Privacy Policy

We collect different categories of data depending on how you interact with the Yumitrade platform:

Personal Information

• Full name, email address, and phone number.
• Business name, registration number, and address.
• Government-issued identification documents (for supplier verification).
• Banking and payment information for transaction processing.

Usage Data

• Pages visited, features used, and time spent on the platform.
• Search queries, product views, and browsing patterns.
• Device information, browser type, operating system, and IP address.
• Referral source and interaction with marketing communications.

Transaction Data

• Order details, purchase history, and payment records.
• Communication records between buyers and suppliers.
• Dispute information and resolution outcomes.
• Shipping and delivery tracking information.

We use the data we collect for the following purposes:

• Platform Operations: To provide, maintain, and improve our marketplace services, including account management and transaction processing.
• Verification: To verify the identity and legitimacy of suppliers through our Verified Supplier Programme.
• Communication: To send you transaction updates, order confirmations, security alerts, and service-related notifications.
• Personalisation: To tailor your experience, including product recommendations and search results based on your activity.
• Safety & Security: To detect and prevent fraud, abuse, and security incidents on the platform.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes, including tax reporting and anti-money laundering requirements.
• Analytics: To analyse platform usage trends and improve our services through aggregated, anonymised data.

In accordance with the Kenya Data Protection Act 2019, we process your personal data based on the following legal grounds:

• Contractual Necessity: Processing is required to fulfil our contract with you, including providing marketplace services, processing transactions, and managing your account.
• Consent: Where you have given explicit consent, such as for marketing communications, personalised recommendations, and non-essential cookies.
• Legal Obligation: Processing necessary to comply with Kenyan law, including tax regulations, anti-money laundering requirements, and data protection obligations.
• Legitimate Interest: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, and service improvement, provided these interests do not override your fundamental rights.

Where we rely on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

We do not sell your personal data. We may share your data with the following categories of recipients:

• Trading Partners: Necessary order and contact information is shared between buyers and suppliers to facilitate transactions.
• Payment Processors: Licensed payment service providers who process transactions and manage escrow services on our behalf.
• Logistics Partners: Shipping and delivery service providers who require information to fulfil orders.
• Verification Services: Third-party services used to verify business identities and documents during the supplier verification process.
• Legal Authorities: Government agencies, law enforcement, or regulators when required by law or to protect our legal rights.
• Service Providers: Cloud hosting, analytics, and support services that assist in operating the platform, subject to strict data processing agreements.

All third-party recipients are required to protect your data in accordance with the Kenya Data Protection Act 2019 and our data processing agreements.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.3. Sensitive data at rest is encrypted using industry-standard AES-256 encryption.
• Access Controls: Strict role-based access controls ensure that only authorised personnel can access personal data, and only to the extent necessary for their role.
• Authentication: Multi-factor authentication, secure session management, and automatic session expiration protect your account.
• Monitoring: Continuous security monitoring and logging to detect and respond to potential security incidents.
• Regular Audits: Periodic security assessments and penetration testing to identify and address vulnerabilities.

While we take reasonable steps to protect your data, no system is completely secure. We encourage you to use strong passwords and enable two-factor authentication on your account.

Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Correction: You may request that we correct any inaccurate or incomplete personal data.
• Right to Deletion: You may request deletion of your personal data, subject to our legal obligations to retain certain records.
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to the processing of your data for direct marketing purposes or where we process data based on legitimate interests.
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances.

To exercise any of these rights, please contact our Data Protection Officer at the details provided below. We will respond to your request within 30 days.

We use cookies and similar tracking technologies to enhance your experience on the platform. Cookies help us remember your preferences, understand how you use our services, and improve platform performance.

For detailed information about the types of cookies we use, their purposes, and how to manage your cookie preferences, please refer to our Cookie Policy.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Account Data: Retained for the duration of your account and up to 2 years after account closure.
• Transaction Records: Retained for 7 years in accordance with Kenyan tax and commercial law requirements.
• Verification Documents: Retained for the duration of the supplier's verified status and 3 years thereafter.
• Communication Records: Retained for 2 years after the last interaction, or longer if related to an active dispute.
• Usage Data: Anonymised and aggregated after 12 months. Raw logs are retained for up to 90 days for security purposes.

When data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to you.

Yumitrade is a business-to-business marketplace intended for use by individuals who are at least 18 years of age and have the legal capacity to enter into binding agreements.

We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete that data promptly. If you believe a minor has provided us with personal data, please contact our Data Protection Officer.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you through the platform or via email for significant changes that affect how your data is processed.
• Provide a summary of key changes where practical.

Your continued use of the platform after changes to this policy constitutes your acceptance of the updated terms.

For any privacy-related questions, concerns, or to exercise your data rights, please contact our Data Protection Officer:

• Email: dpo@yumitrade.com
• Address: Data Protection Officer, Yumitrade Limited, Nairobi, Kenya
• Support: Contact Form

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya if you believe your data protection rights have been violated.