Privacy Policy

1. Introduction

PartsZote Limited ("PartsZote," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, share, and protect the personal data of users ("you" or "your") of the PartsZote platform (www.partszote.com), including our website, mobile applications, and related services (collectively, the "Platform").

This Privacy Policy is prepared in compliance with the Data Protection Act, 2019 (No. 24 of 2019) of Kenya and the regulations made thereunder, as administered by the Office of the Data Protection Commissioner (ODPC) of Kenya. We process your personal data lawfully, fairly, and in a transparent manner, and only for specified, explicit, and legitimate purposes.

By creating an account on or using the Platform, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Platform.

2. Information We Collect

PartsZote collects the following categories of personal information:

2.1 Information You Provide Directly

• Account registration data: Full name, email address, phone number (Kenyan mobile number), and password.
• Delivery information: Physical delivery address, county, town, and any delivery instructions.
• Vehicle information: Vehicle make, model, year, engine type, and VIN (Vehicle Identification Number) when provided by you for fitment purposes.
• Payment information: M-Pesa phone number, or card details (processed securely through our payment gateway—see Section 5).
• Communication data: Any messages, enquiries, complaints, or feedback you send to us via email, phone, live chat, or our contact forms.

2.2 Information Collected Automatically

• Device and browser information: Device type, operating system, browser type and version, screen resolution, and language preferences.
• IP address and location: Your Internet Protocol (IP) address, which may be used to determine your approximate geographic location.
• Usage data: Pages viewed, Products browsed, search queries, time spent on pages, click patterns, referral source, and other interaction data.
• Cookies and similar technologies: We use cookies, web beacons, and similar tracking technologies as described in Section 6.

2.3 Order and Transaction Data

• Order history, including Products ordered, quantities, prices paid, delivery addresses, and order status.
• Return and refund history.
• Customer support interaction records.

3. How We Use Your Information

PartsZote uses the information we collect for the following purposes:

• Order processing and fulfilment: To process your Orders, arrange delivery, communicate order status updates, and handle returns and refunds.
• Account management: To create and manage your PartsZote account, verify your identity, and provide customer support.
• Customer support: To respond to your enquiries, resolve complaints, and provide assistance with orders, returns, and technical issues.
• Vehicle fitment: To use your vehicle information to provide accurate product recommendations and fitment verification.
• Personalisation and recommendations: To display Products and content relevant to your vehicle, browsing history, and purchasing patterns.
• Marketing communications: With your consent, to send you promotional emails, SMS messages, and notifications about new Products, offers, and PartsZote news. You can opt out of marketing communications at any time (see Section 8).
• Platform improvement: To analyse usage patterns, diagnose technical issues, improve our product catalogue, and enhance the overall user experience.
• Legal compliance: To comply with applicable laws, regulations, and legal processes, including tax reporting obligations under the Kenya Revenue Authority (KRA) requirements and the Income Tax Act (Cap 470).
• Fraud prevention and security: To detect, prevent, and investigate fraudulent transactions, security breaches, and other prohibited activities.

The lawful bases for our processing activities under Section 30 of the Data Protection Act, 2019 are: (a) performance of a contract — for order processing, account management, and customer support; (b) legitimate interest — for platform improvement, fraud prevention, and security; (c) legal obligation — for tax compliance and regulatory reporting; (d) consent — for marketing communications and non-essential cookies. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

4. Data Segregation

PartsZote operates as a managed marketplace, acting as the sole intermediary between Buyers and product suppliers. To protect the privacy and commercial interests of all parties, PartsZote enforces a strict data segregation policy:

4.1 Customer Data Protection

Customer personal information—including name, phone number, email address, and delivery address—is NEVER shared with product suppliers, vendors, or any third party involved in the supply chain. Suppliers receive only the minimum information necessary to prepare an order for dispatch (product SKU, quantity, and a PartsZote-internal order reference). They do not know who the end customer is, where the product is being delivered, or how to contact the customer.

