Privacy Policy
This page needs 7 business facts that the owner has not yet supplied. They are shown in square brackets rather than guessed, because an invented company number, address or licence on a live trading site is a real liability.
- [REGISTERED COMPANY NAME]
- [REGISTERED ADDRESS]
- [KRA PIN]
- [ODPC REGISTRATION NUMBER]
- [DATA PROTECTION OFFICER CONTACT]
- [DATA RETENTION PERIODS]
- [DATA HOSTING LOCATION]
The full list, by page and by open decision, is the register at docs/corridor/PENDING-BUSINESS-FACTS.md.
This notice explains what personal data The-Hub collects, why, how long it is kept, and your rights. It is written for two regimes at once, because we serve buyers in both: the Kenya Data Protection Act 2019 for data subjects in Kenya, and the UK/EU General Data Protection Regulation for buyers in the European Union. Where a right or duty exists under only one of them, it is described as such.
Who controls your data
The data controller is [REGISTERED COMPANY NAME], [REGISTERED ADDRESS], KRA PIN [KRA PIN]. We are not yet registered as a data controller or processor with the Office of the Data Protection Commissioner (ODPC); that registration is not in place, and the ODPC registration number is pending and shown as [ODPC REGISTRATION NUMBER] until it is issued. This notice describes the duties we intend to meet, not a compliance status we already hold. An interim data protection contact can be reached at [DATA PROTECTION OFFICER CONTACT].
What we collect and why
- Account and identity data: name, business name, email, phone, password, and, for a business account, the KYC documents a Kenyan exporter or an approved buyer must hold (KRA PIN, identification, compliance certificates). Used to open and administer your account and to meet anti-fraud and export-compliance duties.
- Order data: what you bought, delivery details, proforma and payment references. Used to perform the contract and to issue tax invoices.
- Payment data: the method, reference and status of a payment. We do not store full card numbers; a card gateway, when one is connected, handles them.
- Communications: enquiries, quotes, claims and support messages.
- Technical and cookie data: the destination you are shopping in and your session, described on the Cookie Policy page.
Our lawful basis
- Contract: to create your account and fulfil your order.
- Legal obligation: tax, export-compliance and record-keeping law in Kenya, and equivalent duties where they apply.
- Legitimate interests: securing the marketplace, preventing fraud, and improving the service, balanced against your rights.
- Consent: marketing messages, which you may withdraw at any time.
How long we keep it
We keep personal data no longer than we need it: [DATA RETENTION PERIODS]. Record retention is still being finalised (open decision D12 in the register, with D22). Records that support a tax invoice are intended to be kept for seven years; lot, proof-of-delivery and temperature records for the traceability period; and account data for as long as the account is open plus a short wind-down period.
Who we share it with
We share data only as needed to run the marketplace: the exporter or vendor fulfilling your order, carriers and the Sharjah 3PL where relevant, payment providers, and the marketplace Core service. Data is hosted at [DATA HOSTING LOCATION]. Where data is transferred outside Kenya or outside the EEA, we use appropriate safeguards (contractual clauses or an adequacy decision) and apply the transfer rules of both regimes.
Your rights
Under the Kenya Data Protection Act 2019, and for EU data subjects under the GDPR, you may: access your data; correct it; have it deleted; restrict or object to processing; receive it in a portable form; withdraw consent; and lodge a complaint with a supervisory authority — in Kenya the Office of the Data Protection Commissioner, in the EU your national authority. To exercise any of these, contact [DATA PROTECTION OFFICER CONTACT].
Security, children and changes
We use appropriate technical and organisational measures to protect personal data. The marketplace is for businesses and is not intended for children. We will update this notice as the service changes; the current version date is shown at the top of this page.