Privacy Policy

1. Personal data we collect

• Account data: name, email address, phone number, university, campus location, authentication identifiers, account role, and the version and date you last accepted our Terms and Privacy Policy.
• Order data: items, quantities, prices, delivery or pickup location, contact details, payment method, and order status.
• Seller data: business details, phone number, social handles, shop profile, product listings, profile photo, identity document photo, subscription details, M-Pesa reference code, and payment phone number.
• Communications: support messages, reports, reviews, and quick feedback.
• Technical and usage data: security logs and marketplace events such as shop views, product views, cart additions, and WhatsApp clicks. Your browser may also store your cart and theme choice locally.

Please do not submit unnecessary sensitive information in listing descriptions, reviews, or support messages.

2. How and why we use personal data

We use data to operate accounts and orders, connect buyers with sellers, review and verify sellers, moderate listings, process seller subscriptions, provide support, prevent abuse, secure the service, analyse marketplace performance, meet legal obligations, and improve ShopPepe.

Depending on the activity, processing is based on performing our agreement with you, your consent, compliance with law, or our legitimate interests in operating a safe marketplace. You may withdraw consent where consent is the basis, without affecting earlier lawful processing.

Marketing communications: with your consent, we may send campus-relevant marketing by email, SMS, or WhatsApp, such as new-drop alerts or seller promotions. This is separate from order, security, and account-service messages, which we send regardless of marketing consent. Every marketing message includes a way to opt out, or you can email ShopPepe26@gmail.com with "Unsubscribe" in the subject.

3. When we share data

• Sellers: a seller receives the customer and order details needed to fulfil that seller’s items. Do not use this data for unrelated marketing.
• Service providers: Supabase provides authentication, database, and file storage services. Hosting and communications providers may process limited technical data.
• WhatsApp: when you choose a WhatsApp link, WhatsApp receives data under its own privacy terms.
• Legal and safety reasons: we may disclose information where required by law or reasonably necessary to protect users, rights, property, or the marketplace.
• Business changes: data may transfer as part of a merger, financing, reorganisation, or sale, subject to appropriate safeguards.

We do not sell personal data.

4. International processing

Some service providers may process or store data outside Kenya. Where this occurs, we will use safeguards required by applicable Kenyan data protection law.

5. Retention

We keep personal data only as long as needed for the purposes above, dispute handling, security, and legal or accounting duties. Seller verification records receive restricted access and should be deleted when no longer required for verification or legal defence. Local cart and theme data remain in your browser until you clear them.

6. Security

We use access controls, Supabase authentication, row-level database security, role and ownership checks, restricted storage paths, HTTPS deployment headers, and listing moderation. No online service can guarantee absolute security. Use a unique password, protect your device, and report suspicious activity promptly.

7. Your rights

Subject to Kenyan law, you may ask to be informed about processing, access your data, object to processing, correct inaccurate data, request deletion of false or misleading data, or request data portability where applicable. You may also complain to Kenya’s Office of the Data Protection Commissioner.

We may need to verify your identity before completing a request. Some data may be retained where law or a valid legal claim requires it.

8. Children

ShopPepe is not intended for children under 18. Do not create an account or submit seller identity documents if you are under 18. Contact us if you believe a child has provided personal data.

9. Changes to this policy

We may update this policy as the service or law changes. We will publish the revised date and provide additional notice where a material change requires it.

10. Contact and privacy requests

Email ShopPepe26@gmail.com or use the support form. Include “Privacy Request” in the subject. You can also contact the Office of the Data Protection Commissioner.