1. Personal Data Controller

Structrum Engineering Limited, a company registered in the Republic of Kenya (registered office at Apollo Centre, Ring Road, P.O. Box 764, 00606, Sarit Centre, Nairobi, Kenya), is the controller of your personal data.

2. Categories of Personal Data We Collect

We collect data that you provide to us voluntarily (for example, an email address) and data that we collect automatically (for example, your IP address).

2.1 Data You Give Us

Registration Information: When you register for or use the Service, we may ask you to provide information about yourself, including: first name, last name, phone number, email, gender, and date of birth (together, "Required Information"), as well as address details, working hours, and access to your photos, albums, and their metadata. An ID or similar identification document is required if you wish to post an advertisement in the Mobile Phones category, unblock your account, or make a duplicate account your primary one.

When you submit identification documents, we may use AI-powered automated tools to review and verify them, helping us assess authenticity, detect fraud or manipulation, and enforce platform safety standards.

Required vs Optional Information: Required Information is necessary to register an account and use the Service. You may still use parts of the Service without providing it, though functionality may be limited — for example, without a registered account you cannot chat with other users, post ads, or view other users' contact details.

You may also need to provide additional information when communicating with our Support Team to resolve a request — for example, confirming your identity with an ID document if your account was previously blocked.

Public Profile Information: When posting a listing on the Service, you may choose to include additional personal information, such as your CV or photos bearing personal information. By including such data in your listing, you acknowledge that you are making it publicly available. You also acknowledge and agree that we will make certain profile data public to provide the Service and facilitate communication and transactions between users. In particular, your email may be shown as part of your listing in the Seeking Work CVs section to users who have posted a listing in the Jobs section.

Car Loan Application Data: If you apply for a car loan, you will need to provide your employment type (salary earner or business owner), monthly income or salary, and Bank Verification Number (BVN). We use this data to calculate the first and subsequent monthly installment amounts.

Automated Document Review: When you upload an identification document for verification purposes — such as posting in restricted categories, account recovery, or auction access — we may use AI-powered automated tools to assess and moderate the submitted content.

These tools are provided by Google Cloud (Vertex AI/Gemini) and may process your data outside your country, subject to appropriate safeguards under Google's Data Processing Terms.

The AI system reviews image quality, content consistency, and possible manipulation to help confirm authenticity and safety. Documents are retained only as long as needed for verification or to satisfy legal requirements.

If your document is flagged or rejected by the AI system, you may request a manual review by contacting support.

2.2 Data Provided to Us by Third Parties

Social Login Services:

• Meta/Facebook: When you log in using Meta, we receive personal data from your Meta account, including your profile image, name, and Meta ID. Unless you opt out on the Meta login screen, we also collect data such as your email address, gender, date of birth, friends list, and location as listed in your Meta profile. For further detail, see the Meta Permissions Reference and the Meta Data Policy. Meta also lets you manage the choices you made when connecting your Meta profile to the App, on its Apps and Websites page.
• Google: When you log in with Google, we receive your name, email address, profile picture, and Google ID, which we use in accordance with this Privacy Policy. To learn how Google processes your data, see Google's Privacy Policy. You can remove access you have granted us via Google Permissions.
• Apple: When you log in using Apple, we receive your Apple ID, name, and email from your account. You may use the Hide My Email feature during Apple sign-in, which creates a unique, random email address that forwards our messages to your personal email. Apple lets you revoke the App's access via your Apple ID management page.

Identity Verification (Smile Identity): We may collect your name, government-issued ID number, and photo to confirm your identity, sharing this information with third-party provider Smile Identity Inc. for validation against government sources. Smile Identity Inc. may use your ID number to obtain further data from government sources, such as your full name, date of birth, image, address, phone number, gender, and ID expiry date, or other information the issuing authority associates with your ID number. Smile ID may process or store your data outside your country's borders.

During verification, Smile ID collects data estimating the location of parts of your face ("Face Data"). We do not collect or store your Face Data ourselves. Smile ID uses Face Data solely to confirm you are the person shown on the ID or document submitted, and neither we nor Smile ID use it for any other purpose. Face Data used for verification is retained by Smile ID for up to ninety (90) days after verification is complete, and is stored on Smile ID servers hosted by Amazon Web Services.

