Omniflow Group Ltd

Privacy Policy

Version 1.0 Effective: April 2026 Last Updated: April 2026

This Privacy Policy explains how Omniflow Group Ltd. collects, uses, stores, shares, and protects your personal information when you use the Omniflow Platform. We comply with the Data Protection Act, 2019 of Kenya.

1. Introduction

Omniflow Group Ltd. ("Omniflow", "we", "us", or "our") operates the Omniflow marketplace platform, accessible via our website and mobile application (the "Platform"). This Privacy Policy describes how we handle personal data collected from users of the Platform, including buyers, sellers, and visitors.

1.1 Data Controller

Omniflow Group Ltd. is the data controller responsible for your personal data. We are registered in Kenya under registration number BN-L3SD8Y27, with our registered address at Nairobi, Kenya, 00100.

1.2 Regulatory Compliance

We comply with the Data Protection Act, 2019 of Kenya (the "Act"), and where applicable, the General Data Protection Regulation (GDPR) of the European Union. We are committed to processing your personal data lawfully, fairly, and transparently.

1.3 Consent

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal data as described herein.

2. Information We Collect

2.1 Personal Information You Provide

We collect information that you voluntarily provide to us, including:

Identity Information: Full name, National ID or Passport number, date of birth, KRA PIN certificate, business registration details, profile photograph
Contact Information: Email address, phone number, physical address, delivery address, billing address
Financial Information: M-Pesa number, bank account details, tokenized payment card information, transaction history, wallet balance
Transaction Information: Order details, product listings, messages with buyers/sellers, dispute records, reviews and ratings

2.2 Information Automatically Collected

Device Information: Device type, operating system, browser type, unique device identifiers
Log Data: IP address, access times, pages viewed, and referring URLs
Location Data: Approximate geographic location based on IP address (for fraud prevention and delivery zone determination)
Usage Data: Features used, search queries, and interactions with the Platform

2.3 Information from Third Parties

Authentication data from Google OAuth if you sign in with Google
Payment confirmation data from M-Pesa, PayPal, and banking partners
Identity verification data from KRA and credit reference bureaus
Fraud detection data from security service providers

3. How We Collect Information

3.1 Direct Collection

When you create an account or register as a seller
When you place or fulfill an order
When you communicate with other users through the Platform
When you contact customer support
When you participate in surveys or promotions
When you leave reviews or ratings

3.2 Automatic Collection

Through cookies and similar tracking technologies
Through server logs and analytics tools
Through mobile application permissions
Through web beacons and pixel tags

3.3 Third-Party Sources

Identity verification services
Payment processors
Fraud prevention agencies
Business partners and affiliates

4. How We Use Your Information

4.1 Primary Purposes

Provide Services: Facilitate transactions, process orders, and manage your account
Verify Identity: Authenticate users and verify seller eligibility
Process Payments: Handle escrow, wallet operations, and withdrawals
Facilitate Delivery: Share necessary details with riders and logistics partners
Prevent Fraud: Detect and prevent fraudulent activity and abuse
Customer Support: Respond to inquiries and resolve disputes

4.2 Legal Basis for Processing

Contract Performance: To fulfill our obligations under the Merchant Agreement and Terms of Service
Legal Compliance: To comply with the Data Protection Act, 2019, tax laws, and other applicable regulations
Legitimate Interests: To improve our services, prevent fraud, and ensure platform security
Consent: For marketing communications and optional features where you have provided consent

5. How We Share Your Information

5.1 We Do Not Sell Your Data

Omniflow does not sell, rent, or trade your personal information to third parties for their marketing purposes.

5.2 When We Share

Recipient	Purpose	Data Shared
Buyers/Sellers	Order fulfillment	Name, delivery address, phone
Delivery Partners	Delivery services	Name, address, phone, order details
Payment Processors	Payment processing	Payment details, transaction amount
KRA	Tax compliance	Transaction data, tax identification
Law Enforcement	Legal obligations	As required by law
Service Providers	Platform operations	As necessary for services

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change.

6. Cookies and Tracking Technologies

6.1 What Are Cookies

Cookies are small text files stored on your device when you visit the Platform. They help us provide a better experience and understand how you use our services.

6.2 Types of Cookies We Use

Type	Purpose	Duration
Essential	Authentication, security, session management	Session
Functional	Remember preferences, language settings	1 year
Analytics	Understand usage patterns, improve services	2 years
Marketing	Relevant advertisements, campaign measurement	1 year

6.3 Managing Cookies

You can control cookies through your browser settings. However, disabling essential cookies may affect the functionality of the Platform.

7. Data Security

7.1 Security Measures

We implement appropriate technical and organizational measures to protect your data:

Encryption: All data transmitted via TLS/SSL encryption
Access Controls: Role-based access with multi-factor authentication
Data Minimization: We only collect data necessary for specified purposes
Regular Audits: Security assessments and vulnerability testing
Employee Training: Regular data protection training for staff
Incident Response: Documented procedures for data breach response

7.2 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and affected individuals within 72 hours of becoming aware of the breach, in accordance with the Act.

8. Your Rights

8.1 Your Data Protection Rights

Under the Data Protection Act, 2019, you have the following rights:

Right to Access: Request a copy of the personal data we hold about you
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure: Request deletion of your data under certain circumstances
Right to Restrict: Request restriction of processing in certain cases
Right to Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests

8.2 How to Exercise Your Rights

To exercise any of these rights, please contact us at dpo@omniflowapp.co.ke. We will respond to your request within 30 days.

8.3 Right to Lodge a Complaint

You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been violated.

9. Data Retention

9.1 Retention Periods

Data Type	Retention Period	Reason
Account Information	Active account + 7 years	Tax and legal compliance
Transaction Records	7 years	Financial regulations
Communication Logs	3 years	Dispute resolution
Marketing Preferences	Until withdrawn	Consent-based
Analytics Data	2 years (anonymized)	Service improvement

9.2 Deletion

When retention periods expire, we securely delete or anonymize your data. You may request early deletion by contacting us, subject to legal retention requirements.

10. Children's Privacy

The Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete such information promptly.

If you believe a child has provided us with personal information, please contact us at dpo@omniflowapp.co.ke.

11. International Data Transfers

11.1 Data Location

Your personal data is primarily stored and processed in Kenya. We use secure cloud infrastructure with data centers that may be located outside Kenya.

11.2 Transfer Safeguards

When we transfer data outside Kenya, we ensure appropriate safeguards are in place:

Standard contractual clauses approved by the ODPC
Adequacy decisions where applicable
Explicit consent where required
Binding corporate rules for intra-group transfers

12. Changes to This Policy

12.1 Notification of Changes

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

Posting the updated policy on the Platform
Sending an email notification to registered users
Displaying a prominent notice within the Platform

12.2 Continued Use

Your continued use of the Platform after changes take effect constitutes acceptance of the updated Privacy Policy.

Contact Information

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Company Name: Omniflow Group Ltd

Registration Number: BN-L3SD8Y27

Physical Address: Nairobi, Kenya, 00100

Phone Number: +254 745 456 476

General Email: privacy@omniflowapp.co.ke

Data Protection Officer: dpo@omniflowapp.co.ke

Website: omniflowapp.co.ke

You also have the right to contact the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.