Legal
Privacy Policy
Last updated: 12 September 2026
This is a working draft written to match what Africa Softwares and Services actually collects and does today. It is not legal advice, and it has not been reviewed by a lawyer. Before relying on it, have it reviewed by qualified counsel and replace the bracketed […] placeholder with your registered business details.
This Privacy Policy explains what personal data Africa Softwares and Services ("we", "us") collects when you use the Platform, why, and what rights you have over it. The data controller is [Legal entity name], [registered address], Kenya.
1. Data we collect
| Category | Examples | When |
|---|---|---|
| Account data | First and last name, email, phone number, company name, bio, profile photo | When you register or edit your profile |
| Listing data | Business/product name, description, category, screenshots, location, contact email and phone, website | When you create or edit a listing |
| Review data | Star rating and comment text, linked to your account and the listing | When you leave a review |
| Security & technical data | IP address, timestamps, and outcome of login/sign-in attempts, one-time code (2FA) requests, and password-reset requests | Automatically, whenever you sign in, verify a code, or reset a password |
| Cookies | Session-authentication and CSRF-protection cookies | Automatically — see our Cookie Policy |
| Payment data (where enabled) | Amount paid and a payment reference for paid placement — we do not store your card or mobile-money credentials ourselves | Only if you purchase paid placement for a listing |
2. Why we use it
- To provide the service — create your account, show your listings and reviews, let others contact a listed business.
- To authenticate you — verify your password, email you a one-time sign-in code, process password-reset requests.
- To keep the Platform secure — detect and respond to failed logins, brute-force attempts, and stolen-session indicators using IP address and timing data.
- To verify listings — check that a listed product or service and its contact details appear genuine before granting a Verified badge.
- To communicate with you — transactional emails only (sign-in codes, password resets, account notices), not marketing unless you separately opt in.
- To comply with the law — respond to lawful requests from courts or regulators.
3. Legal basis for processing
We process account, listing, and review data because it is necessary to perform our contract with you (the Terms of Service). We process security and technical data (IP address, login/2FA event logs) on the basis of our legitimate interest in keeping accounts and the Platform secure, in a way that does not override your own rights and interests. Where we rely on your consent for anything else (for example, marketing emails), you may withdraw it at any time.
4. Who we share it with
We do not sell your personal data. We share it only with:
- service providers who host the Platform, send email on our behalf, or process payments — bound by contract to protect your data and use it only to provide that service to us;
- other users, to the extent a listing, review, or profile is designed to be publicly visible;
- authorities, where required by law, court order, or to protect the rights, property, or safety of us or others.
5. How long we keep it
We keep account, listing, and review data for as long as your account is active, and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. Security event logs (login/2FA/reset activity) are kept for a shorter period sufficient for fraud detection and are not used for any other purpose.
6. How we protect it
Passwords are hashed, never stored in plain text. Session tokens are stored in cookies your browser's JavaScript cannot read, and are protected against cross-site request forgery. Sign-in requires a one-time code sent to your email in addition to your password. Traffic to the Platform is encrypted in production. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Your rights
Under Kenya's Data Protection Act, 2019, and equivalent laws elsewhere, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- request deletion of your data, subject to our legal and legitimate business needs (for example, keeping records required by law);
- object to, or ask us to restrict, certain processing;
- receive a copy of your data in a portable format; and
- lodge a complaint with the Office of the Data Protection Commissioner (Kenya), or your local data protection authority.
Most of this you can already do yourself from your profile page. For anything else, contact us using the details below.
8. International users
The Platform is operated from Kenya and our servers may be located there or in another country we or our service providers use for hosting. If you use the Platform from outside Kenya, your data will be processed in Kenya (and possibly elsewhere), and by using the Platform you consent to that transfer.
9. Children
The Platform is not directed at, and we do not knowingly collect data from, anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, take reasonable steps to notify registered users.
11. Contact
To exercise any of the rights above, or for any question about this policy, contact info@afrisoftkenya.com.
See also our Terms of Service and Cookie Policy.