2.3 Data We Collect Automatically

• Data About How You Found Us: We collect data about your referring URL — the place on the web where you were when you clicked our ad.
• Device and Location Data: We collect data from your device, such as language settings, IP address, time zone, device type and model, device settings, operating system, internet service provider, mobile carrier, hardware ID, and Meta ID.
• Usage Data: We record how you interact with the Service — for example, the features and content you engage with, how often and how long you use the Service, which sections you visit, and how many ads you view.
• Advertising IDs: We collect your Apple Identifier for Advertising ("IDFA") or Google Advertising ID ("AAID"), depending on your device's operating system. You can typically reset these through your device settings, though we do not control this process.
• Transaction Data: When you make payments through the Service, you provide financial account data, such as your credit card number, to our third-party service providers. We do not collect or store full credit card numbers, though we may receive related data such as the date, time, and amount of a transaction, and the payment method used.
• Cookies and Similar Technologies: We use cookies and similar technologies, such as ETags, to enhance your experience, improve the Service's functionality, optimize content delivery, and strengthen security by preventing fraud and detecting suspicious activity. See our Cookies Policy for further detail.
• Phone Number Data: With your permission, we may access your phone number directly from your device, solely to verify it when you register or log in. We do not use this data for any other purpose and do not share it with third parties except as needed to complete verification. Granting this permission is optional; if declined, you may need to enter your phone number manually.

3. Data Protection Principles

In handling personal data, we aim in particular to ensure that it is:

• Processed for a specific, legitimate, and lawful purpose to which you have consented;
• Adequate, accurate, and processed without prejudice to human dignity;
• Stored only for as long as reasonably necessary; and
• Protected against reasonably foreseeable hazards and breaches, including theft, cyberattack, viral attack, unauthorized dissemination, manipulation of any kind, and damage from rain, fire, or other natural elements.

4. Purposes for Which We Process Your Personal Data

We process your personal data for the following purposes:

Service Delivery & Core Functions:

• 4.1. To provide our Service — enabling seamless use of the Service and preventing or resolving errors or technical issues.
• 4.2. To enable secure access to the Service — verifying your identity and enabling secure access.
• 4.11. To process your payments — we offer paid products and services within the Service and use third-party payment processors for this purpose, enabling you to pay and access paid features.

Personalization & Communication:

• 4.3. To customize your experience — adjusting Service content and tailoring offers to your preferences and interests.
• 4.4. To manage your account and provide customer support — responding to requests for technical support, Service information, or other communications you initiate, including accessing your account to resolve support requests, and sending notifications or emails about Service performance, security, payment transactions, or updates to our Terms of Use or this Privacy Policy.
• 4.5. To communicate with you about your use of our Service — for example, via push notifications or chat, such as notifying you of a new message on Mybizmtaani. You can opt out of push notifications through your browser or device settings, and out of certain emails via the unsubscribe link in the email footer, by contacting support@mybizmtaani.co.ke, or through your profile settings. The tools we use for this may record when a message was viewed and how you interacted with it, such as by clicking included links.

Analysis & Improvement:

• 4.6. To research and analyze your use of the Service — helping us understand our business, analyze operations, and maintain, improve, innovate, plan, design, and develop Mybizmtaani and new products, including through statistical analysis to test and improve our offers. This helps us understand which features and sections users prefer and which user groups use the Service, informing how we improve it — for example, focusing on the Jobs section if we find it less popular than others.

Marketing & Advertising:

• 4.7. To send you marketing communications: We may add your email address to our marketing list to send information about our products, such as special offers and partner products. You can unsubscribe via the instructions in marketing email footers, by contacting support@mybizmtaani.co.ke, or through your profile settings. We may also display advertisements on the Website and send marketing push notifications, which you can opt out of via your device or browser settings.
• 4.8. To personalize our ads: We and our partners use your personal data to tailor ads and show them at relevant times, for example on Meta, if you've visited our Website. We may target advertising across various ad networks and exchanges using data from technologies such as cookies, pixels, device identifiers, geolocation, operating system information, and email.

Security & Legal Compliance:

• 4.9. To enforce our Terms of Use and prevent and combat fraud — including through automated tools and AI-based technologies. This may involve sharing your information with others, including law enforcement, particularly in connection with a dispute arising from our Terms of Use.
• 4.10. To comply with legal obligations — we may process, use, or share your data where the law requires it, including in response to lawful requests from law enforcement.

5. Legal Bases for Processing Your Personal Data

We process your personal data on the following legal bases, in particular:

• 5.1. Your consent — this is the basis on which we use cookies, as described in our Cookies Policy.
• 5.2. Performance of our contract with you.
• 5.3. Our (or others') legitimate interests. Under this basis, we, in particular:
  • Communicate with you about your use of our Service;
  • Research and analyze your use of the Service;
  • Send you marketing communications;
  • Personalize our ads; and
  • Enforce our Terms of Use and prevent and combat fraud.
• 5.4. Compliance with legal obligations.

