Privacy Policy

This Privacy Policy explains how SureDeals ("SureDeals", "we", "us", "our") collects, uses, shares, and protects personal data when you use suredeals.org and its associated apps (the "Service"). We are the data controller for the personal data described here.

We aim to meet the standards of Kenya's Data Protection Act, 2019, and its regulations, and, as good practice, to follow data protection principles consistent with the EU General Data Protection Regulation (GDPR) — data minimisation, purpose limitation, transparency, and giving you meaningful control over your data.

The Service currently only serves customers in Kenya, and this policy is written with that in mind. If we expand to other countries, we will update this policy accordingly.

We collect the following categories of personal data:

• Identity and account data: first, middle, and last name, date of birth, and a securely hashed password.
• Contact data: email address, recovery email address, and phone number (used for parcel-delivery contact).
• Verification data: email or code-based verification records used to confirm you control an email address or business.
• Transaction evidence: proof-of-payment images or pasted transaction text you upload (for example M-Pesa or Airtel Money confirmations), and the data we extract from them (amount, time, merchant name) to verify and award tokens.
• Redemption and delivery data: shipping name, phone number, address, county, and delivery instructions when you redeem tokens for merchandise or experiences.
• Merchant/business data: if you register or claim a business, the business details, goods/services, and verification documents you submit.
• Social and usage data: reviews and flags you submit, mutual friend connections, membership/cohort enrolment, usage badges, loyalty point and token balances, and approximate location (latitude/longitude) where you provide or enable it.
• Technical and analytics data: basic usage analytics collected via our analytics provider, and session cookies used to keep you signed in.

• To perform our contract with you — creating and managing your account, verifying uploads, awarding tokens, processing redemptions and deliveries, and operating merchant listings.
• Legitimate interests — preventing fraud and abuse (for example, detecting fake or duplicated proof-of-payment uploads), keeping the Service secure, and improving it through aggregated usage analytics.
• Legal obligation — record-keeping, responding to lawful requests from Kenyan authorities, and complying with consumer protection and data protection law.
• Consent — where we ask for it specifically, such as optional location sharing or marketing communications, which you can withdraw at any time.

When you upload proof of payment, we use automated tools (including optical character recognition) to extract details and cross-check them before tokens are awarded. This can result in an automated rejection or hold on an upload. You can edit and resubmit an upload, or contact us to request a human review of an automated decision you believe is wrong.

We do not sell your personal data. We share it only where necessary, with:

• Cloud infrastructure and processing providers (such as Microsoft Azure, for storage, database, and document/OCR processing, and our analytics provider) acting on our instructions and under contractual confidentiality obligations;
• Couriers, bus companies, and pickup partners, given only the shipping name, phone number, and address needed to deliver a redemption;
• Merchants, where necessary to fulfil a redemption, review, or appointment tied to their business; and
• Regulators, law enforcement, or courts, where required by Kenyan law or to protect our rights, users, or the public against fraud or harm.

Our merchant customer-insights (data subscription) add-on is aggregated statistics only. It does not give a merchant any customer's name, contact details, or other personal data — only figures such as other merchants' names, categories, and combined customer counts and spend, and only once at least five distinct customers contribute to a given figure.

Some of our service providers process or store data outside Kenya. Where this happens, we take steps to ensure the data is protected to a standard consistent with Kenyan and GDPR-aligned requirements, such as contractual safeguards with our providers.

We keep personal data for as long as your account is active, and afterwards for as long as needed to resolve disputes, prevent fraud, meet legal or tax obligations, or enforce these terms — after which we delete or anonymise it.

We use technical and organisational measures to protect your data, including hashed passwords, access controls on our systems, and encryption in transit. No system is completely secure, and we encourage you to use a strong, unique password and keep your login details confidential.

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, or restrict or object to certain processing;
• request a copy of your data in a portable format;
• withdraw consent at any time where we rely on consent; and
• lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC), or another supervisory authority with jurisdiction, if you believe we have mishandled your data.

To exercise any of these rights, contact us using the details in Section 14 below.

The Service is intended for adults (18 years and older, or the age of legal majority in Kenya) and is not directed at children. We do not knowingly collect personal data from children.

We use essential cookies to keep you signed in and to keep the Service secure, and privacy-conscious analytics to understand aggregate usage of the Service. We do not use these to build advertising profiles about you.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above, and for material changes we will make reasonable efforts to notify you in-app or by email.

For any question about this Privacy Policy or to exercise your data protection rights, contact us at suredealslimited@gmail.com.