Privacy Policy

1. Introduction

Ubossify ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our dropshipping marketplace platform, website, and related services.

By using Ubossify, you consent to the data practices described in this policy. We encourage you to read this policy carefully and contact us if you have any questions.

2. Information We Collect

Personal Information You Provide:

• Name, email address, and phone number during account registration.
• Business information (business name, KRA PIN) for supplier and merchant accounts.
• Shipping and billing addresses for order fulfillment.
• M-Pesa phone number and payment details for transactions.
• WhatsApp phone number (for suppliers), used to send order notifications via the WhatsApp Business API.
• Store connection details (Shopify, WooCommerce API credentials).

Information Collected Automatically:

• Device information (browser type, operating system, device identifiers).
• Usage data (pages visited, features used, time spent on the platform).
• IP address and approximate location.
• Cookies and similar tracking technologies.

Information from Third Parties:

• Order and store data from connected platforms (Shopify, WooCommerce).
• Payment confirmation data from M-Pesa and other payment providers.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your Ubossify account.
• Process orders, payments, and supplier payouts.
• Sync products and inventory between suppliers and merchant stores.
• Coordinate shipping and delivery across Kenya.
• Provide customer support and respond to your inquiries.
• Send service-related communications (order updates, account notifications).
• Improve our platform, features, and user experience.
• Detect and prevent fraud, abuse, and security threats.
• Comply with legal obligations and enforce our Terms and Conditions.

4. Information Sharing & Disclosure

We may share your information with:

• Suppliers and Merchants: Order details, shipping addresses, and customer contact information necessary for order fulfillment.
• Payment Providers: M-Pesa and other payment processors to complete transactions.
• Delivery Partners: Shipping addresses and contact details for order delivery.
• Platform Partners: Shopify, WooCommerce, and other e-commerce platforms to sync store data.
• Legal Authorities: When required by law, court order, or to protect our rights and safety.

We do not sell your personal information to third parties for marketing purposes.

5. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption in transit: All communications between your browser and our platform are encrypted using HTTPS/TLS.
• Encryption at rest: All data stored in our database (Amazon RDS) is encrypted at rest using AES-256 encryption.
• Encrypted backups: Automated database backups are encrypted and stored securely via AWS infrastructure.
• Password security: Passwords are stored using industry-standard hashing algorithms and are never stored in plain text.
• Access controls: Personal data is accessible only to authorised staff on a strict need-to-know basis. Role-based access controls are enforced across all systems.
• Access logging: Access to personal data by staff is logged and monitored through our platform's activity log system.
• Sensitive data encryption: Platform API tokens (e.g. Shopify access tokens) are encrypted before storage using application-level encryption.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Cookies & Tracking

Ubossify uses cookies and similar technologies to:

• Keep you signed in to your account.
• Remember your preferences and settings.
• Analyze platform usage and improve our services.
• Provide a personalized experience.

You can control cookie settings through your browser. Disabling cookies may affect some platform functionality.

7. Third-Party Services

Our platform integrates with third-party services that have their own privacy policies:

• Shopify: For store management and product syncing.
• WooCommerce: For WordPress-based store integration.
• Safaricom M-Pesa: For payment processing within Kenya.
• Delivery Partners: For shipping and logistics services.
• Meta (WhatsApp Business API): We use the Meta WhatsApp Business API to send order assignment and fulfillment notifications to registered suppliers. Supplier name and WhatsApp phone number are transmitted to Meta's servers to deliver these messages. Meta's data practices are governed by the Meta Privacy Policy.

We encourage you to review the privacy policies of these third-party services. Ubossify is not responsible for the privacy practices of external services.

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected. Our specific retention periods are:

• Customer order data (name, phone, address from fulfilled orders): retained for 90 days after order completion, then anonymised or deleted.
• Merchant and supplier account data: retained for the duration of the account and up to 12 months after account closure.
• Financial and transaction records: retained for 7 years as required by Kenyan tax and business regulations.
• Activity and access logs: retained for 12 months for security and audit purposes.
• Support communications: retained for 24 months to ensure continuity of service.

After the applicable retention period, personal data is securely deleted or anonymised. You may request early deletion of your data by contacting us at [email protected], subject to any legal retention obligations.

9. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Objection: Object to the processing of your personal data in certain circumstances.
• Portability: Request your data in a structured, commonly used format.

To exercise any of these rights, please contact us at [email protected].

10. Children's Privacy

Ubossify is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a minor, we will take steps to delete such information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our platform and updating the "Last updated" date. Your continued use of Ubossify after changes are posted constitutes acceptance of the revised policy.

12. Security Incident Response

We maintain a security incident response policy to ensure prompt and effective action in the event of a data breach or security incident. Our procedure includes:

• Detection and containment: We monitor our systems for suspicious activity. Upon detecting a potential breach, we immediately isolate affected systems to prevent further exposure.
• Assessment: We assess the nature, scope, and impact of the incident within 24 hours of detection, including identifying which personal data may have been affected.
• Notification: If a breach is likely to result in risk to individuals, we will notify affected users and relevant authorities (including the Office of the Data Protection Commissioner of Kenya) within 72 hours of becoming aware of the breach, as required by the Kenya Data Protection Act, 2019.
• Remediation: We take immediate steps to fix vulnerabilities, restore affected systems, and prevent recurrence.
• Review: Following any incident, we conduct a post-incident review to improve our security practices.

To report a suspected security vulnerability or incident, please contact us immediately at [email protected].