4.2 Supplier Data Protection

Supplier and vendor information—including their identity, business name, location, pricing structures, and contact details—is NEVER shared with customers. All Products on the Platform are presented as "Sold by PartsZote." Customers interact only with PartsZote and have no visibility into which supplier provided a particular product.

4.3 PartsZote as Data Intermediary

PartsZote acts as a data intermediary: all parties—Buyers and suppliers alike—interact exclusively with PartsZote. There is no direct communication channel between Buyers and suppliers on the Platform. This model ensures:

• Buyer personal data is protected from exposure to multiple third parties.
• Suppliers' commercial information and competitive pricing remain confidential.
• PartsZote can maintain quality control and consistent customer service standards.
• Disputes and returns are managed centrally by PartsZote without requiring the Buyer to engage with unknown third parties.

This data segregation is enforced at the system level—PartsZote's technology platform is designed to prevent unauthorised cross-party data access. Our staff members with access to customer data are bound by strict confidentiality obligations and operate under the principle of least privilege.

5. Payment Data

PartsZote takes the security of your payment information seriously:

5.1 M-Pesa

M-Pesa transactions are processed directly by Safaricom PLC through the M-Pesa API. When you pay via M-Pesa, you authenticate the transaction on your phone using your M-Pesa PIN. PartsZote does not have access to your M-Pesa PIN. We receive a transaction confirmation from Safaricom that includes the transaction reference number and the amount paid. Your M-Pesa phone number is stored by PartsZote solely for the purpose of processing refunds to the correct number.

5.2 Card Payments

Visa and Mastercard transactions are processed through our PCI DSS-compliant payment gateway. PartsZote does NOT store your full card number, CVV, or card expiration date on its servers. When you enter your card details at checkout, they are transmitted directly to the payment processor via an encrypted (SSL/TLS) connection. PartsZote retains only a masked card reference (e.g., **** **** **** 1234) and the transaction reference for record-keeping and refund processing purposes.

5.3 Payment Security

All payment pages on the Platform are protected by SSL/TLS encryption. PartsZote undergoes periodic security assessments to ensure that payment processing complies with industry standards. If you suspect any unauthorised use of your payment information in connection with PartsZote, please contact us immediately at support@partszote.com.

6. Cookies & Tracking

PartsZote uses cookies and similar technologies to enhance your experience on the Platform. Cookies are small text files stored on your device when you visit a website.

6.1 Types of Cookies We Use

• Essential cookies: Required for the Platform to function correctly. These include session cookies for login authentication, shopping cart persistence, and checkout processing. Without these cookies, the Platform cannot operate properly.
• Preference cookies: Store your preferences, such as your selected vehicle (make/model/year), currency display format, and language. These cookies improve your browsing experience by remembering your settings between visits.
• Analytics cookies: Used to collect information about how visitors use the Platform, including which pages are visited most frequently, how users navigate between pages, and whether users encounter error messages. We use this data in aggregate to improve the Platform. Analytics services may include Google Analytics or similar tools.
• Marketing cookies: Used with your consent to deliver relevant advertisements and measure the effectiveness of our marketing campaigns. These cookies may be set by third-party advertising partners.

6.2 Managing Cookies

You can manage or disable cookies through your browser settings. Please note that disabling essential cookies may prevent you from using certain features of the Platform, including the shopping cart and checkout. Most browsers allow you to view, manage, and delete cookies. For instructions specific to your browser, please consult your browser's help documentation.

7. Data Retention

PartsZote retains your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law:

• Account data: Retained for as long as your account remains active. If you request account deletion, your personal account data will be removed within thirty (30) days, subject to any legal retention obligations.
• Order and transaction records: Retained for a minimum of seven (7) years from the date of the transaction, as required by the Kenya Revenue Authority (KRA) for tax audit purposes under the Income Tax Act (Cap 470) and the Value Added Tax Act, 2013.
• Customer support records: Retained for three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Analytics and usage data: Retained in anonymised or aggregated form indefinitely for Platform improvement purposes. Identifiable usage data is retained for no more than twenty-four (24) months.
• Marketing consent records: Retained for as long as the consent is valid, plus three (3) years after withdrawal of consent, as evidence of consent compliance.

