Privacy Policy

ZaoFresh Limited (“ZaoFresh”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of our users, including Mama Mboga, farmers, and other customers (collectively, “you” or “data subjects”).

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our website, mobile application, and services (collectively, the “Platform”). It is issued in accordance with the Data Protection Act, No. 24 of 2019 of the Laws of Kenya [citation:1].

We collect the following categories of personal data, in accordance with the principles of data minimisation and purpose limitation under Section 25 of the Data Protection Act [citation:1][citation:4]:

• Identity Data: Name, national ID number, KRA PIN (where required for transactions)
• Contact Data: Phone number, email address, physical/delivery address
• Transaction Data: Orders placed, payment records, delivery preferences
• Technical Data: IP address, browser type, device information, usage patterns on the Platform
• Communication Data: Messages sent through our support channels

Note: We do not collect sensitive personal data (as defined under the Act, including health data, biometric data, or data revealing race or ethnic origin) unless required by law or with your explicit consent.

Under Section 30 of the Data Protection Act, we process your personal data on the following lawful bases:

• Contractual Necessity: To fulfil orders, process payments, and deliver products you purchase
• Consent: Where you have given clear affirmative consent (e.g., marketing communications)
• Legal Obligation: To comply with tax, accounting, and regulatory requirements in Kenya
• Legitimate Interests: To improve our services, prevent fraud, and ensure Platform security

Pursuant to Section 26 of the Data Protection Act [citation:1], you have the following rights:

To exercise any of these rights, contact us at privacy@zaofresh.co.ke. We will respond within the statutory timeframe.

In accordance with Section 25(h) of the Data Protection Act, we do not transfer your personal data outside of Kenya unless:

• There is proof of adequate data protection safeguards in the recipient jurisdiction; or
• You have provided explicit consent to such transfer.

Where cloud services are used, we ensure appropriate safeguards including data processing agreements, encryption at rest and in transit, and compliance with guidelines issued by the Office of the Data Protection Commissioner [citation:2].

If you have concerns about how we handle your personal data, you may contact us directly or lodge a complaint with the Office of the Data Protection Commissioner (ODPC):