Solemate Africa collects personal data to run a marketplace: to create an account, take payment, arrange delivery, and support buyers and sellers. This page explains what we collect, why, who we share it with, and what you can do about it.
Who we are
Hawkshe Solemate Africa Limited (trading as Solemate Africa), Brian Apartments, Kihumo Road, Nairobi, Kenya, is the data controller for personal data processed on the platform under the Kenya Data Protection Act 2019.
For any privacy question, contact [email protected] with "Privacy" in the subject line.
What we collect
From buyers
- Account details: name, phone number in E.164 format, email address
- Delivery details: address, alternate contact numbers, delivery notes
- Order history: what you bought, when, from which seller, and at what price
- Payment metadata: M-Pesa transaction reference, card last-4 digits, chargeback status. We do not store PINs, full card numbers, or CVCs. Card details go directly from your browser to our payment service provider; M-Pesa credentials go directly to Safaricom.
- Support and message history within the platform, including WhatsApp messages exchanged with our agent
From sellers
- Business identity documents listed in the Seller KYC policy
- M-Pesa Till/Paybill numbers registered to the business
- Listing content, catalogue metadata, and settlement statements
Automatically, from everyone using the site
- IP address, browser and device type, pages visited, and referring URLs (used for analytics and abuse detection)
- Cookies for authentication and preferences (see Cookies below)
Why we collect it, and the legal basis
Under the Kenya Data Protection Act 2019 we rely on the following grounds:
- Performance of a contract — to fulfil orders you place, settle payments to sellers, and provide customer support
- Legal obligation — to keep transaction and KYC records for regulators, and to respond to lawful requests from the CBK, ODPC, KRA, or the courts
- Legitimate interest — to detect fraud, secure the platform, and measure product usage in aggregate
- Consent — for marketing communications you actively opt into
Who we share it with
We share the minimum necessary personal data with:
- Payment processors: Safaricom (Daraja / M-Pesa) for KES payments; our third-party payment service provider for card payments
- Couriers: the licensed courier partner assigned to your order for delivery
- Sellers: your name, delivery address, contact number, and order details — only for the order they are fulfilling. Sellers do not receive your payment credentials.
- Communications providers: Twilio for WhatsApp messages, our SMTP provider for email
- Analytics: PostHog (EU-hosted) for usage analytics and product telemetry, in aggregate where feasible
- Infrastructure: our hosting provider and Cloudflare (bot protection and CDN)
We do not sell personal data. We do not run advertising or share data with advertising networks.
International transfers
Some of our processors are outside Kenya (our payment service provider, Cloudflare, PostHog EU). Transfers happen only under standard contractual safeguards required by the Kenya Data Protection Act 2019 and, where applicable, GDPR-equivalent terms.
How long we keep it
- Order and transaction records: 7 years, to meet accounting and tax obligations
- KYC documents (sellers): 5 years after the seller ceases to trade with us, per Kenya AML/KYC guidance
- Support and message history: 2 years from the last message
- Analytics events: aggregated and rolled up after 12 months; raw event storage does not exceed 12 months
- Marketing lists: until you unsubscribe
Deletion requests may be partially fulfilled where legal retention overrides — see "Your rights" below.
Cookies and similar technologies
We use cookies for authentication, session state, and preferences (currency, theme). We use PostHog to record product analytics; PostHog sets its own cookies scoped to our domain.
We do not use advertising cookies. Because we do not run advertising or third-party tracking beyond basic analytics, no consent banner is shown; the cookies we do set are necessary for the site to function or serve strictly analytical purposes.
Your rights
Under the Kenya Data Protection Act 2019 you have the right to:
- Access the personal data we hold about you
- Rectification of anything inaccurate
- Erasure ("right to be forgotten"), subject to our legal retention obligations
- Restriction of processing while a dispute is resolved
- Data portability for data you provided to us
- Object to processing based on legitimate interest
- Withdraw consent at any time, without affecting the lawfulness of earlier processing
To exercise any of these, write to [email protected] with "Privacy request" in the subject line and the account phone number you registered with. We aim to respond within 30 calendar days, as required by law.
If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.
Security
We use TLS on every request, hash passwords, and restrict access to personal data on a need-to-know basis internally. Payment credentials are never seen by our systems.
No system is perfect. If you become aware of a security issue affecting Solemate Africa, please email [email protected] with "Security" in the subject line. We will confirm receipt within 2 business days.
Children
Solemate Africa is intended for users aged 18 and above. We do not knowingly collect data from children. If you believe a child's data has been submitted to us, contact us and we will delete it.
Changes to this policy
Material changes are notified by email and posted on this page. The Last updated date at the foot of the page reflects the most recent review.