1. Who looks after your data
EABD is operated by TECHenya Solutions in Nairobi, Kenya, which is the data controller for everything collected on the platform. Suppliers who process data on our behalf act as data processors. You can reach our Data Protection Officer at [email protected].
We follow the Kenya Data Protection Act 2019, the Uganda Data Protection and Privacy Act 2019, the Tanzania Personal Data Protection Act 2022 and the Rwanda Law on the Protection of Personal Data and Privacy 2021. Where they apply, we also follow the equivalent rules in Burundi, South Sudan, Somalia and DR Congo.
2. What we collect
2.1 When you create an account
- Your name and email address, which are required. We send a link to confirm the email address before the account can be used.
- Your phone number, which is optional unless you want SMS notifications.
- Your country and approximate location, which we use to show relevant results.
- A salted hash of your password. We never store passwords in plain text.
- If you choose to sign in with Google, the name, email address and profile picture Google shares with us.
2.2 When you list a business
- Business name, description, addresses, registration and VAT numbers, website and social profiles.
- Photos, logos, videos and portfolio items you upload.
- Names and titles of decision makers you choose to publish. We keep their email addresses private and never publish them.
- Verification documents, such as a registration certificate or utility bill. These are stored encrypted, only our verification team can see them, and we delete them within 90 days of verification.
2.3 When you use the platform
- Your searches, so that we can improve results. We anonymise them after 90 days.
- The listings you view, click, save and contact, for analytics and recommendations.
- The reviews and messages you write.
- Reports of suspicious activity you send us, which we keep confidential.
- Device and browser details, IP address and country, for security, fraud prevention and language settings.
2.4 When you use EABD Sourcing
- What you ask for or offer: request details, item lines, budgets, deadlines, attachments, quotes and the messages that follow.
- We remove phone numbers, email addresses and links from request and quote text, so that buyers and suppliers stay inside EABD until a buyer chooses to share their details.
- Suppliers see a buyer's industry and town, its EABD plan and the year it joined EABD, and how many of its past requests it awarded to a supplier, but not the buyer's name or contacts, until the buyer shares them with that supplier.
- Which suppliers were invited, opened a request, quoted or were chosen, which we use for ranking, insights and fees.
2.5 When email outreach reaches you
- Businesses on paid plans can send campaigns to the business email addresses published on EABD listings. We hold those addresses, and the sending business does not see them unless you reply.
- For each campaign email we record whether it was delivered, opened or clicked, whether you replied, and whether you unsubscribed or complained.
- When you unsubscribe or complain, we add your address to our suppression list. Every campaign is checked against that list before it is sent.
2.6 When you pay
- The plan or item you chose and its price.
- The transaction ID, the last four digits of the payment card or account, and the payment provider's response code.
- The details we need for invoices, receipts and our accounts.
- We never see your full card number or your M-Pesa PIN. The payment providers handle those and only send us a confirmation.
2.6.1 When you use an EABD Wallet
- Your business's details: its registered name, registration number, tax PIN or ID, country, address, phone, the person who acts for it, and the accounts it will send deposits from. Our team uses them to check the business once, and to pay unspent money back only to an account in its name.
- For each deposit, what our team saw on our bank statement or in the payment provider's portal: the amount, the bank's reference, the date, and the name and account it came from.
- Every movement in and out of the wallet, which of our staff checked and approved it, and the browser and network a wallet action came from (to spot misuse).
- Business details, payer details and staff notes are stored encrypted. The one-time codes we email are never stored, only a sealed fingerprint of each that cannot be turned back into the code.
- Where the law requires it, for example to prevent money laundering, we may share wallet records with regulators or law enforcement.
2.7 Cookies and similar technologies
We use as few cookies as we can. There is a session cookie for signing in, a security token for forms, a cookie that remembers your country, and a security cookie that recognises a browser you have signed in on, so that someone guessing your password cannot lock you out of your account. We use Cloudflare Turnstile to stop bots, which checks your browser without tracking you across other sites. We do not use Google Analytics, the Facebook Pixel or any cross-site advertising network.
3. Why we collect it
Each kind of data has a specific purpose and a legal basis.
- To run the service, including accounts, listings, Sourcing and payments. The legal basis is the contract between us.
- To verify businesses by checking registrations and addresses. The legal basis is our legitimate interest in a trustworthy platform, together with your consent when you upload the documents.
- To prevent fraud and abuse through IP logs, rate limits and checks on how the AI features are used. The legal basis is our legitimate interest, and in some cases a legal obligation.
- To send service emails such as receipts, claim checks and new message alerts. The legal basis is the contract between us.
- To send business outreach, meaning campaigns from EABD or from businesses on paid plans to the business contacts published on listings. The legal basis is the legitimate interest of businesses in reaching other businesses about relevant products and services. Every email names the sender and carries an unsubscribe link that works in one click.
