Afribit Marketplace — Privacy Policy

This Privacy Policy explains how Afribit Marketplace ("Afribit", "we", "us") collects, uses, stores, and protects your personal information in accordance with the Kenya Data Protection Act, 2019 and the regulations issued by the Office of the Data Protection Commissioner (ODPC).

1. Information We Collect

1.1 Information You Provide

• Account registration: Name, email address (optional — not required for Nostr-authenticated accounts), phone number (optional), password (not applicable for Nostr-authenticated accounts)
• Merchant onboarding: Business name, business description
• Orders: Delivery address, order notes
• Communications: Messages sent to us via contact forms or email

1.2 Information Collected Automatically

• Usage data: Pages visited, features used, timestamps
• Device data: Browser type, operating system, screen resolution
• Network data: IP address (used for rate limiting and security; not stored long-term)

1.3 Payment Information

• We do not collect or store credit card numbers, bank account details, or mobile money PINs
• Payment processing is handled by BTCPay Server (self-hosted). We record transaction identifiers, amounts, and payment status — not private wallet keys or seed phrases

2. How We Use Your Information

We process your personal data for the following purposes, each with a lawful basis under the Kenya Data Protection Act:

| Purpose | Lawful Basis | |---------|-------------| | Creating and managing your account | Performance of contract | | Processing orders and facilitating payments | Performance of contract | | Communicating order status and platform updates | Performance of contract | | Merchant verification and approval | Legitimate interest | | Preventing fraud and enforcing Terms of Service | Legitimate interest | | Sending marketing emails (Proof Pack, newsletters) | Consent (opt-in) | | Improving Platform functionality and user experience | Legitimate interest | | Complying with legal obligations | Legal obligation |

3. Information Sharing

We do not sell your personal data.

We may share limited information with:

• Merchants: When you place an order, the Merchant receives your name and delivery information to fulfil the order
• Service providers: Cloud hosting (AWS), email delivery services — bound by data processing agreements
• Law enforcement: When required by Kenyan law, court order, or to protect the safety of our users
• Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred to the successor entity

4. Data Retention

• Active accounts: Data retained for the duration of your account plus 2 years after closure
• Transaction records: Retained for 7 years as required by Kenyan tax and financial record-keeping laws
• Marketing leads: Retained until you unsubscribe, then deleted within 30 days
• Security logs (IP addresses): Retained for a maximum of 90 days

5. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access your personal data and obtain a copy
• Rectify inaccurate or incomplete data
• Delete your data (subject to legal retention requirements)
• Object to processing based on legitimate interest
• Withdraw consent for marketing communications at any time
• Data portability — receive your data in a structured, machine-readable format
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encrypted data transmission (HTTPS/TLS)
• Hashed and salted passwords (bcrypt)
• Support for multi-factor authentication (MFA) to secure user access and authorise sensitive actions
• Rate limiting on authentication endpoints
• HMAC signature verification on payment webhooks
• Role-based access controls (admin, merchant, customer)

While we take reasonable precautions, no system is 100% secure. We cannot guarantee absolute security of data transmitted over the internet.

7. Cookies & Local Storage

The Platform uses:

• Session cookies: Essential for authentication (NextAuth.js session tokens)
• Local storage: Shopping cart contents (stored on your device only, not sent to our servers)

We do not use third-party tracking cookies or advertising pixels.

8. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If we discover that a minor has created an account, we will delete it promptly.

9. International Data Transfers

Your data is stored on servers located outside Kenya (United States — AWS). We ensure appropriate safeguards are in place as required by the Kenya Data Protection Act, including ensuring our service providers maintain equivalent data protection standards.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or Platform notification. The "Last updated" date at the top indicates when changes were last made.

11. Contact & Data Protection Officer

For privacy-related questions or to exercise your rights:

Email: [email protected] Data Protection Queries: [email protected] Regulatory Authority: Office of the Data Protection Commissioner (ODPC), Kenya — https://www.odpc.go.ke