hendza Privacy Policy

1. Introduction

Welcome to Hendza ("we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at Hendza (the "Site"). Please read this policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Site.

We are committed to complying with the Kenya Data Protection Act, 2019, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA).

2. Information We Collect

We collect information that you provide directly to us and information that is collected automatically when you use our Site.

2.1 Information You Provide to Us

Since Hendza does not require user sign ups or accounts, the personal information we collect is limited to:

• Contact Information: Your email address and any other information you voluntarily provide when contacting us for support.
• Payment Information: When you make purchases (one time or recurring), payment details are processed directly by our third party payment processors (PayPal and MPesa). We do not store your full payment card details or MPesa PIN on our servers.

2.2 Information Collected Automatically

When you access or use our Site, we automatically collect certain information, including:

• Device and Usage Data: IP address, browser type, operating system, device identifiers, pages viewed, time spent on pages, referring URLs, and other diagnostic data.
• Location Data: With your consent, we may collect precise or approximate geolocation data derived from your IP address or device settings to provide localized services (e.g., nearby places, currency conversion defaults).
• Cookies and Tracking Technologies: See our Cookie Policy for detailed information.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve our tools and services;
• To process transactions and send related information (receipts, confirmations);
• To respond to your inquiries and provide customer support via email;
• To personalize your experience and deliver localized content;
• To serve relevant advertisements through Google AdSense and measure ad performance;
• To analyze usage patterns and improve Site functionality using Google Analytics;
• To detect, prevent, and address technical issues, fraud, or security concerns;
• To comply with legal obligations and enforce our Terms and Conditions.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for collecting and using your personal information depends on the specific context:

• Consent: Where you have given clear consent (e.g., cookie preferences, location access).
• Contract: Where processing is necessary for the performance of a contract (e.g., processing payments).
• Legitimate Interests: Where processing is necessary for our legitimate interests, provided those interests are not overridden by your rights (e.g., analytics, fraud prevention).
• Legal Obligation: Where we are required to comply with a legal obligation.

5. How We Share Your Information

We do not sell your personal information. However, we may share your information with third parties in the following circumstances:

5.1 Service Providers

We may share your information with third-party vendors and service providers who perform services on our behalf, including:

• Google Analytics: For website traffic analysis and user behavior insights. Google Privacy Policy
• Google AdSense: For serving personalized and non-personalized advertisements. Google AdSense Policies
• PayPal: For processing one-time and recurring payments. PayPal Privacy Statement
• M-Pesa (Safaricom): For mobile money payment processing in Kenya. Safaricom Privacy Policy
• Hosting and Cloud Providers: For data storage and Site infrastructure.

5.2 Advertising Partners

We use Google AdSense to display ads. These partners may use cookies and similar technologies to collect information about your visits to this and other websites to provide targeted advertisements. You can opt out of personalized advertising by visiting Google Ad Settings or About Ads.

5.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency), including under the Kenya Data Protection Act, 2019.

5.4 Business Transfers

If we are involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your personal information is transferred and becomes subject to a different Privacy Policy.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Site and hold certain information. For detailed information about the cookies we use, your choices, and how to manage them, please see our Cookie Policy.

7. Data Retention

We retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you (e.g., active subscription);
• Whether there is a legal obligation to which we are subject (e.g., tax and accounting records);
• Whether retention is advisable considering our legal position (e.g., applicable statutes of limitations, litigation, or regulatory investigations).

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

9. International Data Transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those in your jurisdiction. Specifically, data may be transferred to servers operated by Google (United States), PayPal (United States), and other international service providers.

If you are located outside Kenya and choose to provide information to us, please note that we transfer the data to Kenya and process it there. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

For EEA and UK users, we ensure appropriate safeguards are in place for international transfers, including reliance on Standard Contractual Clauses (SCCs) where required.

10. Your Privacy Rights

10.1 Rights Under the Kenya Data Protection Act, 2019

As a data subject under Kenyan law, you have the right to:

• Be informed of the use to which your personal data is being put;
• Access your personal data in our custody or under our control;
• Object to the processing of all or part of your personal data;
• Correction of false or misleading personal data;
• Deletion of false or misleading personal data;
• File a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been violated.

10.2 GDPR Rights (EEA and UK Users)

To exercise any of these rights, please contact us using the details in Section 13. We will respond within 30 days as required by GDPR.

10.3 CCPA/CPRA Rights (California Residents)

If you are a California resident, you have the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: While we do not "sell" personal information in the traditional sense, certain uses of cookies and pixels for advertising may constitute "sharing" under CPRA. You can opt out via the "Do Not Sell or Share My Personal Information" link on our Site.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of sensitive personal information (e.g., precise geolocation data).
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California privacy rights, please contact us at contact@hendza.coo.ke You may also designate an authorized agent to make a request on your behalf.

11. Children's Privacy

Our Site is not intended for children under the age of 13 (or 16 in the EEA). We do not knowingly collect personally identifiable information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from children without verification of parental consent, we take steps to remove that information from our servers.

12. Third-Party Links

Our Site may contain links to third party websites and services that are not owned or controlled by Hendza. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services. We strongly advise you to review the privacy policy of every site you visit.

13. Contact Us

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.