- To send EABD news to personal accounts, only if you have agreed to it. The legal basis is your consent, which you can withdraw at any time.
- To provide AI features such as AI search, the assistant and profile summaries. The legal basis is our legitimate interest in helping you find businesses, and the contract when you use a feature you asked for.
- To comply with the law, for example tax records and court orders. The legal basis is a legal obligation.
4. Who we share it with
We share data with as few suppliers as possible, and each one is bound by contract to use it only as we instruct.
- Payment providers, namely Safaricom M-Pesa, Pesapal and PayPal, when you pay.
- Hosting and infrastructure, meaning our managed hosting provider and Cloudflare for content delivery and bot protection.
- AI providers. We send search text and, for some features, the public parts of listings to OpenAI to produce answers. We do not attach your name or account, and OpenAI does not use data sent through its API to train its models.
- Email delivery providers, which send our service emails and campaigns. We never sell or hand over mailing lists.
- Analytics. We run our analytics on our own servers, with no third-party analytics scripts.
- Other users, when you choose. Your public listing and reviews are visible to everyone. In Sourcing, a supplier only sees a buyer's name and contacts after the buyer shares them, and a buyer sees the suppliers who quote.
We do not sell personal data, we do not share it with advertising networks, and we do not let third parties put trackers on our pages.
5. International transfers
Some of our processors, including OpenAI, Cloudflare and our hosting provider, run servers outside East Africa. These transfers are covered by standard contractual clauses or equivalent safeguards. If you would rather we kept your data only in Kenya, write to us. We can set up a region-restricted account on most paid plans.
6. How long we keep it
- Account data for as long as your account exists, then 30 days in case you change your mind.
- Listings you publish until you archive or delete them.
- Verification documents for 90 days after a successful check, then deleted.
- Messages between users until you delete them or the conversation.
- Sourcing requests and quotes for as long as the buyer's and supplier's accounts exist, so both sides keep a record of what was offered.
- Payment records for 7 years, as Kenyan tax law requires.
- EABD Wallet records and business checks for 7 years after the wallet closes, for our accounts and anti-money-laundering duties.
- Logs of staff actions for 180 days, then removed by a daily clean-up.
- Analytics events for 90 days, then removed.
- AI search queries for 90 days, then anonymised.
- Rate limit and bot detection records for 24 hours, then removed.
- The suppression list for as long as we send email, because it is how we make sure you are never emailed again after you opt out.
7. Your rights
The data protection laws of Kenya, Uganda, Tanzania, Rwanda and the rest of the region give you rights over your personal data. EABD honours all of them, whichever country you are in. Write to [email protected] and we will respond within the legal deadline, which is 30 days under the Kenya Data Protection Act and similar elsewhere.
- Access. Get a copy of everything we hold about you.
- Correction. Fix anything that is wrong.
- Erasure. Ask us to delete it. We delete or anonymise it within 30 days, apart from the records the law makes us keep.
- Restriction. Ask us to pause using your data while a dispute is settled.
- Portability. Get your data in a structured, machine-readable format.
- Objection. Tell us to stop using your data for a particular purpose, including business outreach.
- Opting out of emails. Click the unsubscribe link in any campaign or marketing email, or write to us, and we will add you to the suppression list.
- Withdrawing consent. Take back any consent you gave us, at any time.
8. Complaints
If you are unhappy with how we handled your data or with our reply, you can complain to the data protection authority in your country.
- Kenya: Office of the Data Protection Commissioner (ODPC), odpc.go.ke
- Uganda: Personal Data Protection Office (PDPO), pdpo.go.ug
- Tanzania: Personal Data Protection Commission
- Rwanda: National Cyber Security Authority (NCSA) Data Protection Office
9. Security
We protect your data with industry standard controls. Data is encrypted in transit with TLS, and credentials and verification documents are also encrypted at rest. Staff access is based on roles, and we log every administrative action. Rate limits and bot protection run at the edge, and daily backups are encrypted and stored in a separate region. If a breach affects your data, we tell you within 72 hours of confirming it, and we tell the data protection authority where the law requires.
10. Children
EABD is not meant for children, and we do not knowingly collect data from anyone under 18. If you learn that a minor has created an account, write to us and we will delete it.
11. Changes to this policy
We may update this policy as the platform and the law change. For important changes, we email account holders at least 14 days before they take effect. The "last reviewed" date at the top of this page shows when the current version started to apply.
12. Contact
For anything in this policy, or to use any of the rights above, write to our Data Protection Officer at [email protected]. A person reads every message and logs it in our compliance system. You will get an acknowledgement within one business day and a full reply within 30 days.
