Effective date: [03/11/2026]

This Privacy Policy explains how [Legal entity name] ("we", "us") collects, uses, shares and protects your personal data when you use the Nuza website at nuza.co.ke and the Nuza mobile app (together, "Nuza"). We process personal data in line with the Kenya Data Protection Act, 2019 and its regulations. We are the data controller for the personal data described here.

1. Data we collect

Category	Examples	Source
Account data	Name, email address, phone number, profile photo, login method	You, or Google if you sign in with Google
Advert data	Titles, descriptions, prices, photos, category details, the location you choose	You
Messages	Chats between you and other users on Nuza	You and other users
Payment records	Package bought, amount, date, payment reference	You and our payment providers
Device and usage data	IP address, device type, app version, pages viewed, notification tokens, cookies	Your device, automatically
Location	The county and town you select; approximate location if you allow it on your device	You and your device
Support and reports	Messages you send us, reports you make about adverts or users	You

We do not collect or store your full card details or M-Pesa PIN. Payments are handled by our payment providers.

2. How we use your data

• To create and manage your account and verify your email or phone number.
• To publish your adverts and show them to buyers, including your chosen location.
• To let buyers and sellers contact each other through chat and calls.
• To process payments for paid features and keep transaction records.
• To send service messages, such as verification emails, chat notifications and advert status updates.
• To prevent fraud, scams and misuse, and to review reported content.
• To improve Nuza, understand how it is used, and fix problems.
• To send marketing messages, only where you have agreed. You can opt out at any time.
• To comply with Kenyan law and respond to lawful requests from authorities.

3. Lawful basis

We process your data where it is necessary to provide Nuza to you under our Terms of Use, where you have given consent (for example marketing or device location), where we have a legitimate interest (for example fraud prevention and improving the service), or where the law requires it.

4. Who sees your data

• Other users: your adverts, public profile name, profile photo, and the location you choose are visible to anyone on Nuza. Your phone number is shown only where you choose to display it.
• Service providers that process data on our behalf, under contract: hosting provider ([Hosting provider and server country]); Google Firebase (account login, email verification, push notifications and app analytics); our email service; payment providers ([Payment providers used]).
• Authorities: the police, courts or regulators where the law requires it, or to investigate fraud or unlawful activity.
• Business transfers: a buyer or successor if Nuza is sold or merged, subject to this Policy.

We do not sell your personal data.

5. Transfers outside Kenya

Some of our service providers, including Google Firebase, store or process data on servers outside Kenya. We only transfer data where appropriate safeguards are in place as required by the Data Protection Act, 2019, such as contractual protections and the provider's security standards.

6. How long we keep data

• Account and advert data: while your account is active. When you delete your account, we delete or anonymise your personal data within [30] days, except as below.
• Expired or deleted adverts: kept for up to [12] months for fraud prevention and dispute handling, then deleted.
• Payment and transaction records: kept for as long as Kenyan tax and accounting laws require.
• Data needed for a legal claim, investigation or legal obligation: kept until that matter is resolved.

7. Your rights

Under the Data Protection Act, 2019, you have the right to:

• be informed of how your personal data is used;
• access the personal data we hold about you;
• object to all or part of the processing of your data, including for marketing;
• have false or misleading data corrected;
• have false or misleading data deleted, and request deletion of your account and data.

You can update most details yourself in your profile, and delete your account from your profile settings. For any other request, email admin@nuza.co.ke. We may ask you to confirm your identity, and we will respond within [14] days. If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

8. Security

We protect your data with encrypted connections (HTTPS), access controls on our systems, hashed passwords, and regular backups. No system is completely secure. If a personal data breach creates a real risk of harm, we will notify the Data Commissioner within 72 hours of becoming aware of it, and notify you where required.

9. Children

Nuza is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

10. Cookies

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how Nuza is used. You can accept or reject non-essential cookies through the cookie banner, and control cookies in your browser settings. Rejecting some cookies may affect how Nuza works.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on this page with a new effective date, and notify you of significant changes.

12. Contact

[SHAH TECHNOLOGIES SOLUTION], [NAIROBI], Kenya. Email: admin@nuza.co.ke. Phone: [+254746663821].