Your Privacy Matters

1. Who We Are

SOKONI is a digital marketplace platform operated by Bravilex International Co. Limited, a company registered in Kenya. SOKONI is owned and operated by Bravilex International Co. Limited. In this Policy, "Company" means Bravilex International Co. Limited. Our platform connects buyers, sellers, service providers, vendors, drivers, and businesses across Kenya through one unified digital ecosystem available at mysokoni.co.ke.

This Privacy Policy describes how we collect, use, store, and protect personal data in accordance with the Kenya Data Protection Act, 2019 (No. 24 of 2019) and all applicable regulations. By using SOKONI, you agree to this policy.

Data Controller: Bravilex International Co. Limited  •  Nairobi, Kenya
DPO: privacy@mysokoni.co.ke

2. Data We Collect

Account & Identity

Marketplace Activity

• Products listed, orders placed, order history
• Search queries and browsing activity on the platform
• Reviews written and received, ratings given
• Messages exchanged with other users (transaction-gated)
• Saved items, wishlists, recently viewed products

Device & Technical Data

• IP address, browser type, operating system
• Device identifiers (Firebase Installation ID, push token)
• Service worker cache version, app version
• Crash logs and performance metrics

Location Data

• Delivery address (required for order fulfilment)
• GPS coordinates — only when you explicitly grant permission (driver app, live delivery tracking)
• City or region inferred from IP address for localisation

Seller & Business Data

• Business name, KRA PIN, business registration number
• Bank account details or M-Pesa number for payouts
• Product inventory, pricing, promotions
• VAT registration and eTIMS credentials (AES-256-GCM encrypted at rest)

3. Authentication Providers

SOKONI uses Firebase Authentication (provided by Google LLC) to manage user sign-in securely. When you choose a social sign-in method, that provider's privacy policy also applies to data they share with us.

We do not store your social provider passwords. We support account linking — you can connect multiple sign-in methods to one SOKONI account from Profile → Settings.

4. How We Use Your Data

• Service delivery: Process orders, facilitate payments, match buyers and sellers, route deliveries.
• Authentication: Verify your identity, maintain secure sessions, enforce account limits and brute-force protection.
• Communications: Send order updates, delivery tracking, security alerts, and (with consent) marketing emails.
• Payments: Process M-Pesa, card, and wallet transactions; generate eTIMS-compliant tax receipts.
• Trust & Safety: Detect fraud, prevent abuse, enforce community standards, moderate content.
• Legal compliance: Meet KRA eTIMS obligations, anti-money-laundering requirements, and lawful court orders.
• Platform improvement: Aggregate, anonymised analytics used to improve search results, recommendations, and performance.

5. Cookies & Local Storage

SOKONI is a Progressive Web App (PWA). We use the following storage mechanisms:

We do not use third-party advertising cookies. You may clear all browser storage at any time via your browser settings or by logging out of SOKONI.

6. Payments & Financial Data

Payment processing is handled by IntaSend, licensed by the Central Bank of Kenya. SOKONI does not store raw card numbers or M-Pesa PINs.

• M-Pesa STK Push is initiated via IntaSend — your PIN is entered directly on the Safaricom secure interface, never on SOKONI servers.
• Transaction records (amount, reference number, status) are stored in our Firestore database for accounting, reconciliation, and dispute resolution.
• Seller payouts are processed via IntaSend B2C with 5% Withholding Tax (WHT) deducted per the Income Tax Act, Cap. 470.
• KRA eTIMS receipts are generated for all taxable transactions and stored for 7 years as required by law.

IntaSend Privacy Policy: intasend.com/privacy-policy

7. Analytics

We use Google Analytics 4 (GA4) to understand how users interact with the platform. All data is aggregated and anonymised before informing product decisions. We do not build individual advertising profiles or sell analytics data to third parties.

We also maintain internal platform analytics (search trends, funnel metrics, seller performance scores) stored in Firebase Firestore, accessible only to authorised admin and operations staff.

8. Data Sharing

We share your personal data only when necessary:

• Sellers: Your delivery name and address are shared with the fulfilling seller.
• Drivers: Your pickup or delivery coordinates are shared with the assigned driver during an active delivery.
• Google / Firebase: Authentication, database, storage, and hosting infrastructure.
• IntaSend: Payment processing — name, phone number, amount.
• Kenya Revenue Authority (KRA): eTIMS transaction data as required by law.
• Law enforcement: Only when required by a valid Kenyan court order or statutory demand.

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

9. Data Retention

After the applicable retention period expires, data is permanently deleted or irreversibly anonymised.

10. Your Rights

Under the Kenya Data Protection Act 2019, you have the following rights:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate personal data.
• Erasure: Request deletion of your data (subject to legal retention requirements).
• Portability: Receive your data in a structured, machine-readable format (CSV or JSON).
• Objection: Object to processing based on legitimate interests.
• Restriction: Request that we temporarily stop processing your data.
• Withdraw consent: At any time, where processing is based on your consent.

To exercise any right, visit our Data Deletion & Rights Centre or email privacy@mysokoni.co.ke. We respond within 30 days as required by the KDPA.

You may also complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

11. Security

• All data in transit is encrypted with TLS 1.2+.
• Firebase Firestore data is encrypted at rest by Google Cloud (AES-256).
• Payment API keys and credentials are stored in Firebase Secret Manager, not in source code.
• Admin access is protected by multi-factor authentication and role-based access control (8 permission levels).
• Brute-force protection: accounts are locked after 5 failed consecutive login attempts.
• Sessions time out automatically after 30 minutes of inactivity (configurable).
• Content Security Policy (CSP) headers are enforced on all pages.

To report a security vulnerability responsibly, email security@mysokoni.co.ke.

12. Children

SOKONI is not directed at children under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact privacy@mysokoni.co.ke immediately and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or an in-app notification at least 14 days before taking effect. The "Last updated" date at the top of this page always reflects the most recent revision. Continued use of SOKONI after a change takes effect constitutes acceptance of the updated policy.

14. Contact & Data Protection Officer

To request data deletion or data export, use our self-service Data Deletion Centre.