| Effective Date | 1 July 2026 |
| Platform | Manda (sellmanda.com) |
| Data Controller | Manda |
| Registered Office | 7th Floor, Pinetree Plaza, Kaburu Drive, Kilimani, Nairobi, Kenya |
| Contact | Hello@sellmanda.com |
| Regulatory Framework | Data Protection Act No. 24 of 2019 (Kenya) |
| This Privacy Policy explains how Manda collects, uses, stores, and protects your personal data in compliance with the Data Protection Act No. 24 of 2019, the regulations issued thereunder, and other applicable Kenyan law. As a registered Data Controller with the Office of the Data Protection Commissioner (ODPC), Manda is committed to handling your personal data lawfully, fairly, and transparently. |
1. INFORMATION WE COLLECT
Manda collects personal data that is necessary for the provision of its services. We collect information in the following categories:
1.1 Information You Provide Directly
- Identity data: full name, date of birth, national identification number, or passport number;
- Contact data: email address, phone number, and physical address;
- Business data: business name, registration number, financial statements, ownership structure, business description, and other information relating to a listed business;
- Account data: username, password (stored in encrypted form), and account preferences;
- Transaction data: details of transactions concluded or facilitated through the Platform;
- Communication data: messages, correspondence, and feedback submitted through the Platform or to our team.
1.2 Information Collected Automatically
- Device and technical data: IP address, browser type and version, device identifiers, and operating system;
- Usage data: pages visited, features used, time spent on the Platform, and clickstream data;
- Location data: approximate geographic location derived from your IP address;
- Cookies and tracking data: as further described in Clause 7 of this Policy.
1.3 Information from Third Parties
- Identity and verification data obtained from third-party Know Your Customer (KYC) and Anti-Money Laundering (AML) verification services;
- Business registration and credit data obtained from the Business Registration Service (BRS) or other official sources, where applicable;
- Publicly available information about businesses or individuals from official registries or public databases.
| Legal Basis (Data Protection Act, 2019): Manda processes your personal data on the following lawful bases: (a) performance of a contract to which you are a party; (b) compliance with a legal obligation; (c) your consent, where obtained; and (d) our legitimate interests in operating and improving the Platform, where such interests do not override your rights. |
2. HOW WE USE YOUR INFORMATION
Manda uses the personal data we collect for the following purposes:
- To create and manage your account and verify your identity;
- To provide, operate, and improve the Platform and our services;
- To facilitate connections between business sellers, buyers, and investors;
- To conduct and communicate with you about business valuations;
- To process payments and manage billing;
- To comply with our legal and regulatory obligations, including KYC, AML, and tax reporting requirements;
- To detect, investigate, and prevent fraud, security breaches, and other prohibited activities;
- To send you service-related communications, including account notifications and updates to these policies;
- To send you marketing communications about Manda’s services, where you have consented or where we have a legitimate interest to do so (with an option to opt out at any time);
- To analyse usage trends and improve the functionality, security, and user experience of the Platform;
- To enforce our Terms of Service and protect Manda’s legal rights.
Manda will not use your personal data for purposes incompatible with those for which it was collected without first obtaining your consent, except where permitted by the Data Protection Act No. 24 of 2019.
3. SHARING OF INFORMATION
Manda does not sell your personal data to third parties. We may share your personal data in the following circumstances:
3.1 With Other Users
Where you are a business seller, certain information about your listed business will be shared with registered and verified buyers or investors on the Platform. The extent of information shared will depend on the stage of the transaction process and your consent.
3.2 With Service Providers
We share data with trusted third-party service providers who assist us in operating the Platform, including cloud hosting providers, payment processors, email service providers, KYC/AML verification services, and analytics providers. These providers are contractually required to process data only on our instructions and to maintain appropriate security measures, consistent with the requirements of the Data Protection Act, 2019.
