Privacy policy

1. Who we are

Arusifiti Ltd, Marsabit Plaza, Ngong Road, Nairobi, Kenya, is the data controller for arusifiti.com. Contact: privacy@arusifiti.com. Our registration with the Office of the Data Protection Commissioner (ODPC) is in progress.

2. What we collect

• Couples: name, email, phone number, wedding date and location, and messages you send to vendors.
• Vendors: business name, contact person, email, phone, business location, category, prices, and photos and descriptions you upload.
• Everyone: technical data needed to run the site, such as login session cookies, IP address and browser type.

3. Why we use it and our legal basis

• To create and run your account and show vendor profiles: to perform our agreement with you.
• To pass your enquiry to the vendor you contact: to perform our agreement with you.
• To verify vendors and prevent fraud and spam: our legitimate interest in a safe marketplace.
• To send product news or offers: only with your consent, which you can withdraw at any time.
• To meet legal obligations, such as tax records or lawful requests from authorities.

4. Who we share it with

• Vendors you contact receive your name, contact details and message.
• Service providers who process data for us under written contracts: Resend (email), Africa’s Talking (SMS in Kenya), Cloudflare (photo storage) and Contabo (hosting). Some are outside Kenya; see section 5.
• We don’t sell your personal data.

5. Transfers outside Kenya

Some providers store data outside Kenya, including in the United States. We only use providers that give appropriate safeguards for your data, under written agreements, as required by sections 48 and 49 of the Data Protection Act.

6. How long we keep it

Profile and account data is deleted 30 days after account closure. Transaction and payment records are retained for 5 years from the end of the financial year in which the transaction took place, as required by Kenyan tax law. Enquiry messages for 24 months after the last message in a conversation.

7. Your rights

You can ask to: be informed about how we use your data; access it (we reply within 7 days); correct it (within 14 days); delete it (within 14 days); object to or restrict how we use it (within 14 days); and receive a copy in a portable format (within 30 days). To make a request, email privacy@arusifiti.com. If you’re unhappy with our response, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.

8. Marketing

We only send marketing with your consent. Every marketing email and SMS includes a free way to opt out, and replying STOP to an SMS works.

9. Security

See our Security page. If a breach puts your data at real risk, we’ll notify the Data Protection Commissioner within 72 hours of becoming aware and tell affected users without undue delay.

10. Age

Arusifiti is for people aged 18 and over. We don’t knowingly collect data from children.

11. Changes

We’ll post updates here and, for significant changes, email account holders.