Privacy policy

Draft for legal review. This text has not yet been approved and may change before Goodsoko launches.

Last updated [date of publication]

1. Who is responsible for your data

[Goodsoko Limited] of [physical address], Nairobi is the data controller for personal data processed through goodsoko.com, registered with the Office of the Data Protection Commissioner (registration number [●]). Our data protection contact is [[email protected]].

2. What we collect

  • Account details: name, phone number, email address, password (stored only as a secure hash), and sign-in method (phone code, email, Google or Facebook).
  • Seller details: business or display name, seller type, county, public phone number, and the ads, photos and descriptions you post. Photos are re-processed when uploaded, which removes hidden data such as the GPS location stored by phones.
  • Verification documents: copies of ID, passport, business registration, KRA PIN or licences you choose to submit.
  • Messages between buyers and sellers, reports you make, and support requests.
  • Identity verification (only if you choose to get verified): your ID type and number and a live selfie, which go to our verification partner Smile ID to be checked against the government record. We keep the result, the name on the record and the last 4 digits of your ID number, not your selfie or ID photo. Selfies are biometric data; we ask for your explicit consent before the check.
  • Payments: the M-PESA number used, amount, M-PESA receipt number and what was bought. We never see or store your M-PESA PIN.
  • Technical data: IP address, device and browser type, sign-in times and security events, used to keep accounts safe, and anonymous page-view and page-speed measurements.
  • Activity: ads you view, save or contact sellers about, used to count views and show you relevant content.

3. Why we use it, and our lawful basis

  • To run your account and the marketplace, publish your ads, deliver messages and process payments: performance of our contract with you.
  • To review ads, verify sellers, prevent fraud and scams, secure accounts and enforce our Terms: our legitimate interests and those of other users in a safe marketplace.
  • To keep payment and tax records and respond to lawful requests: legal obligation.
  • To send sign-in codes, receipts and important notices by SMS and email: contract. Marketing messages are sent only with your consent, which you can withdraw at any time.

4. Who we share it with

We don't sell your personal data. We share it only as needed with:

  • Other users: your seller name, county, public phone (when a buyer taps "Show phone number") and ads are public; messages go to the person you're chatting with.
  • Service providers acting on our instructions: Safaricom (M-PESA payments), [Eddy Pay] (SMS), [Resend] (email), Railway (hosting and database), Cloudflare (photo and document storage, and cookieless site analytics), Smile ID (identity verification, only for sellers who choose to get verified), and Sentry (error monitoring, technical data only).
  • Authorities when the law requires it, for example the police or Kenya Revenue Authority on a lawful request.

5. Transfers outside Kenya

Some providers store data outside Kenya (for example in the European Union or the United States). We transfer data only where the Data Protection Act, 2019 allows it, with contractual safeguards that require providers to protect it to an equivalent standard.

6. How long we keep it

  • Account and ad data: while your account is open, and up to 12 months after you close it (to handle disputes and fraud).
  • Payment records: 7 years, as required for tax.
  • Verification documents: until verification is decided and for up to 12 months after your account closes, unless needed for an investigation. Smile ID keeps its own record of the check under its retention policy and Kenyan law.
  • Messages: up to 24 months after the last message in a conversation.
  • Security logs: up to 12 months.

7. Your rights

Under the Data Protection Act, 2019 you can ask to access your data, correct it, delete it, object to or restrict its use, receive it in a portable format, and withdraw consent. Contact [[email protected]] or Contact support; we'll respond within the time the law requires. If you're unhappy with our response you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

8. Security

Data is encrypted in transit, passwords are hashed, verification documents are stored privately and visible only to authorised staff (every view is logged), staff must use two-factor sign-in, and access is limited by role and recorded in an audit log.

9. Cookies

We use only essential cookies, to keep you signed in and secure. We don't use advertising or tracking cookies.

To understand how the site is used and how fast it loads, we use Cloudflare Web Analytics, which counts page views without cookies and without building a profile of you.

10. Children

Goodsoko is for people aged 18 and over. We don't knowingly collect data from children; contact us if you believe a child has created an account.

11. Changes

We'll post any changes here and tell you about significant ones before they take effect.