3.3 With Legal and Regulatory Authorities
We may disclose your personal data to government bodies, law enforcement agencies, the Office of the Data Protection Commissioner (ODPC), the Capital Markets Authority (CMA), the Financial Reporting Centre (FRC), the Kenya Revenue Authority (KRA), or any other competent authority where required by law, court order, or regulatory obligation.
3.4 In Connection with Business Transactions
In the event of a merger, acquisition, restructuring, or sale of Manda’s business or assets, your personal data may be transferred to the relevant counterparty, subject to equivalent data protection safeguards.
3.5 With Your Consent
We may share your personal data with third parties in other circumstances where you have given your explicit consent
4. DATA SECURITY
Manda takes the security of your personal data seriously and implements appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration, consistent with the requirements of the Data Protection Act No. 24 of 2019 and the Computer Misuse and Cybercrimes Act No. 5 of 2018.
Our security measures include:
- Encryption of data in transit using industry-standard TLS/SSL protocols;
- Encryption of sensitive data at rest;
- Access controls and role-based permissions limiting access to personal data to authorised personnel only;
- Regular security assessments and vulnerability testing;
- Staff training on data protection and information security.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Manda will notify the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects without undue delay, as required by the Data Protection Act, 2019.
You are responsible for maintaining the confidentiality of your account credentials. Please notify us immediately at hello@sellmanda.com if you suspect any unauthorised access to your account.
5. DATA RETENTION
Manda retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our retention periods are as follows:
| Data Category | Retention Period |
|---|---|
| Account and identity data | For the duration of your account, plus 7 years after closure (for regulatory compliance) |
| Business listing data | For the duration of the listing, plus 7 years after completion or removal |
| Transaction records | 7 years from the date of transaction (Kenya tax law requirement) |
| Communication records | 3 years from the date of communication |
| Marketing preferences | Until you withdraw consent or close your account |
| Security and fraud logs | 3 years from the date of the relevant event |
| Cookie and analytics data | As set out in Clause 7 of this Policy |
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with Manda’s data disposal procedures.
6. YOUR RIGHTS
Under the Data Protection Act No. 24 of 2019, you have the following rights in relation to your personal data. These rights may be subject to certain conditions and limitations under applicable law:
| Your Right | What It Means |
|---|---|
| Right of Access | You may request a copy of the personal data Manda holds about you and information about how it is processed. |
| Right to Rectification | You may request that inaccurate or incomplete personal data be corrected or updated. |
| Right to Erasure | You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. |
| Right to Restriction | You may request that we restrict the processing of your personal data in certain circumstances, such as while the accuracy of the data is being verified. |
| Right to Data Portability | You may request that we provide your personal data in a structured, commonly used, and machine-readable format, or transfer it to another data controller where technically feasible. |
| Right to Object | You may object to the processing of your personal data for direct marketing purposes at any time, and in other circumstances where we are processing data based on our legitimate interests. |
| Right to Withdraw Consent | Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal. |
| Right to Complain | You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke if you believe your rights have been infringed. |
To exercise any of your rights, please submit a written request to Hello@sellmanda.com. Manda will respond within thirty (30) days, as required by the Data Protection Act, 2019. We may require verification of your identity before processing your request.
7. COOKIES AND TRACKING TECHNOLOGY
7.1 What Are Cookies
Cookies are small text files placed on your device when you visit the Platform. They enable the Platform to function correctly, remember your preferences, and provide us with information about how the Platform is used.
7.2 Types of Cookies We Use
| Cookie Type | Purpose |
|---|---|
| Strictly Necessary Cookies | Essential for the Platform to function. These cannot be disabled. They include cookies for session management, authentication, and security. |
| Functional Cookies | Enable the Platform to remember your preferences, such as language settings and login details, to improve your experience. |
| Analytical / Performance Cookies | Allow us to understand how visitors use the Platform, which pages are visited most frequently, and where errors occur. This data is aggregated and anonymous. |
| Marketing Cookies | Used to track your activity across the Platform and third-party websites to deliver targeted advertising. These are only activated with your consent. |
7.3 Managing Cookies
You can control and manage cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. You can also manage your marketing cookie preferences through our cookie consent manager on the Platform.