When personal data is no longer required, it will be securely deleted or anonymised in accordance with industry-standard data disposal practices.

8. Your Rights

Under the Data Protection Act, 2019 of Kenya, you have the following rights regarding your personal data:

• Right of access: You have the right to request a copy of the personal data PartsZote holds about you. We will provide this information within thirty (30) days of receiving your request.
• Right to correction: You have the right to request correction of inaccurate or incomplete personal data. You can update most of your account information directly through your account settings on the Platform.
• Right to deletion: You have the right to request the deletion of your personal data, subject to any legal retention obligations (see Section 7). Upon receiving a valid deletion request, PartsZote will delete your data within thirty (30) days, except for data that must be retained under Kenyan tax law.
• Right to object to processing: You have the right to object to the processing of your personal data for direct marketing purposes. You can opt out of marketing communications at any time by clicking the "Unsubscribe" link in any marketing email, replying "STOP" to any marketing SMS, or contacting us at dpo@partszote.com.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to lodge a complaint: If you believe that PartsZote has violated your data protection rights, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.

To exercise any of the above rights, please contact our Data Protection Officer at dpo@partszote.com. We may require you to verify your identity before processing your request.

9. Data Security

PartsZote implements appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit: All data transmitted between your browser and the Platform is encrypted using SSL/TLS (Secure Sockets Layer / Transport Layer Security) protocols. The Platform is served exclusively over HTTPS.
• Encryption at rest: Sensitive personal data, including payment references, is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to personal data is restricted to PartsZote personnel who require it for their job functions. All staff with access to personal data are bound by confidentiality agreements and are subject to disciplinary action for violations.
• Secure servers: Our servers are hosted in secure data centres with physical access controls, environmental protections, and monitoring systems.
• Regular security assessments: PartsZote conducts periodic vulnerability assessments and security audits to identify and address potential security risks.
• Incident response: PartsZote maintains a data breach incident response plan. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, PartsZote will notify the ODPC within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects without undue delay, as required by Section 43 of the Data Protection Act, 2019.

While we take all reasonable precautions, no method of electronic transmission or storage is completely secure. PartsZote cannot guarantee the absolute security of your data but is committed to maintaining the highest practicable level of data protection.

10. Cross-Border Data Transfers

PartsZote primarily stores and processes your personal data on servers located in Kenya. However, certain third-party service providers (such as payment processors, cloud hosting providers, and analytics services) may process data outside Kenya. Where personal data is transferred to a country outside Kenya, PartsZote ensures that:

1. The recipient country has been determined by the Data Protection Commissioner to have adequate data protection safeguards; or
2. Appropriate safeguards are in place, such as binding contractual clauses that provide equivalent protection to the Data Protection Act, 2019; or
3. You have provided explicit consent to the transfer after being informed of the risks.

These transfers are made in compliance with Section 48 of the Data Protection Act, 2019. You may contact our Data Protection Officer at dpo@partszote.com for details on the safeguards in place for any specific transfer.

11. Children's Privacy

The PartsZote platform is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe that your child has provided personal information to PartsZote, please contact us at dpo@partszote.com, and we will take steps to delete such information from our systems.

If PartsZote becomes aware that it has inadvertently collected personal data from a child under 18, we will delete the data promptly and take steps to ensure that the account is closed.

12. Changes to This Policy

PartsZote may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Post the revised policy on the Platform.
• For significant changes, notify registered Users via email or a prominent banner on the Platform.

Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this page periodically to stay informed about how PartsZote protects your data. Previous versions of this policy are available upon request.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or PartsZote's data protection practices, please contact our Data Protection Officer:

• Data Protection Officer: dpo@partszote.com
• General Support: support@partszote.com
• Phone: +254 111 044 400
• Address: PartsZote Limited, Nairobi, Kenya

For complaints related to data protection that have not been resolved to your satisfaction, you may contact the Office of the Data Protection Commissioner (ODPC) of Kenya:

• Website: www.odpc.go.ke
• Email: info@odpc.go.ke