Choose a county to see shops that deliver there

Privacy Policy

Last updated: 25 September 2026

This Privacy Policy explains how GiftSasa, operated by [Your registered business name], Kenya ("GiftSasa", "we", "us"), collects and uses your personal data when you use giftsasa.com. We process personal data in line with Kenya's Data Protection Act, 2019.

1. What we collect

  • Account details: your name, username, email address, phone number and password (stored in encrypted form).
  • Delivery details: recipient names, recipient phone numbers, delivery addresses, towns and counties.
  • Order details: what you order, customization notes, gift card messages, delivery dates and order history.
  • Payment details: your M-Pesa phone number, payment amounts and M-Pesa receipt numbers. We do not see or store your M-Pesa PIN.
  • Messages and photos: chat messages and images you exchange with Shops.
  • Shop details (for Vendors): shop name, location, phone number, products and payout information.
  • Technical data: basic information such as IP address and browser type, collected in server logs for security.

2. How we use your data

  • To create and manage your account.
  • To process orders and payments and arrange delivery.
  • To let Customers and Shops communicate about orders.
  • To provide customer support and resolve disputes.
  • To prevent fraud and keep the platform secure.
  • To meet legal, tax and accounting obligations.

We process your data because it is necessary to provide the service you request (performance of a contract), to meet legal obligations, and for our legitimate interest in keeping GiftSasa safe. We will ask for your consent before sending marketing messages, and you can withdraw consent at any time.

3. Who we share it with

  • Shops: when you order, the Shop receives the details it needs to prepare and deliver your gift: recipient name and phone number, delivery address, order details, customization notes and your chat messages.
  • Payment provider: Safaricom (M-Pesa) processes payments.
  • Service providers: our hosting provider (Hetzner Online GmbH) and our domain and email provider (Cloudflare), who process data only on our instructions.
  • Authorities: where required by Kenyan law.

We do not sell your personal data.

4. Where your data is stored

Our servers are located in the European Union (Finland). The EU provides strong data protection standards, and we apply appropriate safeguards to protect data transferred outside Kenya, as required by the Data Protection Act.

5. How long we keep it

We keep account data while your account is active. Order and payment records are kept for up to 7 years to meet tax and accounting requirements. Chat messages are kept for as long as needed to support orders and resolve disputes. When data is no longer needed, we delete or anonymise it.

6. How we protect it

We use encrypted connections (HTTPS), encrypted password storage, access controls and regular backups. No system is completely secure, but we work to protect your data and will notify you and the Office of the Data Protection Commissioner of any serious breach as required by law.

7. Cookies

We use essential cookies only: to keep you logged in, remember your cart and chosen county, and protect forms against misuse. We do not use advertising cookies.

8. Your rights

Under the Data Protection Act, you have the right to:

  • be informed about how your data is used;
  • access the personal data we hold about you;
  • correct inaccurate data;
  • ask us to delete your data, where we are not required to keep it;
  • object to or restrict certain processing; and
  • withdraw consent where processing is based on consent.

To exercise these rights, email hello@giftsasa.com. We will respond within the time required by law. You can update most account details yourself on your profile page.

9. Children

GiftSasa is not intended for anyone under 18. We do not knowingly collect data from children.

10. Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), Kenya, at www.odpc.go.ke.

11. Changes to this policy

We may update this policy. The date at the top shows the latest version.

12. Contact us

Email: hello@giftsasa.com