1. Who we are
Pichatech operates the Pichatech marketplace in Kenya. We are the data controller for the personal data described in this policy. You can reach us about privacy at hello@pichatech.com.
2. Data we collect
We do not collect or store card numbers, M-Pesa PINs or bank credentials. Buyer payments go directly to sellers and never pass through Pichatech systems.
- Account data: name, email address, phone number, password (stored hashed), and the shops you own or work for.
- Order data: the name, email, phone number, delivery address, notes and items in an order. Sellers receive the details needed to fulfil that order.
- Shop data: shop name, description, location, contact details, verification documents and the payment details a seller chooses to publish.
- Usage data: pages viewed, searches, device and browser information, IP address and approximate location, used to keep the service secure and improve it.
- Communications: messages, reviews, dispute evidence and support emails.
- Promotion data: campaigns, bids, impressions and clicks for sellers who promote listings.
3. How we use data and our lawful basis
- To create and secure accounts, and to provide the marketplace (contract).
- To pass order details to the seller so they can fulfil your order (contract).
- To show shop payment details and order tracking (contract).
- To prevent fraud, abuse and illegal listings, and to moderate reviews (legitimate interests and legal obligation).
- To send transactional email such as order updates and password resets (contract).
- To understand how the marketplace is used and improve it (legitimate interests).
- To meet tax, accounting and regulatory obligations (legal obligation).
6. How long we keep data
We keep account and order records for as long as your account is active and for the period needed to meet legal, tax and dispute-resolution obligations. After that we delete or anonymise the data. Dispute and fraud records may be kept longer where necessary.
7. Security
We use access controls, encryption in transit, hashed passwords and least-privilege access for staff. No system is completely secure; if a breach affects your rights we will notify you and the Office of the Data Protection Commissioner as required by law.
8. Your rights
To exercise a right, email hello@pichatech.com from the address on your account. We may need to verify your identity first.
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Request deletion where we no longer need the data or the law allows it.
- Object to or restrict certain processing.
- Withdraw consent where processing is based on consent.
- Complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.
9. Children
Pichatech is not intended for children under 18. If we learn that we have collected data from a child without permission, we will delete it.
10. International transfers
Some service providers may process data outside Kenya. Where that happens we use appropriate safeguards as required by the Data Protection Act, 2019.
11. Changes to this policy
We may update this policy as the marketplace changes. We will post the new version here and update the date above. Material changes will be communicated to account holders.