Privacy Policy

1. Scope and who is responsible

This Privacy Policy applies to marketplace.kerea.org, related marketplace pages, vendor accounts, customer enquiries, quote requests, orders, support interactions and marketplace analytics.

The Kenya Renewable Energy Association (KEREA) operates the marketplace and acts as the data controller for personal data it determines how and why to process. Marketplace vendors may act as separate data controllers for personal data they receive to answer enquiries, provide quotations, fulfil orders, arrange delivery or provide after-sales support. Vendors are responsible for their own lawful handling of that data.

2. Data protection compliance

We process personal data in accordance with applicable Kenyan data protection requirements, including Article 31 of the Constitution of Kenya, the Data Protection Act, 2019 (Cap. 411C), and the Data Protection (General) Regulations, 2021.

Our data protection practices are guided by the principles of lawful, fair and transparent processing; purpose limitation; data minimisation; accuracy; storage limitation; security; and accountability. Where consent is the applicable lawful basis, you may withdraw it at any time, without affecting processing that was lawful before withdrawal.

You can read the Data Protection Act on Kenya Law.

3. Personal data we collect

3.1 Information you provide

• Identity and contact details, such as your name, email address, telephone number, delivery address and organisation.
• Vendor account and business information, including company details, profile information, contact persons and marketplace credentials.
• Order, quotation and enquiry information, including selected products, quantities, messages, delivery details and transaction references.
• Product listings, photographs, descriptions, pricing, certificates or supporting information submitted by vendors.
• Communications sent to KEREA or a vendor through the marketplace, including support requests, feedback and complaints.

3.2 Information collected automatically

When you use the marketplace, we may automatically collect technical and usage information needed to operate, secure and improve the service. This may include:

• IP address, browser name and version, operating system, device type and preferred language.
• The date and time of a visit, pages and products viewed, product category, session activity and repeat visit counts.
• Approximate location information derived from an IP address, such as country, region or city. We do not use this feature to collect precise GPS location.
• Referral information showing whether a visit came from a search engine, social network, another website or a direct visit, together with campaign parameters where available.
• A privacy-conscious technical identifier used to recognise a unique visitor to a particular product page for a particular day and reduce duplicate analytics records.

3.3 Cookies and similar technologies

We may use essential cookies, session storage or similar technologies to maintain sessions, remember cart contents, protect forms and support core marketplace functions. Where non-essential analytics or marketing technologies require consent, we will request it before using them.

3.4 Payment information

Payments may be handled by banks, mobile-money operators or payment service providers. KEREA may receive payment status, amount and transaction reference information. Unless expressly stated at the payment point, the marketplace does not store complete card numbers, card security codes or mobile-money PINs.

4. Why and how we use personal data

Depending on the circumstances, we rely on performance of a contract, steps requested before entering a contract, compliance with legal obligations, legitimate interests, consent or another lawful basis permitted by law. We use personal data to:

• Create and manage vendor accounts and marketplace sessions.
• Display product listings and connect customers with relevant vendors.
• Process carts, orders, quotation requests, deliveries, withdrawals and related marketplace records.
• Respond to enquiries, provide support and resolve disputes or complaints.
• Verify marketplace activity, prevent fraud, protect accounts and maintain the security of the platform.
• Measure product and category interest, understand referral sources and improve marketplace content and performance.
• Comply with tax, accounting, regulatory, court, law-enforcement and other applicable legal requirements.
• Send service messages and, where permitted, marketplace news or marketing communications. You may opt out of direct marketing at any time.

5. When we share personal data

We do not sell personal data. We may share only the data reasonably necessary with:

• Marketplace vendors so they can answer an enquiry, prepare a quotation, fulfil an order or provide delivery and support.
• Payment, communication, hosting, analytics, security and technology providers acting under appropriate instructions or contractual safeguards.
• Delivery, installation or professional service providers involved in completing a requested transaction.
• Regulators, courts, law-enforcement bodies or public authorities where disclosure is required or permitted by law.
• Professional advisers and auditors where necessary to protect rights, manage risk or demonstrate compliance.
• A successor organisation in connection with a lawful restructuring, merger or transfer, subject to appropriate safeguards.

International transfers

Some service providers may process data outside Kenya. Where personal data is transferred internationally, KEREA will take reasonable steps to ensure that the transfer has a lawful basis and appropriate safeguards as required by Kenyan data protection law.

6. Data retention and security

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to maintain marketplace and transaction records, meet legal or regulatory obligations, resolve disputes and protect legitimate interests. Retention periods vary according to the type of data, the relationship with you and applicable legal requirements. When data is no longer required, we will delete, anonymise or securely archive it as appropriate.

We use reasonable administrative, organisational and technical safeguards designed to protect personal data against accidental or unlawful loss, destruction, alteration, unauthorised access or disclosure. These measures may include access controls, authentication, encrypted connections, backups, monitoring and limiting staff or service-provider access.

No online service can guarantee absolute security. You should protect account credentials, use a strong password and contact us promptly if you believe your account or personal data has been compromised.

7. Your data protection rights

Subject to the Data Protection Act and applicable limitations, you may have the right to:

• Be informed about how your personal data is used.
• Request access to personal data held about you.
• Request correction of inaccurate or incomplete personal data.
• Object to processing, including processing for direct marketing.
• Request restriction of processing in qualifying circumstances.
• Request deletion of personal data where the legal requirements are met.
• Receive certain personal data in a structured, commonly used and machine-readable format.
• Withdraw consent where processing is based on consent.
• Not be subject to certain decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise a right, email membership@kerea.org. Please describe your request clearly. We may request information necessary to confirm your identity and protect your data from unauthorised disclosure.

Right to complain

If you believe your personal data has been processed contrary to law, please contact us first so we can address the concern. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

8. Children

The marketplace is intended for adults and organisations purchasing or supplying clean cooking products. It is not designed to collect personal data from children. Where child-related data must lawfully be processed, we will apply the consent, age-verification and best-interest safeguards required by Kenyan law.

9. Third-party websites

The marketplace may contain links to vendor websites, social networks, payment services or other third-party services. Their privacy practices are controlled by their own policies. We encourage you to review those policies before providing personal data.

10. Changes to this policy

We may update this Privacy Policy to reflect changes in the marketplace, our data practices or applicable law. The updated version will be published on this page with a revised “Last updated” date. Where a change materially affects how we use personal data, we will provide additional notice where required.

11. Contact us

Questions, privacy requests and complaints may be directed to: