Privacy Policy

1. Introduction

SilkCommerce ("SilkCommerce", "we", "us", or "our") provides an e-commerce platform that enables merchants in Kenya and across Africa to set up and run online stores. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our platform, whether as a merchant ("Store Owner"), a Store Owner's staff, or a customer shopping on a store built with SilkCommerce (each a "User"). This policy is issued in line with the Kenya Data Protection Act, 2019 and its subsidiary regulations, as enforced by the Office of the Data Protection Commissioner (ODPC).

2. Information We Collect

We collect the following categories of personal data:

• Account information: full name, email address, phone number, physical/business address, and password, provided when you register a store or a customer account.
• Store and business information: shop name, shop description, product listings, and branding assets uploaded by Store Owners.
• Transaction information: order details, billing and delivery addresses, and payment references from providers such as M-Pesa, card processors, and other payment gateways. We do not store full M-Pesa PINs or card numbers — these are processed directly by our licensed payment partners.
• Communications data: messages, support requests, and marketing preferences, including SMS, WhatsApp, and email marketing opt-ins.
• Technical data: IP address, browser type, device identifiers, and usage data collected via cookies and similar technologies.
• Location data: general delivery location provided at checkout or store setup.

3. How We Use Your Information

We use personal data to:

• Create and manage store and customer accounts, and authenticate users.
• Process orders, payments, refunds, and withdrawals/payouts to Store Owners.
• Provide customer support and respond to enquiries.
• Send transactional communications (order confirmations, delivery updates, payment receipts) and, where you have consented, marketing communications via SMS, email, or WhatsApp.
• Enable POS, inventory, wallet, analytics, and other features Store Owners choose to activate.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal, tax, and regulatory obligations under Kenyan law.
• Improve and develop our platform and services.

4. Legal Basis for Processing

We process personal data on the basis of: performance of a contract (fulfilling orders and providing platform services), consent (for marketing communications and optional features), legitimate interests (fraud prevention, platform security, and service improvement), and compliance with legal obligations (tax records, consumer protection, and law enforcement requests).

5. Sharing of Information

We may share personal data with:

• Payment service providers (e.g. Safaricom M-Pesa, card processors, and banks) to process payments and payouts.
• Logistics and delivery partners to fulfil orders.
• SMS, email, and WhatsApp Business messaging providers to deliver notifications and marketing messages you have opted into.
• Cloud hosting and infrastructure providers who store and process data on our behalf under confidentiality obligations.
• Regulators, tax authorities (including the Kenya Revenue Authority), or law enforcement, where required by law.
• Professional advisors (auditors, lawyers) and, in the event of a merger, acquisition, or restructuring, a successor entity.

6. Cookies and Tracking Technologies

Our website and merchant storefronts use cookies and similar technologies to keep you signed in, remember cart contents, understand how our platform is used, and measure the performance of marketing campaigns. You can control cookies through your browser settings, though disabling them may affect certain features.

7. Data Retention

We retain personal data for as long as your account is active and as necessary to provide our services, comply with legal obligations (including the seven-year record-keeping requirements common under Kenyan tax and company law), resolve disputes, and enforce our agreements. When data is no longer required, we securely delete or anonymise it.

8. Data Security

We implement appropriate technical and organisational measures — including encryption in transit, access controls, and regular security reviews — to protect personal data against unauthorised access, loss, misuse, or alteration. No system is completely secure, and we encourage users to use strong, unique passwords and to keep their login credentials confidential.

9. Your Rights

Under the Data Protection Act, 2019, you have the right to:

• Be informed of the use to which your personal data is to be put.
• Access your personal data that we hold.
• Request correction or update of inaccurate or outdated personal data.
• Request deletion or restriction of processing of your personal data, subject to legal retention requirements.
• Object to processing of your personal data, including for direct marketing.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

To exercise any of these rights, contact us using the details in Section 12 below.

10. Children's Privacy

Our platform is not directed at children under the age of 18. We do not knowingly collect personal data from children without the consent of a parent or guardian. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on this page with a revised "last updated" date, and where changes are material, we will provide additional notice.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how your personal data is handled, please contact us at:

• Email: hello@silkcommerce.business
• Data Protection Officer: SilkCommerce Data Protection Office
• Office of the Data Protection Commissioner (ODPC), Kenya: www.odpc.go.ke