For more information on cookies, visit the Kenya ICT Authority guidelines or www.allaboutcookies.org.
8. CHILDREN’S PRIVACY
The Platform is not directed at, and is not intended for use by, persons under the age of eighteen (18) years. Manda does not knowingly collect personal data from persons under the age of eighteen (18).
If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately at Hello@sellmanda.com. We will take prompt steps to delete such data from our systems.
This policy is consistent with the protections afforded to children under the Children Act No. 29 of 2022 and the Data Protection Act No. 24 of 2019.
9. TRANSFER OF DATA
As Manda operates a pan-African marketplace, certain personal data may be transferred to, processed in, or stored in countries outside Kenya, including other East African Community member states or countries where Manda’s service providers are located.
Manda will only transfer personal data outside Kenya where:
- The destination country provides an adequate level of data protection recognised by the ODPC;
- Appropriate safeguards are in place, such as standard contractual clauses, binding corporate rules, or equivalent mechanisms approved under the Data Protection Act, 2019;
- You have given your explicit consent to the transfer; or
- The transfer is necessary for the performance of a contract to which you are a party.
Where data is transferred to countries that are party to the African Continental Free Trade Area (AfCFTA) framework, Manda will comply with any applicable AfCFTA data governance protocols as they develop.
| Cross-Border Data Transfers (Section 48, Data Protection Act, 2019): Manda shall not transfer personal data outside Kenya except in compliance with Section 48 of the Data Protection Act No. 24 of 2019, which requires that the receiving country ensures adequate data protection or that appropriate safeguards are in place. |
10. CHANGES TO THIS POLICY
Manda reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer.
Material changes to this Policy will be communicated to registered Users by email and/or by prominent notice on the Platform at least fourteen (14) days before the changes take effect. The updated effective date will be indicated at the top of this Policy.
Your continued use of the Platform after the effective date of any updated Policy constitutes your acknowledgment of and agreement to the updated Policy. If you do not agree with any changes, you should discontinue use of the Platform and may request deletion of your account.
Previous versions of this Privacy Policy will be archived and made available on request to Hello@sellmanda.com.
11. OUR COMMITMENT
| Manda’s Data Protection Pledge |
|---|
| ✓ Lawfulness and Transparency We will always process your personal data on a lawful basis and be transparent about how and why we use it. |
| ✓ Purpose Limitation We will only use your data for the specific purposes for which it was collected, and will seek your consent before using it for any new purpose. |
| ✓ Data Minimisation We will collect only the minimum personal data necessary to deliver our services. |
| ✓ Accuracy We will take reasonable steps to ensure your personal data is accurate and up to date, and will correct it promptly upon request. |
| ✓ Security We will implement and maintain robust technical and organisational measures to protect your data from unauthorised access, loss, or misuse. |
| ✓ Respect for Your Rights We will honour all data subject rights requests promptly, fairly, and without charge, in accordance with the Data Protection Act, 2019. |
| ✓ Accountability We accept full responsibility for the personal data we hold and are registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC). |
| ✓ Openness We will be open about our data practices and will communicate any material changes clearly and in advance. |
Contact Our Data Protection Office
For all data protection enquiries, rights requests, or complaints, please contact:
Manda Data Protection Office
7th Floor, Pinetree Plaza, Kaburu Drive, Kilimani, Nairobi, Kenya
Email: Hello@sellmanda.com
Website: sellmanda.com
You also have the right to lodge a complaint directly with the Office of the Data Protection Commissioner (ODPC) of Kenya at: odpc.go.ke
Manda Privacy Policy · Effective 1 July 2026 · sellmanda.com · Hello@sellmanda.com · odpc.go.ke
