Last updated: 16 March 2026 · Version 1
Karare - Tech Solutions ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our website at k-techsolutions.co.ke (the "Platform"), interact with our WhatsApp AI Chatbot, or engage with our services.
This policy is drafted in compliance with the Data Protection Act No. 24 of 2019 of the Republic of Kenya and the regulations issued by the Office of the Data Protection Commissioner (ODPC).
The data controller responsible for your personal data is:
For data protection enquiries, please contact us at the email address above with the subject line "Data Protection Enquiry".
We collect different categories of personal data depending on how you interact with our Platform:
| Data | Purpose | Required? |
|---|---|---|
| First name, last name | Account identification, order fulfilment | Yes |
| Email address | Account verification (OTP), order confirmations, communications | Yes |
| Phone number | Account identification, SMS notifications, delivery coordination | Yes |
| Date of birth | Age verification (18+ eligibility) | Yes |
| Password | Account security (stored as bcrypt hash, never in plain text) | Yes |
| Newsletter preference | Marketing consent record | Optional |
| Data | Purpose |
|---|---|
| Delivery address (street, city, county, postal code) | Order delivery |
| Order history (products, quantities, prices, dates) | Order tracking, customer service, warranty claims |
| Payment references (M-Pesa transaction IDs, PesaPal references) | Payment verification and reconciliation |
Note: We do not store full credit/debit card numbers, M-Pesa PINs, or payment credentials. Payment processing is handled by our third-party payment providers (Safaricom M-Pesa and PesaPal).
| Data | Purpose |
|---|---|
| Product views and search queries | Service improvement, product recommendations |
| Wishlist items | Saved for your convenience |
| Shopping cart contents | Order completion, abandoned cart recovery |
| Data | Purpose |
|---|---|
| WhatsApp phone number | Identifying you in the conversation |
| Message content (your questions and queries) | Providing automated customer support |
| Conversation history and timestamps | Service quality, training, and improvement |
| Data | Purpose |
|---|---|
| Marketing consent status (opt-in/opt-out) | Compliance with consent requirements |
| Communication history (emails, SMS sent to you) | Record-keeping, unsubscribe management |
| Data | Purpose |
|---|---|
| Review text, star rating | Community product feedback |
| Display name (first name) | Attribution of review |
| Data | Purpose |
|---|---|
| IP address | Security (rate limiting, fraud prevention) |
| Browser type and version | Ensuring Platform compatibility |
| Operating system | Ensuring Platform compatibility |
| Session cookies | Authentication, shopping cart persistence |
We process your personal data for the following specific purposes:
Under the Kenya Data Protection Act 2019, we process your data on the following legal bases:
| Legal Basis | Applicable Processing |
|---|---|
| Consent (Section 32) | Marketing communications (email, SMS, WhatsApp); newsletter subscription; AI Chatbot usage; product reviews |
| Performance of Contract (Section 30(1)(b)) | Order processing and delivery; payment processing; account creation and management; warranty claims |
| Legitimate Interest (Section 30(1)(f)) | Fraud prevention and security; abandoned cart reminders; analytics and service improvement; customer support |
| Legal Obligation (Section 30(1)(c)) | Tax records; regulatory compliance; responding to lawful requests from authorities |
We will only send you marketing communications if you have given us your explicit opt-in consent during account registration or through your account settings.
You may withdraw your marketing consent at any time through any of the following methods:
We will process your unsubscribe request promptly. Note that opting out of marketing does not affect transactional communications (order confirmations, delivery updates, security alerts).
Our WhatsApp AI Chatbot uses artificial intelligence to process your messages and generate automated responses. You should be aware of the following:
We may share your personal data with the following categories of third parties, strictly for the purposes described:
| Third Party | Data Shared | Purpose |
|---|---|---|
| Safaricom (M-Pesa) | Phone number, transaction amount | Processing M-Pesa payments via Daraja API |
| PesaPal | Name, email, phone, transaction amount | Processing card and mobile money payments |
| Onfon Media | Phone number, message content | Delivering SMS notifications and marketing messages |
| WhatsApp / Meta | Phone number, message content | WhatsApp AI Chatbot and marketing messages |
| Delivery Partners | Name, phone, delivery address | Delivering your orders |
| Hosting Provider | All Platform data | Website hosting and infrastructure |
| AI Service Providers | Chatbot conversation content | Processing AI chatbot responses |
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. All third parties are required to process your data in accordance with our instructions and applicable data protection laws.
Some of our third-party service providers may process your data outside of Kenya. Where this occurs, we ensure that appropriate safeguards are in place as required by Section 48 of the Data Protection Act, including:
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
| Data Category | Retention Period |
|---|---|
| Account information | Duration of your account + 2 years after deletion request |
| Order history and transaction records | 7 years (Kenya tax law requirement) |
| Payment references | 7 years (financial record-keeping) |
| Marketing consent records | Duration of consent + 2 years after withdrawal |
| WhatsApp AI Chatbot logs | 12 months from conversation date |
| Email/SMS communication logs | 3 years |
| Product reviews | Indefinitely (unless you request deletion) |
| Technical/device data (IP, sessions) | 90 days |
| Abandoned cart data | 6 months |
After the retention period expires, data is securely deleted or anonymised so that it can no longer identify you.
Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:
To exercise any of these rights, contact us at:
We will respond to your request within 30 days of receipt. We may request verification of your identity before processing your request. If your request is complex or involves a large volume of data, we may extend the response period by an additional 30 days, with notification.
We use the following technologies to enhance your experience on the Platform:
| Technology | Type | Purpose | Duration |
|---|---|---|---|
Session cookie (ktech_sess) | Essential | Maintaining your login session and CSRF protection | 2 hours |
| localStorage (cart data) | Essential | Persisting your shopping cart contents | Until cleared |
| localStorage (theme preference) | Functional | Remembering your light/dark theme preference | Until cleared |
We do not use third-party tracking cookies, advertising pixels, or analytics platforms that track you across other websites. Essential cookies cannot be disabled as they are necessary for the Platform to function.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
While we take all reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
In the event of a personal data breach, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach, as required by Section 43 of the Data Protection Act. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.
Our Platform is not intended for persons under the age of 18. We do not knowingly collect personal data from children. Our registration process requires users to be at least 18 years old, and we verify this through the date of birth provided during registration.
If we become aware that we have collected personal data from a person under 18, we will take steps to delete such data promptly. If you believe that a child has provided us with personal data, please contact us immediately.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:
We encourage you to review this Privacy Policy periodically.
If you are not satisfied with how we handle your personal data or respond to your data protection request, you have the right to lodge a complaint with:
We encourage you to contact us first so we can attempt to resolve your concern before escalating to the ODPC.
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: