Privacy Policy

1. Who We Are

Micro Depth Technologies Limited is a company incorporated in Kenya, operating as an ICT hardware reseller and inbound e-commerce retailer under the trading names "MDT" and "MDT Retail." For the purposes of the Act, MDT is the data controller responsible for the personal data described in this Policy.

MDT is registered with Kenya's Office of the Data Protection Commissioner (ODPC) as both a Data Controller and a Data Processor, confirming our authorization to collect and process personal data under the Data Protection Act, 2019.

2. Scope of This Policy

This Policy applies to personal data we collect through our websites, the ordering and checkout tools embedded on those websites, our customer account system, our internal order-processing systems, and any direct communication with you by phone, email, or WhatsApp regarding an order or enquiry. It does not apply to third-party websites, platforms, or services that may be linked from our Services, which maintain their own privacy policies.

3. Information We Collect

3.1 Information You Provide to Us

• Account information: your full name, email address, phone number, and a password (stored only in encrypted/hashed form — we never store your password in plain text and cannot view it).
• Order information: the products you purchase, order quantities, and order value.
• Billing and contact details: name, phone number, and email address associated with an order.
• Delivery information: where you choose delivery rather than pickup, the delivery address you describe in text and the map location (GPS coordinates) you pin, so our team can locate you accurately.
• Communications: messages, calls, or WhatsApp conversations between you and our team — for example, when confirming stock availability before checkout, or coordinating delivery.
• Payment confirmation details: the M-Pesa phone number used for payment, the M-Pesa transaction/receipt reference, and the amount paid.

3.2 Information Collected Automatically

• Technical data such as your IP address, browser type, device type, and general location inferred from your network connection.
• Cookies and similar technologies used to operate your shopping cart, remember your session, and keep you signed in between visits (see Section 11).
• Usage data such as pages visited, products viewed, and how you interact with our Services, used to improve site performance and reliability.

3.3 Payment Information

Payments are processed through Safaricom's M-Pesa mobile money platform via the Daraja API. We do not collect, store, or have access to your M-Pesa PIN or any Safaricom account credentials at any point — these are entered directly on your phone through Safaricom's own secure prompt and never pass through our systems. We retain only the payment confirmation details necessary to reconcile your order (the phone number used, the amount, the date, and the M-Pesa receipt number).

4. How We Use Your Information

We use the personal data described above for the following purposes:

• To create and manage your customer account.
• To process, fulfil, and confirm stock availability for your orders.
• To process payments and reconcile M-Pesa transactions against your order.
• To coordinate delivery to the location and address you provide, or to prepare your order for pickup.
• To communicate with you about your order, including by phone, email, or WhatsApp — for example, to confirm item availability or arrange delivery.
• To respond to your enquiries and provide customer support.
• To maintain the security of our Services, including detecting and preventing fraud or unauthorised account access.
• To comply with applicable legal, tax, and regulatory obligations.
• With your consent, to send you information about products, offers, or updates relevant to you. You may opt out of marketing communications at any time.

5. Legal Basis for Processing

In accordance with the Act, we process your personal data only where we have a valid legal basis to do so, which may include:

• Performance of a contract — to create your account, process your order, and arrange payment or delivery.
• Consent — for example, when you register an account, share your delivery location, or opt in to marketing communications. Where processing relies on consent, you may withdraw it at any time.
• Legal obligation — where we are required to retain or disclose information to comply with tax, financial, or regulatory requirements.
• Legitimate interest — for example, to maintain the security of our platform, prevent fraud, and improve our Services, provided this does not override your fundamental rights and freedoms.

6. How We Share Your Information

We do not sell your personal data. We may share personal data only with the following categories of recipients, and only to the extent necessary:

• Payment processors — Safaricom, to process M-Pesa payments via the Daraja API.
• Hosting and infrastructure providers — including our website hosting, database, and application hosting providers, who process data on our behalf under appropriate confidentiality and security obligations.
• Delivery coordination — our internal team, and where applicable, third-party riders or logistics partners, solely to the extent necessary to deliver your order.
• Legal and regulatory authorities — where disclosure is required by law, court order, or to protect our legal rights, or the rights and safety of others.
• Professional advisors — such as auditors or legal counsel, bound by confidentiality obligations, where necessary.

Any third party that processes personal data on our behalf does so only under a written agreement requiring them to protect that data to a standard consistent with the Act.

7. Data Storage, Hosting and Security

Personal data is stored across secure systems, including a cloud-hosted database used for customer accounts and an e-commerce platform used for order and product data. We apply technical and organisational measures appropriate to the sensitivity of the data involved, including:

• Encryption of passwords using industry-standard hashing — no MDT staff member can view your password.
• Access controls restricting who within our organisation can view customer and order data, limited to what each role requires.
• Secure transmission of data between your device and our systems.

While we take reasonable steps to protect your personal data, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

8. International Data Transfers

Some of the infrastructure providers we use to host our systems may store or process data on servers located outside Kenya. Where personal data is transferred outside Kenya, we take steps consistent with the Act to ensure that such transfers are made only to jurisdictions or recipients that provide an adequate level of data protection, or under appropriate safeguards such as contractual protections with our service providers.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including any applicable legal, accounting, or reporting requirements. Order and transaction records may be retained for longer periods where required for tax or financial record-keeping purposes. Where you close your account or request deletion of your data, we will delete or anonymise it unless we are required or permitted by law to retain it further.

10. Your Rights Under the Data Protection Act, 2019

As a data subject, you have the right to:

• Be informed of the use to which your personal data is to be put.
• Access your personal data that we hold about you.
• Request correction or updating of inaccurate, outdated, incomplete, or misleading personal data.
• Request the deletion or destruction of personal data that is no longer necessary, or that has been unlawfully processed.
• Object to the processing of all or part of your personal data, including for direct marketing purposes.
• Withdraw consent to processing at any time, where processing is based on consent.
• Request the transfer of your personal data to you or another party in a structured, commonly used, machine-readable format, where technically feasible.
• Lodge a complaint with the Office of the Data Protection Commissioner (see Section 16).

To exercise any of these rights, please contact us using the details in Section 15. We will respond to verified requests within the timeframes required by the Act.

11. Cookies and Similar Technologies

Our websites use cookies and similar technologies to operate your shopping cart, keep you signed in to your account, and understand how our Services are used. You can control or disable cookies through your browser settings; however, doing so may affect the functionality of your shopping cart, checkout, and account features.

12. Children's Privacy

Our Services are intended for use by individuals who are at least 18 years old or who otherwise have the legal capacity to enter into a binding contract in Kenya. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take steps to delete that data.

13. Third-Party Websites and Links

Our Services may contain links to third-party websites, including social media platforms and payment providers. This Policy does not apply to those third-party sites, and we encourage you to review their respective privacy policies before providing any personal data to them.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Where changes are material, we will take reasonable steps to notify you, such as posting a notice on our website or updating the "Last Updated" date above. We encourage you to review this Policy periodically.

15. How to Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us at:

Email: sales@mdt.co.ke
Phone / WhatsApp: +254 727 995 734 / +254 748 489 784
Address: Sound Plaza, 3rd Floor, Suite D6, Woodvale Grove, Westlands, Nairobi, Kenya

16. Lodging a Complaint

If you believe your personal data has been processed unlawfully or that your rights under the Act have been violated, you have the right to lodge a complaint with:

The Office of the Data Protection Commissioner (ODPC), Kenya
Website: www.odpc.go.ke  |  Email: info@odpc.go.ke

17. Registration Certificates

Micro Depth Technologies Limited is registered with the ODPC as both a Data Controller and Data Processor (ID 763-0074-11A6).

Data Controller — Serial No. 16236

Data Processor — Serial No. 16235