Privacy Policy.
How we collect, use, disclose, and safeguard your personal data — drafted in strict accordance with the Data Protection Act, 2019 of Kenya.
How we collect, use, disclose, and safeguard your personal data — drafted in strict accordance with the Data Protection Act, 2019 of Kenya.
Welcome to Agrizen Foods. We are a curated food reseller operating in Kenya, dedicated to providing high-quality, rigorously vetted food products sourced from independent Kenyan suppliers. Our mission is to connect consumers with the best of Kenyan agriculture while ensuring transparency, quality, and safety. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our e-commerce platform, including our website, mobile applications, and related services (collectively referred to as the "Platform").
This policy is drafted in strict accordance with the Data Protection Act, 2019 of Kenya, the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021, and other applicable legal frameworks, including the Computer Misuse and Cybercrimes Act and the Consumer Protection Act. It applies to all users of our Platform, including customers, suppliers, and visitors.
By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to our data processing practices. If you do not agree with these terms, please do not use our services. We are committed to protecting your privacy and ensuring that your personal data is handled lawfully, fairly, and transparently. We believe that trust is the foundation of our marketplace, and we take our responsibilities as a Data Controller very seriously.
Agrizen Foods is an online marketplace that connects consumers with independently owned, rigorously vetted Kenyan farms and suppliers. We do not own farms, cattle, or supplier brands. Instead, we apply our quality standards as a gatekeeper and sell products under the Agrizen umbrella, ensuring full transparency by linking every product to a hosted supplier profile. This unique model requires us to process data not only from our customers but also from our network of trusted suppliers to ensure the quality and safety of the food we deliver.
We act as a Data Controller under the Data Protection Act, 2019, meaning we determine the purposes and means of processing your personal data. In some instances, we may also act as a Data Processor when we handle data on behalf of our suppliers or other partners.
Company Details:
| Field | Detail |
|---|---|
| Company Name | Agrizen Foods |
| Trading Name | Agrizen Foods |
| Country of Registration | Kenya |
| Physical Address | Rhino Park Road ACDI |
| Telephone | +254107100373 |
| Customer Care Email | agrizenfoods@gmail.com |
| Privacy Email | agrizenfoods@gmail.com |
| Data Protection Officer (DPO) | Moses Mwangi Kega |
To provide our services effectively, we collect various categories of personal data. The specific data collected depends on how you interact with the Platform. We adhere to the principle of data minimization, meaning we only collect the data that is strictly necessary for the purposes outlined in this policy.
We collect information that identifies you as an individual or business entity. For customers, this includes your full name, date of birth (if required for age-restricted products), and username. For suppliers, we collect the business name, contact person name, KRA PIN, and business registration number to ensure transparency and regulatory compliance. This data allows us to create your account, verify your identity, and maintain accurate records of transactions and supplier relationships.
We collect contact details to communicate with you and deliver orders. This includes your phone number, email address, physical delivery address, and postal address. We also collect GPS coordinates and saved delivery locations if you voluntarily provide them to facilitate accurate deliveries. This information is crucial for ensuring that your orders reach you promptly and that we can communicate effectively regarding your orders, account status, or any issues that may arise.
We collect information necessary to process payments securely. Please note that we do not store full credit or debit card numbers on our servers. We collect payment reference numbers, transaction IDs, mobile money references (e.g., M-PESA transaction codes), and card token references provided by payment gateways. For suppliers, we also collect banking information necessary for payout processing. This data is essential for completing transactions, processing refunds, and managing the financial aspects of our marketplace.
We collect data related to your account settings and preferences. This includes login information, passwords (stored securely as cryptographic hashes), user preferences, saved delivery addresses, and favorite products. For suppliers, we collect product catalogue data, certifications with expiry dates, and our internal audit history for the supplier. This data helps us personalize your experience, streamline the checkout process, and ensure that suppliers maintain the high standards required by Agrizen Foods.
We automatically collect data about your device and connection to ensure the Platform functions correctly and securely. This includes your IP address, browser type and version, device information, cookie information, and session information. This data helps us diagnose technical issues, optimize our website for different devices, and monitor for any suspicious activity that could compromise the security of our Platform.
We collect data on how you interact with the Platform to improve our services and provide personalized recommendations. This includes search queries, pages visited, shopping behavior (such as cart additions and purchases), and the time spent on the Platform. By analyzing this data, we can understand customer preferences, improve our product offerings, and create a more intuitive and user-friendly shopping experience.
