This policy explains how Juuhudi Technologies ("we", "us") handles personal data when you use our marketplace (juuhudi.co.ke). We are the data controller for this processing, and we handle personal data in accordance with the Data Protection Act, 2019 (Kenya).
Trust is our product. That applies to your data too: we collect what the Service needs to work and keep you safe, we don't sell it, and we tell you plainly what happens to it.
1. What we collect
Information you give us:
- Identity & profile: name, username, profile photo, bio, general location (e.g. "Westlands, Nairobi").
- Contact: email address, phone number.
- Verification data: one-time codes sent to verify your phone number (we store a hashed code temporarily, never in plain text).
- Listings: photos, descriptions, condition, prices, and item locations you publish.
- Messages: conversations you have with other members on the Service.
- Reports & reviews: reports you file and reviews you write.
Information created when you use the Service:
- Transaction records: credit purchases (amount, bundle, M-Pesa receipt number, the phone number used to pay), credit spending, exchange confirmations. We never see or store your M-Pesa PIN.
- Activity data: listings you view and save, response activity, moderation history.
- Technical data: device and browser information, IP address, and log data used for security and to operate the Service.
Information from third parties:
- Google, if you sign in with Google: your name, email address, and profile photo.
- M-Pesa, when you buy credits: payment confirmation details.
2. Why we process it (and the legal basis)
- To provide the Service — accounts, listings, messaging, credits, notifications (performance of a contract).
- To keep the marketplace safe — verifying phone numbers, moderating listings, investigating reports and suspected fraud, enforcing our Terms (legitimate interests in a safe, trusted marketplace; and legal obligation where applicable).
- To communicate with you — transactional emails and SMS about your account, listings, and purchases (performance of a contract); marketing communications only with your consent, which you may withdraw at any time (consent).
- To comply with the law — keeping records required for tax, accounting, and lawful requests (legal obligation).
- To improve the Service — aggregated, de-identified usage analysis (legitimate interests).
3. What other members can see
Your public profile shows: your name, username, photo, general location, join date, verification badges, active listings, sold-item history, exchange count, and reviews.
Your phone number and email address are never shown publicly and are never shared automatically with other members. Whether to share contact details with someone you're transacting with is always your choice.
Messages are visible only to the two participants in a conversation. Our staff do not read messages in the ordinary course; access is limited to safety and fraud investigations (for example, reviewing a reported conversation) and every such access is logged and auditable.
4. Who we share data with
We do not sell personal data. We share it only with:
- Service providers (processors) who help us run Juuhudi under contract — for database and storage hosting, application hosting, network security, email delivery, SMS delivery, and mobile-money payment processing.
- Authorities, where required by law or a valid legal process, or where necessary to prevent fraud or harm.
- A successor entity, if we undergo a merger, acquisition, or asset sale — under this policy's protections.
5. International transfers
Some of our providers store data outside Kenya (including in the European Union and the United States). Where personal data is transferred outside Kenya, we do so in accordance with the Data Protection Act's cross-border transfer requirements, using providers with appropriate safeguards and security certifications.
6. How long we keep it
- Account data: for as long as your account exists.
- Messages: for the life of the conversation, retained as a safety record.
- Transaction and credit records: up to seven (7) years, as required for accounting and tax purposes.
- OTP codes: minutes — deleted on verification or expiry.
- After account deletion: see below.
7. Your rights
Under the Data Protection Act, 2019, you have the right to:
- access the personal data we hold about you;
- correct inaccurate or incomplete data (most profile data you can edit yourself in Settings);
- delete your data (right to erasure);
- object to or restrict certain processing;
- data portability, where applicable;
- withdraw consent at any time, where processing is based on consent.
To exercise any right, email privacy@juuhudi.co.ke.
When you delete your account: your profile, photos, contact details, and personal data are erased. Reviews you received remain (they are other members' statements about their own experience); reviews you wrote may remain in anonymised form. Transaction records are retained for the legal retention period, then deleted.
8. Security
We protect personal data with encryption in transit, access controls, row-level database security, audited administrative access to sensitive data, and the principle of least privilege for our systems and staff. No system is perfectly secure; if a breach occurs that puts your rights at risk, we will notify you and the ODPC as the Act requires.
9. Cookies
We use essential cookies to keep you signed in and to secure the Service — these are always on, as the Service cannot work without them.
With your consent, we also use analytics cookies to understand how the Service is used so we can improve it. You choose whether to allow these the first time you visit, and you can change your mind at any time using the "Cookie preferences" link in the footer. We do not use advertising cookies, and we never sell your data.
10. Age
Juuhudi is for adults aged 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it.
11. Changes
We may update this policy. We will post the updated version with a new effective date and notify you of material changes through the Service or by email.
12. Contact
Data protection contact: privacy@juuhudi.co.ke
General support: support@juuhudi.co.ke
Controller: Juuhudi Technologies (juuhudi.co.ke)