Legal
Privacy policy
Last updated: [DATE]
Draft. This policy is being reviewed and isn’t in force yet. Details in [brackets] are still to be confirmed.
This policy explains what personal data Zendo collects, why we need it, who we share it with and the rights you have under Kenya’s Data Protection Act, 2019. We collect as little as we can, and we never sell personal data.
Who we are
Zendo is run by [LEGAL NAME, e.g. Lindi Secure Solutions], registered in Kenya at [REGISTERED ADDRESS] (“Zendo”, “we”, “us”). We’re registered with the Office of the Data Protection Commissioner as [a data controller and processor, registration number ____]. You can reach us about privacy using the details under Contact us.
Shop owners and shop customers
- If you run a shop on Zendo (or work in one), or visit this website, Zendo decides how your data is used. This policy covers you.
- If you buy from a shop that uses Zendo, the shop decides how your details are used, and Zendo stores and processes them on the shop’s behalf. Please read that shop’s privacy policy, linked at the bottom of its website, and contact the shop about your details. We’ll help the shop answer you.
What we collect
Your account. Your name and email address. If you sign in with Google, we also receive your Google account’s name, email address and account ID. We never see your Google password, and Zendo has no passwords: we email you a one-time code instead.
Your shop and team. Your shop’s details, products and settings, and the names and email addresses of team members you invite.
Payments to Zendo. When you pay for your subscription with M-Pesa, Safaricom sends us the phone number and name of the person who paid, the M-Pesa transaction code, the amount and the time. We never see M-Pesa PINs.
Shop customers’ details (held for the shop): the phone number given at checkout, and a name, delivery address and note when given, plus what was ordered. When a shop records a payment, we also keep the payment method and M-Pesa code the shop enters.
Technical details. When you use Zendo, our servers record basic information such as your IP address, browser and the pages you open, to keep the service secure and working.
Visitor figures for shops. Shop websites measure visits with Google Analytics, but only after the visitor agrees. We also receive Google Search Console figures about how shops appear in Google search; these are totals, not details about individual people.
How we use it
- To provide Zendo (our contract with you): signing you in, running your shop, sending sign-in codes, order alerts and team invitations, and taking subscription payments.
- To meet legal duties: keeping invoices and payment records, and answering lawful requests from authorities.
- For our legitimate interests: keeping Zendo secure, preventing fraud and abuse, answering questions and giving support, understanding how Zendo is used, building reports and figures, and testing and improving features.
- With consent: measuring visits on shop websites, and any marketing emails. We only send marketing if you’ve agreed, and you can stop it at any time.
Before we use data for our legitimate interests, we weigh the privacy risk to you. We keep what we collect and who can see it to a minimum, keep it no longer than needed, and protect it.
We don’t make decisions about you using only automated means. We don’t sell personal data, and we don’t use shop customers’ details for our own marketing.
Data stored outside Kenya
Some of our providers store data outside Kenya, for example in the European Union or the United States. We only use providers that protect data to the standard Kenya’s Data Protection Act requires, with the safeguards it sets out. [TO CONFIRM with the providers’ data processing agreements]
How long we keep it
- Sign-in codes stop working after 10 minutes.
- Your account and shop for as long as you use Zendo. If a shop is locked for not renewing, we keep its data for [90 days] so you can come back, then delete it.
- Invoices and payment records for [5 years], as Kenyan tax law requires.
- Server logs for [30 days].
- Shop customers’ details for as long as the shop keeps them, or until the shop’s data is deleted.
Keeping it safe
- Everything travels over secure, encrypted connections (HTTPS).
- Sign-in codes are stored scrambled (hashed), work once, expire after 10 minutes and stop after 5 wrong tries.
- Each shop’s data is only open to that shop’s team, and sales figures only to its owner.
- Only Zendo staff who need it for their job can reach personal data.
Our team works continuously to keep Zendo secure, but no way of sending or storing data over the internet is completely secure, so we can’t promise absolute security. If a breach puts your data at risk, we’ll tell the Data Protection Commissioner within 72 hours and tell you without delay, as the law requires.
Your rights
Under Kenya’s Data Protection Act, 2019, you can:
- know what data we hold about you and get a copy of it;
- have wrong or incomplete data corrected;
- have your data deleted, unless we must keep it by law;
- object to, or ask us to limit, how we use your data;
- get your data in a format you can take elsewhere;
- withdraw your consent at any time, for example to analytics or marketing.
To use any of these rights, contact us. We’ll reply within [30 days]. If you’re not happy with our answer, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.
Children
Zendo accounts are for people aged 18 and over. We don’t knowingly collect data from children. If you think a child has given us their details, contact us and we’ll delete them.
Changes to this policy
We’ll update this policy when Zendo or the law changes. For important changes we’ll tell you by email or in your dashboard before they apply. The date at the top shows the latest version.
Contact us
For privacy questions or to use your rights: email helpdesk@zendo.co.ke, WhatsApp or call 0797 625 778, or write to [POSTAL ADDRESS], Nairobi, Kenya. See also our Terms and conditions.