We collect data when you interact with our support team or other users. This includes customer support messages (email, chat, or phone logs), product reviews and ratings, feedback, and complaints. This data is vital for resolving issues, improving our customer service, and maintaining the quality of our marketplace.
Because we source from independent suppliers, we collect and publish specific data about our partners to ensure transparency for our customers. This includes farm location and details, profiles of the people behind the farm, certifications (e.g., KEBS, Organic) with expiry dates, and our internal audit history for the supplier. This commitment to transparency is a cornerstone of the Agrizen Foods brand, allowing our customers to make informed decisions about the food they purchase.
Specifically, the following supplier data may be collected and displayed on our Platform:
All supplier data is collected with the supplier's prior knowledge and consent, typically as part of the onboarding process when they join the Agrizen Foods network. Suppliers retain ownership of their data and can request updates or corrections at any time.
Under the Kenya Data Protection Act, 2019, we must have a lawful basis to process your personal data. We rely on the following bases:
| Legal Basis | Description & Practical Example |
|---|---|
| Consent | You have explicitly agreed to the processing. For example, opting in to receive our marketing newsletter, accepting our cookie banner, or providing specific data for a one-time service. Consent must be freely given, specific, informed, and unambiguous. |
| Performance of a Contract | Processing is necessary to fulfill an agreement with you. For example, processing your order, arranging delivery, and processing payments when you buy meat from Agristead Meats via our platform. This is the primary basis for our core e-commerce operations. |
| Compliance with Legal Obligations | Processing is required by Kenyan law. For example, retaining invoices for tax purposes (KRA requirements), verifying KRA PINs for suppliers, or responding to lawful requests from law enforcement agencies. |
| Legitimate Interests | Processing is necessary for our legitimate business interests, provided they do not override your rights. For example, using usage data to improve our platform's functionality, detecting fraud, preventing abuse, or conducting internal audits of our suppliers to maintain our quality standards. |
| Protection of Vital Interests | Processing is necessary to protect someone's life. For example, sharing emergency contact details during a delivery emergency or in the event of a severe allergic reaction related to a product. |
| Public Interest | Processing is necessary for tasks carried out in the public interest. For example, cooperating with national security organs or law enforcement when legally mandated. |
We process your personal data for specific, legitimate purposes:
We understand the importance of flexible delivery options. You may add multiple delivery addresses to your account, edit or delete existing addresses, and choose any saved address during checkout. You can also enter a one-time delivery location for a specific order or voluntarily share your GPS location or use our map-based location selection tool.
We collect location information solely to facilitate accurate deliveries and improve our logistics network. Location sharing is entirely optional, unless the nature of the requested service (e.g., real-time delivery tracking) requires it to function. We ensure that all location data is handled securely and used only for the intended delivery purposes.
We use cookies and similar tracking technologies to ensure our Platform functions correctly and to enhance your experience. Cookies are small text files that are stored on your device when you visit a website.
Strictly necessary for the website to function (e.g., maintaining your shopping cart, logging you in). These cannot be disabled as the Platform relies on them for basic functionality.
Help us understand how users interact with the site (e.g., which pages are most popular). We use this data to improve the Platform, identify errors, and optimize our services.
Remember your choices (e.g., language, region) to provide a personalized and consistent experience across your visits.
Used to track visitors across websites to display relevant advertisements and measure the effectiveness of our marketing campaigns. We only use these if you have consented to their use.
Temporary cookies that are deleted when you close your browser. They are essential for maintaining your session while you navigate the Platform.
Remain on your device for a set period or until you delete them. They help us recognize returning users and remember your preferences over time.
Cookie Consent: When you first visit our Platform, we will ask for your consent to use non-essential cookies. You can manage or disable your cookie preferences at any time through your browser settings or our cookie consent tool. Please note that disabling essential cookies may impair the functionality of our Platform.
We never sell your personal data to third parties. We only share data where strictly necessary to operate our business or comply with the law. We carefully vet our third-party partners to ensure they adhere to strict data protection standards.
We may share your data with:
Agrizen Foods primarily stores and processes data within Kenya. However, some of our technology partners (e.g., cloud hosting providers, email services) may have servers located outside of Kenya.
If we transfer your data outside Kenya, we ensure it is protected by implementing adequate safeguards, including:
We continuously monitor these transfers to ensure ongoing compliance.
