Privacy Policy

1. Introduction & Commitment

Afams Ltd is committed to handling your personal data responsibly and lawfully in accordance with applicable Kenyan data protection legislation, including the Data Protection Act, 2019 (Kenya). This Privacy Policy explains how we process your data and the protections in place to safeguard Afams Ltd's legal and operational interests while respecting your privacy rights.

2. Data Controller

Data Controller: Afams Ltd

Registration: PVT-5JUEG2R2

Privacy Contact: privacy@afams.co.ke

Compliance: compliance@afams.co.ke

3. Data We Collect and Why

3.1 Data You Provide

• Identity data: full name, username or equivalent identifier
• Contact data: email address, phone number, physical address
• Financial data: payment method details (processed by Paystack, M-Pesa, Airtel — we do not store full card or PIN data)
• Transaction data: order history, purchase amounts, product details
• Account credentials (hashed and encrypted — we cannot recover your password)
• Communications and correspondence sent to us

3.2 Automatically Collected Data

• Device identifiers, browser type and version, operating system
• IP addresses and approximate geolocation data
• Usage data: pages visited, click paths, time-on-site, referral URLs
• Cookie and tracking data as described in our Cookie Policy

3.3 Third-Party Sourced Data

• Transaction confirmations and payment status data from Paystack, M-Pesa, and Airtel Money
• Delivery status data from logistics partners
• Aggregated analytics data from web analytics providers

4. Legal Bases for Processing

• Contract Performance: Processing necessary to fulfil Orders, manage accounts, and deliver services.
• Legal Obligation: Processing required under the Data Protection Act 2019, Tax Procedures Act, Companies Act, and other applicable Kenyan law.
• Legitimate Interests: Processing necessary for fraud prevention, platform security, business analytics, and operational continuity of Afams Ltd.
• Consent: Marketing communications and non-essential cookies where you have opted in. Consent is freely withdrawable at any time.

5. Sharing of Personal Data

Afams Ltd does not sell your personal data. We may share data with:

• Payment processors (Paystack, Safaricom, Airtel) — solely to process payments
• Logistics and delivery partners — solely to fulfil Orders
• Cloud infrastructure and backend providers (Supabase, hosting) — under data processing agreements
• Legal and professional advisors — subject to strict confidentiality
• Regulators, courts, and law enforcement — where required by applicable law, court order, or to protect our legal rights

Each third party with whom we share data is contractually required to handle your data securely and only for the specific purpose for which it was shared. Afams Ltd is not liable for data breaches caused by third-party processors acting outside their authorised scope.

6. Data Retention

We retain personal data only as long as necessary:

• Account and transaction records: 7 years (tax and legal compliance)
• Marketing data: until unsubscription or withdrawal of consent
• Security and fraud logs: up to 3 years
• Support communications: 2 years

Upon expiry of the applicable retention period, data is securely deleted or anonymised, unless retention is required by law or for the establishment, exercise, or defence of legal claims by Afams Ltd.

7. Data Security & Limitation of Liability for Breaches

Afams Ltd implements industry-standard technical and organisational security measures including:

• HTTPS/TLS encryption for all data in transit
• Encrypted storage of sensitive data at rest
• Role-based access controls
• Third-party payment processing (we do not store card or PIN data)
• Regular security assessments

IMPORTANT: No data transmission over the internet or electronic storage system is 100% secure. Afams Ltd does not warrant absolute security of data and shall not be liable for any unauthorised access, loss, theft, or disclosure of personal data resulting from circumstances beyond its reasonable control, including third-party cyberattacks, zero-day vulnerabilities, or Force Majeure Events.

In the event of a data breach affecting your personal data, Afams Ltd will notify you as required by the Data Protection Act, 2019 (Kenya) and take reasonable remedial steps. Our liability for any data breach shall be limited to the maximum extent permitted by applicable law.

8. Your Data Rights

Subject to the Data Protection Act, 2019 (Kenya), you have the following rights:

• Access: request a copy of personal data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion in certain circumstances (subject to legal retention obligations)
• Restriction: request limitation of processing in certain circumstances
• Portability: request your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw Consent: for consent-based processing, withdraw at any time

To exercise your rights, submit a written request to privacy@afams.co.ke. We will respond within 30 days. We reserve the right to verify your identity before actioning any request, and to decline requests that are manifestly unfounded, excessive, or repetitive.

9. No Liability for Third-Party Services

The Platform may integrate with or link to third-party services (payment processors, social platforms, analytics tools). Afams Ltd is not responsible for the privacy practices, data handling, or security of any third-party service. Your use of third-party services is at your own risk and governed by their respective privacy policies.

10. Children

The Platform is not directed at individuals under 18 years of age. We do not knowingly collect data from minors. If we become aware that we have collected data from a minor, we will delete it promptly. Parents or guardians who believe a minor's data has been collected should contact us at privacy@afams.co.ke.

11. International Transfers

Where data is transferred to processors or storage located outside Kenya, Afams Ltd ensures such transfers comply with applicable data protection law and that adequate safeguards are in place. Afams Ltd shall not be liable for acts or omissions of overseas processors acting beyond their contractual scope.

12. Limitation of Liability for Data Processing

To the fullest extent permitted by law, Afams Ltd's liability for any claim arising from data processing activities shall not exceed the amount set out in our Terms and Conditions. Afams Ltd shall have no liability for losses arising from:

• Your provision of inaccurate or incomplete data
• Third-party data breaches outside our control
• Your failure to maintain account security
• Data processing required by law or court order

13. Governing Law & Dispute Resolution

These terms are governed by and construed in accordance with the laws of the Republic of Kenya. Before initiating formal proceedings, the complaining party must send written notice to legal@afams.co.ke giving Afams Ltd 30 days to respond. Unresolved disputes are submitted to binding arbitration under the Nairobi Centre for International Arbitration (NCIA) Rules. All claims must be brought on an individual basis — class actions are waived.

14. Amendments

Afams Ltd reserves the right to amend this Policy at any time. Updated versions will be posted on the Platform with a revised effective date. Your continued use of the Platform after any amendment constitutes acceptance of the amended Policy.

Contact