting and visit statistics)
- Safaricom (M-Pesa payments)
- Resend (sending emails)
Some of these providers store data outside Kenya. When they do, we only transfer data where the Data Protection Act allows it, with appropriate safeguards such as contracts that protect your data to the same standard. We may share information with the police or regulators where the law requires it, or to prevent fraud.
How long we keep it
We keep your account data while your account is open. When you delete your account, we delete your profile, ads, messages and saved items. We keep payment records for as long as Kenyan tax law requires (at least 5 years), without linking them to a deleted account, and limited records about fraud reports where needed for legal reasons.
Keeping it safe
Your data is protected with encryption in transit, strict access rules in our database, and limited staff access. If a breach puts your data at risk, we will tell the Data Protection Commissioner within 72 hours and tell you without delay.
Your rights
You have the right to be told how your data is used, to access it, to have it corrected or deleted, to object to how we use it, and to get a copy in a format you can take elsewhere. You can delete your account yourself from Settings. To use any other right, contact us at hello@sokoswift.ke. If you’re unhappy with how we’ve handled your data, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.
Children
SokoSwift Kenya is for adults. You must be 18 or over to create an account, and we don’t knowingly collect children’s data.
Cookies
We only use cookies that keep you signed in. See our Cookie Policy for details.
Who we are
This website is run by SokoSwift Global Limited, a company registered in Kenya and based in Mombasa, Kenya. You can contact us at hello@sokoswift.ke or on +254 755 552525.