6. With Whom We Share Your Personal Data

We share information with third parties who help us operate, provide, improve, integrate, customize, support, and market the Service. The categories include:

6.1 Service Providers

• Cloud storage providers: Amazon, DigitalOcean, Hetzner
• Data analytics providers: Facebook, Google, Appsflyer
• Login service providers: Google, Apple, Facebook, Truecaller
• Marketing partners: Social media networks (Facebook, Google), Marketing agencies, Email delivery services
• Payment services providers: Flutterwave, Safaricom (M-Pesa), Local banks and other financial institutions (Access Bank, Sterling Bank, Union Bank, Sovereign Finance, Purple Money, QuickCheck, RenMoney, and others)
• Moderation tools: Generative AI on Vertex AI

6.2 Law Enforcement Agencies and Other Public Authorities

We may disclose personal data to enforce our Terms of Use, protect our rights, privacy, safety, or property, and respond to requests from courts, law enforcement, regulators, and other government authorities.

6.3 Third Parties in a Merger or Acquisition

Customer information is typically among transferred assets in corporate transactions such as a sale, divestiture, merger, consolidation, asset sale, or bankruptcy.

7. Escrow Services and Data Sharing

7.1 Personal Data Shared: If you use the escrow service, we share certain personal data with the licensed third-party escrow provider (the "Escrow Provider" or "Escrow Agent") solely to enable that service, including: full name, contact details, item/service details, payment and transaction details, shipping information, and government-issued ID/verification documents.

7.2 Purpose of Data Sharing: To verify identity in compliance with AML/fraud laws, enable secure holding/release of funds, ensure regulatory compliance, and process/manage your escrow transaction.

7.3 Legal Basis for Processing: Based on legitimate interest in enabling secure escrow services, compliance with legal/regulatory obligations (AML/fraud prevention), and consent where required by law.

7.4 Facilitator Role and Independent Controller Status: Mybizmtaani acts solely as a facilitator connecting you with the Escrow Provider. We do not provide escrow services ourselves nor hold funds. The Escrow Provider is an independent data controller responsible for its own processing activities.

7.5 Your Data Protection Rights: You retain your rights under the Kenya Data Protection Act. Requests concerning data held by Mybizmtaani should be directed to us; inquiries about data processed by the Escrow Provider should go to them.

7.6 Data Retention and Security: Retained only as long as necessary to complete the escrow transaction, meet legal requirements, and resolve disputes, protected by appropriate security measures.

8. Available Remedies

If a data breach poses a risk to individuals' rights and freedoms, we will notify the competent supervisory authority where notification is mandatory. Where we assess the risk as "high," we will also notify affected data subjects without undue delay.

If concerns remain unresolved, you have the right to lodge a complaint with a competent supervisory authority or seek redress in a court of competent jurisdiction.

9. No Limitation Clause

No limitation of liability applies if we act in breach of the principles set out in Section 3.

10. How You Can Exercise Your Privacy Rights

• Accessing, reviewing, updating, or correcting: Edit your data in account settings or request a copy of collected personal data.
• Deleting your personal data: Email support@mybizmtaani.co.ke or delete your account via the relevant link.
• Objecting to or restricting use: Ask us to stop using or limit our use of all or some personal data (including direct marketing & AI processing).
• Lodge a complaint: Contact us directly or lodge a complaint with a competent supervisory authority.
• Objecting to automated decision-making: Request a human review if your account is flagged/blocked by automated tools.

To exercise any rights, email support@mybizmtaani.co.ke.

11. Age Limitation

We do not knowingly process personal data from anyone under 18 years of age. If you become aware that someone younger than 18 has provided us with personal data, please contact us at support@mybizmtaani.co.ke.

12. International Data Transfers

We may transfer personal data to countries other than where it was collected. Where such countries lack equivalent data protection laws, we apply appropriate safeguards (such as Standard Contractual Clauses approved by the European Commission or adequacy decisions).

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Service. Continuing to access or use the Service after changes take effect constitutes agreement to the revised Privacy Policy.

14. Data Retention

We retain personal data as long as reasonably necessary to fulfill the purposes described, comply with legal obligations, resolve disputes, and enforce agreements. Following a deletion request, we retain a hashed version of your email address and phone number, identification documents, and a record that your account was blocked.

15. Contact Us

For questions about this Privacy Policy, your account, or personal data, contact us at:

Email: support@mybizmtaani.co.ke

Address: Structrum Engineering Limited, Apollo Centre, Ring Road, P.O. Box 764, 00606, Sarit Centre, Nairobi, Kenya.