Privacy Policy

01Who is responsible for your data

IbuyUg is responsible for personal data processed through this storefront, except where a payment provider, product publisher, delivery provider, or independent supplier acts under its own privacy terms.

Contact details for privacy requests appear at the end of this policy.

02Information we collect

• Account and identity data: name, email, phone number, login security information, account role, and customer tier.
• Order and delivery data: products, quantities, prices, addresses, order notes, status, invoices, support history, and fulfillment records.
• Digital-product data: device model, serial or IMEI information, account or service identifiers, licence details, and other product-specific fields clearly requested at checkout.
• Payment data: payment method, amount, transaction reference, payment status, payer email where supplied by a provider, and anti-fraud signals. We do not ask you to store a payment PIN or complete card credentials on our servers.
• Technical and security data: IP address, browser/user-agent, session and cookie identifiers, access times, audit events, and security logs.
• Communications: contact forms, emails, WhatsApp order messages you choose to send, complaint details, and support responses.
• Legal-consent evidence: accepted policy versions, the agreement shown, acceptance time, account, order, IP address, browser information, and cart fingerprint.

03Why and how we use information

Depending on the context and applicable law, processing is based on performance of our contract with you, steps requested before a contract, compliance with legal obligations, legitimate interests that do not override your rights, or your consent where consent is required.

• create and secure accounts, authenticate users, and prevent unauthorized access;
• price, validate, process, deliver, support, and keep records of orders;
• send transactional messages and respond to questions, disputes, or refund requests;
• process payments, reconcile transactions, detect fraud, enforce purchase limits, and protect the platform;
• meet tax, accounting, consumer-protection, data-protection, sanctions, and lawful-request obligations;
• diagnose errors, maintain availability, measure service performance, and improve the storefront;
• send marketing only where permitted, with an available opt-out.

04Digital-product and sensitive order data

Some digital products require a device or service identifier so that a supplier can perform the requested technical service. We use those fields only to validate, route, fulfill, troubleshoot, document, or support the order and for legitimate fraud and authorization checks.

You confirm that you are authorized to provide the submitted information and request the service. Do not submit special-category or highly sensitive personal information unless we expressly request it and explain why it is necessary.

05When information is shared

We do not sell personal data. We disclose only what is reasonably necessary to:

• payment providers such as M-Pesa or PayPal to initiate, verify, capture, refund, and reconcile transactions;
• digital-product suppliers, software publishers, API providers, and technical fulfillment partners to process the selected product;
• delivery, hosting, email, security, analytics, professional-adviser, and customer-support providers acting under appropriate obligations;
• regulators, courts, law enforcement, rights holders, or other parties where disclosure is legally required or reasonably necessary to protect rights, safety, systems, or prevent fraud;
• a successor in a merger, financing, restructuring, or sale, subject to applicable confidentiality and data-protection requirements.

06International data transfers

Payment, hosting, communications, or digital-product suppliers may process information outside Kenya or your country. Where transfer rules apply, we use a lawful transfer mechanism and proportionate safeguards, such as contractual protections, adequacy decisions, or another mechanism recognized by applicable law.

07How long information is kept

We retain information only for as long as reasonably necessary for the purpose collected, including fulfillment, account operation, support, fraud prevention, dispute handling, warranty evidence, tax and accounting, legal claims, and regulatory obligations.

Retention periods vary by record and jurisdiction. Consent and transaction evidence may be kept for the applicable limitation or statutory recordkeeping period. When information is no longer required, we delete, anonymize, or securely isolate it unless a legal hold applies.

08Security and incident response

We use administrative, technical, and organizational safeguards designed for the nature and risk of the data, including access control, authentication, encryption in transit, validation, logging, backups, least-privilege practices, and service-provider review where appropriate.

No online system can guarantee absolute security. You should use a unique password, enable available account protections, keep fulfilment credentials confidential, and notify us immediately if you suspect misuse.

09Your privacy rights

Subject to applicable law and relevant exceptions, you may have rights to be informed, access your data, correct inaccurate data, object to or restrict certain processing, request deletion, receive portable data, withdraw consent for consent-based processing, and complain to a competent data-protection authority.

Withdrawal of consent does not affect earlier lawful processing and does not require deletion of records we must retain for contract, fraud prevention, legal claims, accounting, or another lawful purpose. We may verify your identity and authority before responding.

10Cookies and similar technology

We use essential cookies and session storage for login, security, cart contents, checkout, currency preference, and site functionality. Optional analytics or marketing technology, if enabled, should be governed by any consent controls required in your location. Browser settings can block cookies, but essential features may then stop working.

11Children and third-party information

This store and its technical digital tools are not directed to children who cannot lawfully enter the relevant contract. Do not submit another person’s data unless you have authority and an appropriate lawful basis. Parents or guardians who believe a child provided data improperly should contact us.

12Requests, complaints, and updates

We may update this policy to reflect operational, legal, or technical changes. The version shown at the time of a digital checkout is recorded with the purchase consent. Material revisions will receive a new version or effective date.