Privacy Policy

Last Updated: December 20, 2025

1. Introduction

Zadi ("we", "us", "our", "the Platform") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in compliance with the Data Protection Act, 2019 of Kenya (the "DPA").

By using Zadi, you consent to the collection and use of your personal data as described in this Privacy Policy. If you do not agree with any part of this Privacy Policy, please do not use our services.

2. Data Controller

Data Controller: Zadi

3. Information We Collect

3.1. Personal Data from Vendors

When you register as a vendor, we collect:

• Identity Information: Business name, business registration details, industry category
• Contact Information: Email address, phone number, physical address, location (branch/area)
• Account Information: Username, password (hashed), account preferences
• Business Information: Logo, cover photo, business description, operating hours
• Verification Information: Email verification status, verification tokens
• Activity Data: Coupons created, claims received, redemptions processed

3.2. Personal Data from Customers

When you claim or redeem coupons, we collect:

• Contact Information: Email address (required for coupon delivery)
• Claim Information: Coupon codes claimed, claim dates, redemption status
• Device Information: IP address, browser type, device information (collected automatically)
• Location Data: General location data for coupon relevance (if provided or inferred)

3.3. Automatically Collected Data

We automatically collect certain information when you use our Platform:

• IP address and device identifiers
• Browser type and version
• Operating system
• Pages visited and time spent on pages
• Referring website addresses
• Cookies and similar tracking technologies (see Section 10)

4. Legal Basis for Processing

Under the Data Protection Act, 2019, we process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for us to process your data for specific purposes (e.g., email notifications)
• Contract Performance: Processing is necessary for the performance of a contract to which you are a party (e.g., providing coupon services)
• Legal Obligation: Processing is necessary for compliance with legal obligations (e.g., tax records, business registration requirements)
• Legitimate Interests: Processing is necessary for our legitimate business interests (e.g., platform security, fraud prevention, service improvement)

5. How We Use Your Information

5.1. Service Provision

We use your personal data to:

• Create and manage your account
• Provide access to our coupon platform
• Process coupon claims and redemptions
• Send coupon-related communications (e.g., coupon codes, redemption confirmations)
• Verify your identity and prevent fraud
• Provide customer support

5.2. Business Operations

We use your personal data to:

• Improve our services and platform functionality
• Conduct analytics and research
• Monitor platform usage and performance
• Ensure platform security and prevent abuse
• Comply with legal and regulatory requirements

5.3. Marketing and Communications

With your consent, we may use your personal data to:

• Send promotional emails about new deals and offers
• Send newsletters and platform updates
• Conduct marketing research and surveys

You can opt-out of marketing communications at any time by clicking the unsubscribe link in emails or contacting us directly.

6. Data Sharing and Disclosure

6.1. Third-Party Service Providers

We may share your personal data with trusted third-party service providers who assist us in operating our Platform, including:

• Email Service Providers: For sending emails (e.g., Resend, SendGrid)
• Cloud Storage Providers: For storing data and media (e.g., Cloudinary, MongoDB Atlas)
• Analytics Providers: For understanding platform usage (e.g., Google Analytics)
• Payment Processors: For processing payments (if applicable)

All third-party service providers are contractually obligated to protect your data and use it only for specified purposes.

6.2. Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such transfer and your rights regarding your data.

6.3. Legal Requirements

We may disclose your personal data if required by law or in response to:

• Court orders, subpoenas, or legal processes
• Government requests or regulatory investigations
• Protection of our rights, property, or safety
• Protection of the rights, property, or safety of others

6.4. Public Information

When vendors create coupons, certain business information (business name, location, industry) may be publicly visible on the Platform. This is necessary for customers to discover and redeem coupons.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained while your account is active and for 2 years after account deletion for legal and security purposes
• Transaction Data: Retained for 7 years as required by Kenyan tax and business laws
• Marketing Data: Retained until you opt-out or unsubscribe
• Analytics Data: Retained in anonymized form for up to 3 years

Upon expiration of the retention period, we will securely delete or anonymize your personal data in accordance with our data deletion procedures.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (SSL/TLS) and at rest
• Secure password hashing (bcrypt)
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Secure data centers and infrastructure
• Employee training on data protection

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Your Rights Under the Data Protection Act, 2019

As a data subject under the DPA, you have the following rights regarding your personal data:

9.1. Right to Access

You have the right to request access to your personal data and receive a copy of the data we hold about you. You can exercise this right by contacting us at privacy@zadi.co.ke.

9.2. Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. You can update your information directly through your account settings or by contacting us.

9.3. Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• The data has been unlawfully processed

Note: We may retain certain data if required by law or for legitimate business purposes.

9.4. Right to Restrict Processing

You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

9.5. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

9.6. Right to Object

You have the right to object to processing of your personal data for direct marketing purposes or when processing is based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.

9.7. Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

9.8. Right to Complain

You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data protection rights have been violated:

10. Cookies and Tracking Technologies

10.1. What Are Cookies?

Cookies are small text files stored on your device when you visit our Platform. We use cookies and similar tracking technologies to enhance your experience, analyze platform usage, and provide personalized content.

10.2. Types of Cookies We Use

• Essential Cookies: Required for the Platform to function (e.g., authentication, security)
• Performance Cookies: Help us understand how visitors use our Platform (e.g., Google Analytics)
• Functionality Cookies: Remember your preferences and settings
• Targeting Cookies: Used for advertising and marketing (with your consent)

10.3. Managing Cookies

You can control and manage cookies through your browser settings. However, disabling certain cookies may affect Platform functionality. For more information, visit our Cookie Policy.

11. International Data Transfers

Your personal data may be transferred to and stored in countries outside Kenya, including:

• Countries where our cloud service providers operate data centers
• Countries where our third-party service providers are located

We ensure that any international data transfers comply with the Data Protection Act, 2019, and that appropriate safeguards are in place, including:

• Data processing agreements with international service providers
• Standard contractual clauses where applicable
• Verification of adequate data protection standards in recipient countries

12. Children's Privacy

Zadi is not intended for children under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information.

If you believe we have collected information from a child, please contact us immediately at privacy@zadi.co.ke.

13. Data Breach Notification

In the event of a personal data breach that poses a high risk to your rights and freedoms, we will:

• Notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach
• Notify affected data subjects without undue delay
• Provide information about the nature of the breach, likely consequences, and measures taken to address it

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated via:

• Email notification to registered users
• Prominent notice on the Platform
• Updated "Last Updated" date

Your continued use of the Platform after changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

15. Data Protection Officer

If you have questions, concerns, or wish to exercise your data protection rights, please contact our Data Protection Officer:

16. Contact Us

For general privacy inquiries or to exercise your rights, please contact us:

17. Governing Law

This Privacy Policy is governed by the laws of the Republic of Kenya, including the Data Protection Act, 2019, and any other applicable data protection laws and regulations.

18. Acknowledgment

By using Zadi, you acknowledge that you have read, understood, and agree to this Privacy Policy. You also acknowledge that you have read and understood our Terms of Service, which govern your use of the Platform.

---

This Privacy Policy is effective as of the "Last Updated" date shown above and complies with the Data Protection Act, 2019 of Kenya. Zadi is committed to protecting your privacy and respecting your data protection rights.