← Bargain Hunters

Privacy Policy

Effective date: June 2026

This Privacy Policy explains how Bargain Hunters (“we”, “us”, or “our”) collects, uses, stores, and protects your personal data when you use our website, mobile application, and WhatsApp service (collectively, the “Platform”). We are committed to complying with the Kenya Data Protection Act, 2019 (“DPA”) and applicable regulations.

1. Who We Are

Bargain Hunters is a Kenyan deal aggregation platform that collects and displays product pricing and discount information from Naivas, Quickmart, Carrefour, and Chandarana supermarkets. We operate at www.bargainhunters.co.ke.

Data Controller contact:

Name:Bargain Hunters
Email:privacy@bargainhunters.co.ke
Website:www.bargainhunters.co.ke

2. What Personal Data We Collect

2.1 Data you provide directly

  • Full name and email address (when you register an account)
  • Phone number (for WhatsApp alerts)
  • Date of birth (optional, for age verification)
  • Payment information (M-Pesa transaction reference — we do not store card numbers)

2.2 Data collected automatically

  • Pages visited, links clicked, search queries entered, and deals viewed
  • Device type, operating system, and browser
  • IP address and approximate location (city/country level)
  • Session duration and navigation path through the Platform
  • Shopping lists created and alert subscriptions configured

2.3 Data from third-party analytics

We use PostHog (PostHog Inc., EU Cloud hosted in Frankfurt, Germany) to collect behavioural analytics data including page views, clicks, and session recordings. PostHog processes data under Standard Contractual Clauses approved by the European Commission. See Section 7 for details on cross-border transfers.

3. How We Use Your Data

3.1 To provide the service

  • Creating and managing your account
  • Sending deal alerts via WhatsApp or in-app notifications based on your subscriptions
  • Generating personalised shopping lists and price comparisons
  • Processing payments for premium subscriptions

3.2 To improve the Platform

  • Understanding which product categories and retailers are most useful
  • Identifying pages or features where users experience difficulty
  • Improving search accuracy and deal recommendations

3.3 Legal compliance

  • Responding to lawful requests from the Office of the Data Protection Commissioner (ODPC) or other authorities
  • Resolving disputes and enforcing our Terms of Service

4. Legal Basis for Processing

Under Section 30 of the DPA, we process your personal data on the following lawful grounds:

Consent — for analytics tracking, marketing communications, and optional profile data. You may withdraw consent at any time.

Contractual necessity — to create your account and deliver deal alerts and shopping list features you have requested.

Legitimate interests — for fraud prevention, platform security, and aggregate analytics that do not override your rights.

Legal obligation — where Kenyan law requires us to retain or disclose data.

5. How Long We Keep Your Data

Account data
Until you delete your account, plus 90 days
Deal alert history
12 months from the date the alert was sent
Payment records
7 years (Kenya tax law requirement)
Analytics data
24 months (PostHog EU Cloud)
Session recordings
90 days (PostHog EU Cloud)

6. Who We Share Your Data With

We do not sell your personal data. We share data only with:

6.1 Service providers

  • PostHog Inc. (EU) — product analytics and session recording
  • Twilio / Meta — WhatsApp Business API for alert delivery
  • Contabo GmbH (Germany) — server hosting for our backend, database, and application
  • Payment processors — M-Pesa (Safaricom) for subscription payments

6.2 Legal disclosure

We may disclose your data if required by law, court order, or to protect the rights and safety of our users or the public.

7. Cross-Border Data Transfers

Some of the service providers listed above process data outside Kenya, primarily in Germany (EU). Under Section 48 of the DPA, we ensure that appropriate safeguards are in place before transferring personal data outside Kenya:

  • PostHog EU Cloud: covered by Standard Contractual Clauses (SCCs) between PostHog and its sub-processors, and by the EU's GDPR which provides a level of protection comparable to Kenya's DPA.
  • Contabo GmbH: our primary server is in Frankfurt, Germany, a jurisdiction with strong data protection law (GDPR).
  • Meta/Twilio: covered by their respective data processing agreements and applicable international transfer mechanisms.
Note on data localisation: Section 48(2) of the DPA requires that at least one serving copy of personal data on Kenyan residents be maintained on a server physically located in Kenya. We are working toward establishing a Kenya-based data replica and will update this policy when that is in place.

8. Your Rights Under the DPA

Under Sections 26–34 of the Kenya Data Protection Act, you have the following rights:

  1. Right to be informed — to know what data we hold about you and how we use it.
  2. Right of access — to request a copy of your personal data.
  3. Right to rectification — to correct inaccurate or incomplete data.
  4. Right to erasure — to request deletion of your data (subject to legal retention obligations).
  5. Right to restrict processing — to limit how we use your data in certain circumstances.
  6. Right to data portability — to receive your data in a structured, machine-readable format.
  7. Right to object — to object to processing based on legitimate interests.
  8. Right to withdraw consent — at any time, without affecting prior lawful processing.

To exercise any of these rights, email us at privacy@bargainhunters.co.ke. We will respond within 21 days as required by the DPA.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

9. Cookies and Tracking

Our website uses PostHog analytics which operates in cookie-free mode. We do not use advertising cookies, retargeting pixels, or third-party tracking cookies. We use a single functional session cookie to keep you logged in across pages.

You can disable JavaScript in your browser to prevent all analytics tracking. This will not affect core Platform functionality.

10. Children's Privacy

The Platform is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at privacy@bargainhunters.co.ke and we will delete it promptly.

11. Security

  • HTTPS encryption for all data in transit (TLS 1.2+)
  • Encrypted passwords (Django's PBKDF2 hashing)
  • Role-based access controls limiting who can access production data
  • Regular dependency updates and security patching

In the event of a data breach that is likely to result in risk to your rights, we will notify you and the ODPC within 72 hours of becoming aware of it, as required by Section 43 of the DPA.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email and display a prominent notice on the Platform at least 14 days before material changes take effect. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

13. Contact

For any questions about this Privacy Policy or your personal data, contact us at: privacy@bargainhunters.co.ke

Bargain Hunters | www.bargainhunters.co.ke