By creating an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy. Please read it together with our Terms & Conditions and Cookie Policy.
01 Who this Policy applies to
This Policy applies to everyone who interacts with the Platform, including:
- Buyers who browse or purchase items;
- Curators (sellers) who list and sell items through the Platform;
- Visitors who use the Platform without registering; and
- People who contact us, subscribe to our communications, or otherwise engage with us.
02 The personal data we collect
We collect personal data in three ways: information you give us, information we collect automatically, and information we receive from third parties.
2.1 Information you provide to us
- Account and identity data: your name, username/handle, email address, phone number, password, and date of birth (to confirm you are at least 18).
- Profile data: profile photo, bio, location/closet location, style preferences, and any other details you choose to add.
- Curator (seller) onboarding data: where you apply to sell, we may collect additional verification information such as your full legal name, a government-issued identification document, your KRA PIN, business details, and the payout details (such as your M-Pesa number or bank account) needed to pay you. We collect this to verify identity, prevent fraud, meet tax and anti–money-laundering obligations, and remit your earnings.
- Order and transaction data: items purchased or sold, order history, bids placed, delivery and billing addresses, recipient names and phone numbers, order notes, and communications relating to a transaction.
- Payment data: when you pay, your payment is processed by our third-party payment processor(s). We do not store full card or banking credentials on our own systems. We receive limited information such as the transaction reference, payment status, the payment method type, and the first/last digits of an instrument where applicable. Please review the payment processor's own privacy notice.
- Content you submit: product listings, photographs, item descriptions and condition notes, reviews and ratings, messages to other users or to us, and dispute or return requests.
- Communications and support data: the contents of emails, chat, WhatsApp, social messages, call records or notes, and survey or feedback responses.
- Marketing preferences: your choices about receiving newsletters and promotional messages.
2.2 Information we collect automatically
When you use the Platform we automatically collect certain technical and usage data, including:
- Device and connection data: IP address, device type and identifiers, operating system, browser type, language, and mobile network information.
- Usage data: pages and listings viewed, searches run, filters used, items saved or added to cart, time spent, referring/exit pages, and interaction timestamps.
- Approximate location: derived from your IP address or, with your permission, more precise location for delivery and store-locator features.
- Cookies and similar technologies: see Section 4.
2.3 Information we receive from third parties
- Payment processors: confirmation of payment, settlement, chargeback, or refund status.
- Delivery and logistics partners: delivery status, proof of delivery, and pickup-station information.
- Identity/anti-fraud and analytics providers: verification outcomes and aggregated insights.
- Social or login providers: if you choose to connect or sign in via a third-party account, basic profile details permitted by that provider.
We do not knowingly collect special-category data (such as health, religious, or biometric data) and ask that you do not submit it through reviews, listings, or messages.
03 How and why we use your personal data, and our legal basis
Under the DPA we must have a lawful basis for each use of your personal data. The table below summarises our main purposes and bases.
| Purpose | Examples | Lawful basis (DPA) |
|---|---|---|
| Provide the Platform and your account | Registering you, authenticating logins, maintaining your profile | Performance of a contract; legitimate interests |
| Process and fulfil orders | Taking payment, sharing delivery details with curators and couriers, sending order updates | Performance of a contract |
| Pay curators | Verifying sellers, calculating commissions, remitting payouts | Performance of a contract; legal obligation |
| Authenticate and quality-check items | Reviewing photos and condition information | Legitimate interests (trust and safety) |
| Customer support and dispute handling | Responding to queries, mediating returns/disputes | Performance of a contract; legitimate interests |
| Prevent fraud, abuse, and ensure security | Monitoring for suspicious activity, enforcing our Terms | Legitimate interests; legal obligation |
| Personalise your experience | Recommending items, remembering preferences | Legitimate interests; consent (where required) |
| Marketing and communications | Newsletters, promotions, drop alerts | Consent; legitimate interests (existing customers) |
| Analytics and improvement | Understanding usage to improve features | Legitimate interests; consent (for non-essential cookies) |
| Comply with law | Tax, accounting, regulatory, and law-enforcement requests | Legal obligation |
Where we rely on consent (for example, certain marketing or non-essential cookies), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
06 International transfers
We are based in Kenya and primarily process data here. Some of our service providers may store or process data outside Kenya. Where personal data is transferred out of Kenya, we do so in accordance with the DPA—on the basis of adequacy, appropriate safeguards (such as contractual data-protection clauses), your explicit consent, or another lawful ground—so that your data continues to receive an appropriate level of protection.
07 How long we keep your data
We keep personal data only for as long as necessary for the purposes set out in this Policy, including to:
- maintain your account while it is active;
- complete and record transactions and meet tax, accounting, and legal retention requirements (generally several years after a transaction, as required by Kenyan law);
- resolve disputes, enforce agreements, and prevent fraud.
When data is no longer needed, we delete it or irreversibly anonymise it. Some information may persist in backups for a limited period before being overwritten.
08 How we protect your data
We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, access controls and least-privilege practices, secure hosting, and monitoring. No system is completely secure; you are responsible for keeping your password confidential. If we become aware of a personal-data breach that poses a real risk to your rights, we will notify the Office of the Data Protection Commissioner (ODPC) and affected individuals as required by the DPA.
09 Your rights
Subject to the DPA, you have the right to:
- be informed about how your data is used;
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten") in certain circumstances;
- restrict or object to certain processing, including direct marketing;
- data portability, to receive certain data in a structured, commonly used format;
- withdraw consent where we rely on it; and
- not be subject to a decision based solely on automated processing that significantly affects you.
To exercise any right, contact us at hello@thriftedition.com. We will respond within the timeframes set by the DPA and may need to verify your identity first. Exercising your rights is free in most cases. If you are unsatisfied, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke. If you are in the EU/UK, you may also have rights under the GDPR and may complain to your local supervisory authority.
10 Marketing communications
With your consent (or where otherwise permitted for existing customers), we may send you newsletters, drop alerts, and promotions. You can opt out at any time using the "unsubscribe" link in our emails, your notification settings, or by contacting us. We will still send you essential service messages (such as order and security notifications).
11 Children
The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will delete it.
12 Third-party links and services
The Platform may link to third-party websites, payment pages, or social platforms that we do not control. This Policy does not apply to those services; please review their privacy notices.
13 Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, where changes are significant, notify you through the Platform or by email. Your continued use after an update constitutes acceptance of the revised Policy.
14 Contact us
For any questions, requests, or complaints about this Policy or your personal data, contact:
Data Protection Officer / Privacy Team
Email: hello@thriftedition.com
Phone: +254 723 352 636
Address: Pawansut Apartments, Nyali Road, Mombasa, Mombasa District. P.O. Box 41263–00100 G.P.O., Nairobi
Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke