Privacy Policy

Embakasi33 Limited ("we", "us", "our") operates the local business directory platform at www.embakasi33.co.ke. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our Platform, in compliance with the Kenya Data Protection Act, 2019 (the "DPA") and related regulations.

This Policy applies to all users of our Platform, including visitors who browse without registering, registered users with accounts, and business owners who submit listings.

The data controller responsible for your personal data is:

Our Data Protection Officer (DPO) can be reached at dpo@embakasi33.co.ke for any queries specifically relating to data protection compliance.

3.1 Data You Provide Directly

• Account data: Name, email address, phone number, and password hash when you register
• Business listing data: Business name, description, address, category, photos, operating hours, and contact details
• Review data: Text reviews, star ratings, and the dates you submit them
• Communications: Messages you send to us via email, support tickets, or our contact form
• Payment data: Transaction reference numbers (we do not store card or M-Pesa PINs)

3.2 Data Collected Automatically

• Usage data: Pages visited, features used, search queries, and time spent on the Platform
• Device data: IP address, browser type and version, operating system, and screen resolution
• Location data: Approximate location derived from IP address (we do not collect precise GPS unless you explicitly enable it)
• Cookies and similar technologies: See Section 9 for details

3.3 Data from Third Parties

We may receive limited data about you from third-party services you use to sign in (such as Google OAuth), and from payment processors confirming the status of transactions.

We use your personal data to:

• Create and manage your account and authenticate your identity
• Publish, manage, and verify business listings submitted by you
• Display listings and search results to other users of the Platform
• Process payments and issue receipts for paid services
• Respond to your support requests, enquiries, and complaints
• Send transactional communications (account verification, password resets, listing status updates)
• Send marketing communications where you have given explicit consent, which you may withdraw at any time
• Analyse Platform usage to improve our services, fix bugs, and develop new features
• Detect, prevent, and investigate fraud, abuse, and violations of our Terms
• Comply with legal obligations under Kenyan law, including tax and anti-money laundering requirements

Under the DPA 2019, we rely on the following lawful bases for processing your personal data:

• Contract performance: Processing necessary to provide the services you have requested, including managing your account and publishing your listings
• Legitimate interests: Improving the Platform, preventing fraud, and direct marketing to existing users, balanced against your rights and interests
• Consent: For optional features such as marketing emails, push notifications, and precise location services. You may withdraw consent at any time without affecting prior processing
• Legal obligation: Where we are required to process data to comply with Kenyan law, including tax laws, court orders, and regulatory requirements

We do not sell your personal data to third parties. We may share your data with:

• Service providers: Hosting providers, payment processors, email delivery services, and analytics providers who process data on our behalf under data processing agreements
• Other users (public data only): Business listing information you submit is displayed publicly on the Platform. Reviews are attributed to your display name
• Legal authorities: Where required by a valid court order, subpoena, or legal obligation under Kenyan law, including requests from the Communications Authority of Kenya or law enforcement agencies
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of our assets, your data may be transferred to the acquiring entity, subject to the same privacy protections

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations:

• Account data: Retained for the duration of your account and for 3 years after closure, to comply with anti-fraud and tax obligations
• Business listing data: Retained while your listing is active and for 1 year after removal, unless you request earlier deletion
• Reviews: Retained indefinitely as part of the business's public profile, unless removed under our content policy
• Transaction records: Retained for 7 years as required by the Kenya Revenue Authority (KRA)
• Usage and analytics data: Aggregated or anonymised after 12 months; raw logs retained for no more than 90 days

When personal data is no longer needed, we delete or anonymise it securely. Where deletion is not immediately possible (e.g. backup archives), we isolate the data and prevent further processing until deletion occurs.

Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data where it is no longer necessary for the purpose it was collected, or where you withdraw consent
• Right to restrict processing: Request that we limit processing of your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format and transfer it to another controller
• Right to object: Object to processing based on legitimate interests, including direct marketing
• Right to withdraw consent: Withdraw consent at any time without affecting prior lawful processing

To exercise any of these rights, submit a request to privacy@embakasi33.co.ke. We will respond within 21 days as required by the DPA 2019. We may need to verify your identity before processing your request.

We use cookies and similar technologies to operate and improve the Platform. The cookies we use fall into the following categories:

• Strictly necessary: Required for the Platform to function (authentication sessions, security tokens, load balancing). These cannot be disabled.
• Functional: Remember your preferences such as language, location, and display settings. Disabled if you decline optional cookies.
• Analytics: Help us understand how users interact with the Platform, using privacy-focused tools. Data is aggregated and anonymised where possible.
• Marketing: Used only with your explicit consent to show relevant content. You may withdraw consent via our cookie preferences panel.

You can manage cookie preferences through your browser settings or our cookie consent banner. Note that disabling essential cookies may impair the functionality of the Platform.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• Transport Layer Security (TLS/HTTPS) encryption for all data in transit
• Encryption of passwords using industry-standard hashing algorithms (bcrypt)
• Role-based access controls limiting staff access to personal data on a need-to-know basis
• Regular security assessments and penetration testing
• Incident response procedures, including mandatory breach notification to the ODPC within 72 hours of discovery

While we take all reasonable precautions, no internet-based system is completely secure. If you suspect your account has been compromised, please contact us immediately at security@embakasi33.co.ke.

The Platform is not directed at children under the age of 18, and we do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a child, we will delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at privacy@embakasi33.co.ke and we will take immediate action.

Our primary data storage and processing infrastructure is located within Kenya. Where we use third-party service providers based outside Kenya (for example, cloud infrastructure or analytics providers), we ensure that appropriate safeguards are in place as required under Section 48 of the DPA 2019, including:

• Standard contractual clauses binding the recipient to data protection standards equivalent to those under Kenyan law
• Adequacy decisions by the ODPC where applicable
• Your explicit consent for specific transfers where required

You may request information about the specific safeguards in place for cross-border transfers by contacting our DPO.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users by email at least 14 days before the changes take effect
• Where required by law, seek fresh consent for any new processing activities

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy. If you do not agree with any changes, you should stop using the Platform and may request deletion of your account.

For any questions about this Privacy Policy or to exercise your data rights, please contact:

We aim to acknowledge all data rights requests within 3 business days and resolve them within the 21-day statutory period. If you are unhappy with our response, you may escalate to the Office of the Data Protection Commissioner (ODPC):