Privacy policy

1. Who is responsible for your data

Sokommerce (sokommerce.com) is run by A&K Worldwide Enterprises FZCO, which decides how your personal data is used (the “data controller”). We are based in Dubai and sell to customers in Kenya, so the Data Protection Act 2019 of Kenya applies to how we handle your data.

For anything about your data, write to [support@sokommerce.com](mailto:support@sokommerce.com) or WhatsApp +971 50 236 9167.

2. What we collect

We do not ask for ID numbers, and we do not collect sensitive data such as health, religion or ethnicity.

3. Why we use it, and on what legal basis

Your name and M-PESA phone number are needed to place an order: without them we cannot take your payment or hand over your goods. Everything else is optional.

4. Who we share it with

• Safaricom (M-PESA): to request and confirm your payment and to send refunds.
• Our SMS provider: to send order updates to your phone.
• WhatsApp (Meta): when you chat with us on WhatsApp, under WhatsApp's own terms.
• Hosting and IT providers: who run our website, database, email and backups for us, under contract.
• Couriers you choose: the name, phone number and town needed to deliver your parcel.
• Meta Platforms: Pixel data from your browser, only if you accept advertising cookies.
• Kenya Revenue Authority: data on eTIMS tax invoices, and tax authorities where the law requires.
• Authorities, courts and our professional advisers: only when the law requires it or to defend a legal claim.

We do not sell your personal data and we do not give it to other businesses for their own marketing.

5. Transfers outside Kenya

Our company is in the United Arab Emirates, and some of our providers keep data on servers outside Kenya. We only transfer data where the Data Protection Act (sections 48 to 50) and the Data Protection (General) Regulations 2021 allow it: under written contracts that protect your data (including the ODPC standard contractual clauses where needed), with encryption in transit and access limited to staff who need it, or where the transfer is necessary for your order. You can ask us which safeguards apply.

6. How long we keep it

After that we delete the data or make it anonymous.

7. How we protect it

The website runs only over encrypted connections (HTTPS). Access to customer data is limited to staff who need it for their work and is protected by passwords. Each order has its own pickup code. If a data breach puts you at real risk, we will report it to the Data Protection Commissioner within 72 hours and tell you what happened and what you can do, as section 43 of the Act requires.

8. Your rights

Under the Data Protection Act 2019 you have the right to:

• be informed how your data is used (this page);
• access the data we hold about you;
• correct data that is wrong or out of date;
• delete data we no longer need or hold unlawfully;
• object to processing, and to stop direct marketing at any time;
• restrict processing while a complaint is checked;
• data portability: receive your data in a common machine-readable format;
• withdraw consent at any time, without affecting what was done before;
• not be subject to a decision based only on automated processing. We do not make such decisions.

To use a right, write to support@sokommerce.com from the email or WhatsApp number linked to your account, or tell us that number. We may ask a question to confirm it is really you. We answer access requests within 7 days, correction, deletion, objection and restriction within 14 days, and portability within 30 days, as the Data Protection (General) Regulations 2021 set out. It is free.

9. Marketing messages

We send offers or new-stock alerts only if you said yes. Every marketing SMS or WhatsApp message tells you how to stop: reply STOP, or write to us. We stop within 7 days at the latest. Order updates about an order you placed are not marketing and continue until the order is closed.

10. Cookies

Necessary cookies do not need consent because the shop does not work without them. The Meta Pixel loads only after you press “Accept” in the cookie banner. You can change your choice any time with “Cookie settings” at the bottom of every page, or by deleting cookies in your browser.

11. Children

Sokommerce is for adults (18 and over) buying stock for resale or their own business. We do not knowingly collect data about children. If you think a child has given us data, contact us and we will delete it.

12. Complaints

Please talk to us first, so we can fix it. You also have the right to complain to the Data Protection Commissioner:

13. Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use data you already gave us, we tell you by SMS or email before it applies.