We implement robust technical and organizational measures to protect your personal data:
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.
| Data Category | Typical Retention Period | Rationale |
|---|---|---|
| Active Customer Accounts | For the duration of the active account | Ongoing service provision |
| Closed Accounts | 12 months after closure | Dispute resolution window |
| Order & Invoice Data | 7 years | Kenyan tax and accounting law compliance |
| Payment Records | Minimum period required by financial regulations | Regulatory compliance |
| Support Tickets | 2 years after resolution | Quality assurance and dispute reference |
| Marketing Data | Until consent is withdrawn or account is closed | Consent-based processing |
| Supplier Records | Duration of supplier relationship plus 7 years | Regulatory and contractual obligations |
| Audit & Compliance Records | 7 years | Legal and regulatory requirements |
| Cookies | Session cookies: until browser closes; Persistent cookies: as per specific lifespan (e.g., 12 months) | Functional necessity |
Under the Data Protection Act, 2019, you have the following rights regarding your personal data:
You have the right to know how your data is being processed. This policy serves as our comprehensive privacy notice fulfilling this obligation.
You can request a copy of the personal data we hold about you. This includes the categories of data processed, the purposes of processing, the recipients or categories of recipients, and the retention period.
You can request that we correct inaccurate or incomplete data. We will respond to such requests promptly and update our records accordingly.
You can request the deletion of your data, subject to legal obligations. For example, we must retain invoices for tax purposes under Kenyan law, so complete erasure may not always be possible.
You can object to the processing of your data, particularly for direct marketing. Where you object, we will cease processing your data for the specified purpose unless we can demonstrate compelling legitimate grounds.
You can request that we limit the ways we process your data. For example, while we verify the accuracy of your data, we may restrict further processing until the verification is complete.
You can request your data in a structured, machine-readable format to transfer to another service provider. This right applies where processing is based on consent or a contract.
You have the right to human intervention in decisions made solely by automated means that significantly affect you. We do not make significant decisions based solely on automated processing.
If we process data based on your consent, you can withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
How to Exercise Your Rights: To exercise any of these rights, please contact our Data Protection Officer at agrizenfoods@gmail.com or +254107100373. We will respond to your request within the statutory timeframe (usually 7 working days to acknowledge, and a reasonable time to fulfill). We may request additional information to verify your identity before processing your request.
Our Platform is intended for individuals aged 18 and above. We do not knowingly collect personal data from children under the age of 18. If you are under 18, please do not use our services. If we become aware that we have inadvertently collected data from a child, we will take steps to delete that information promptly. We encourage parents and guardians to monitor their children's online activities and educate them about safe internet practices.
With your prior consent, we may send you marketing communications via:
We use the personal data described in Sections 3.1 (Identity Data), 3.2 (Contact Data), and 3.6 (Usage Data) to personalize our marketing communications and ensure that the content we send is relevant to your interests and preferences. This personalization is based on your past purchases, browsing behavior, and stated preferences.
Opt-Out Rights: You can unsubscribe from marketing communications at any time by clicking the "unsubscribe" link in our emails, adjusting your account preferences in the "Notifications" section of your account settings, or contacting our customer support team. We respect your choice and will promptly cease sending you marketing communications upon your request. Opting out of marketing communications will not affect your ability to use the Platform or receive transactional communications (e.g., order confirmations and delivery updates).
To maintain the integrity of our marketplace, we use your information to:
This processing is conducted under our legitimate interests and legal obligations.
You may choose to submit reviews, feedback, or other content on our Platform. By submitting a review, you acknowledge that it may become publicly visible on the supplier's profile. We may moderate reviews to ensure they comply with our community guidelines, but we do not routinely pre-screen all content before publication.
You are responsible for the content you upload. Please do not include sensitive personal information of yourself or others in your public reviews. We reserve the right to remove any content that violates our community guidelines or is deemed inappropriate.
Our Platform integrates with various third-party services to function effectively:
When you use these third-party services, their respective privacy policies also apply. We encourage you to review the privacy policies of any third-party services you interact with through our Platform to understand how they handle your personal data.
We use automated systems for:
Clarification: We do not make significant decisions that legally affect you or significantly impact you solely based on automated processing. For example, we do not automatically deny you credit or refuse service without human review. Our automated systems are designed to assist and enhance our operations, not to make final decisions that could adversely affect your rights.
You have the right to object to profiling and automated decision making. If you wish to exercise this right, please contact our Data Protection Officer.
In the unlikely event of a personal data breach, we will follow a strict response protocol in accordance with Section 43 of the Data Protection Act, 2019, which requires data controllers to notify the Data Commissioner and the data subject of a breach within seventy-two hours of becoming aware of the breach where the breach is likely to result in a risk to the rights and freedoms of a data subject.
We will immediately detect and contain the breach to prevent further unauthorized access. This may involve isolating affected systems, revoking compromised credentials, and deploying additional security measures. Our security team will work around the clock to identify the source of the breach, assess the extent of the compromise, and implement containment measures to prevent further data exposure.
We will assess the severity of the breach and the potential impact on your rights and freedoms. This includes determining the categories and approximate number of data subjects affected, the types of records involved, the likely consequences of the breach, and whether the breach could result in financial loss, identity theft, discrimination, or other harm to the affected individuals.
If the breach is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of the breach, and we will notify you without undue delay. The notification will include the nature of the breach, the likely consequences, the measures taken or proposed to address it, and the contact details of our Data Protection Officer for further inquiries.
We will take necessary steps to rectify the breach, strengthen our security measures to prevent recurrence, and conduct a post-incident review to identify lessons learned. This may include updating our security protocols, enhancing employee training, upgrading our technical infrastructure, and engaging external cybersecurity experts to conduct a thorough forensic investigation.
Following the resolution of any data breach, we will conduct a comprehensive post-incident review to identify the root cause of the breach, assess the effectiveness of our response, and implement corrective measures to prevent similar incidents in the future. The findings of this review will be documented and used to update our incident response plan and data protection policies.
If you have any concerns about how we handle your personal data, please contact us first:
We are committed to addressing your concerns promptly and fairly. If you are not satisfied with our response, you have the right to lodge a formal complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya. You can reach the ODPC through their official website at https://www.odpc.go.ke or by phone.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any significant changes by posting the updated policy on our website and, where appropriate, sending you an email notification. We encourage you to review this policy periodically to stay informed about how we are protecting your personal data.
In accordance with the Data Protection Act, 2019, we are committed to conducting Data Protection Impact Assessments (DPIAs) before undertaking any processing activities that are likely to result in a high risk to the rights and freedoms of data subjects. This includes, but is not limited to, large-scale processing of sensitive personal data, systematic monitoring of public areas, or the introduction of new technologies.
Our DPIA process involves:
A DPIA will be conducted in the following circumstances:
If our DPIA identifies a high risk that cannot be adequately mitigated, we will consult with the ODPC before proceeding with the processing activity.
We have appointed a Data Protection Officer (DPO) to oversee our data protection strategy and implementation to ensure compliance with the requirements of the Data Protection Act, 2019. The DPO's responsibilities include:
Under the Data Protection Act, 2019, sensitive personal data includes data revealing a person's race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details, sex, or sexual orientation.
We generally do not collect or process sensitive personal data. However, in exceptional circumstances where such data is necessary (e.g., processing health data for allergy-related product recommendations or dietary requirements), we will obtain your explicit consent and implement enhanced security measures to protect this data. We will only process sensitive personal data in compliance with the strict requirements set out in Part V of the Data Protection Act, 2019.
Our Platform may contain links to our social media profiles (e.g., Facebook, Instagram, Twitter/X). When you interact with our social media profiles, the respective social media platform's privacy policy will apply. We recommend that you review the privacy policies of these platforms to understand how they collect and use your personal data.
We may also host public forums or comment sections on our Platform. Please be aware that any personal data you disclose in these public areas can be read, collected, and used by others. We strongly advise against posting sensitive personal information in public forums.
We are committed to the principles of data protection by design and by default, as mandated by the Data Protection Act, 2019. This means that we integrate data protection into the development of our Platform and business practices from the very beginning.
We implement appropriate technical and organizational measures to ensure that, by default, only personal data which is necessary for each specific purpose of the processing is processed. This applies to the amount of personal data collected, the extent of their processing, the period of their storage, and their accessibility.
In practice, this means:
While we take extensive measures to protect your personal data, you also have responsibilities to ensure the security of your account and information:
Agrizen Foods is registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC) of Kenya, as required by Section 18 of the Data Protection Act, 2019. Our registration details are available on the ODPC's public register of data controllers and data processors.
If any provision of this Privacy Policy is found to be invalid or unenforceable under applicable law, the remaining provisions shall continue in full force and effect. Any invalid or unenforceable provision shall be replaced with a valid and enforceable provision that most closely approximates the intent and effect of the original provision.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us at:
| Contact Method | Details |
|---|---|
| Privacy Officer | Moses Mwangi Kega |
| agrizenfoods@gmail.com | |
| Phone | +254107100373 |
| Office Address | Rhino Park Road ACDI |
See also our Terms of Use.
This Privacy Policy has been drafted in compliance with the Kenya Data Protection Act, 2019, and related regulations. It is intended for publication on the Agrizen Foods commercial e-commerce website.
Back to top