Privacy Policy

Version 18 October 2026 · Applies to everyone who uses onrizo.com

What personal data Onrizo collects when you buy, sell or promote, why, and the choices you have.

Contents

Who is responsible
What we collect
Why we use it
Who we share it with
How long we keep it
Cookies and local storage
Security
Your rights
Children
Changes and contact

Onrizo respects your privacy and handles personal data in line with the Kenya Data Protection Act, 2019. This policy explains what we collect and why.

1. Who is responsible

Onrizo Shop is the data controller for the personal data described here. Contact: support@onrizo.com, +254 115 900 068.

2. What we collect

Who	Data
Buyers	Name, email, phone number, delivery location and map pin (coordinates and address), the items ordered, order and tracking history, any dispute messages and evidence you send us, and your M-Pesa payment details (the paying phone number, amount and M-Pesa receipt number). We never see or store your M-Pesa PIN.
Sellers	Name, email, phone, county and sub-county, username and a securely hashed password, listings and sales, withdrawal requests and payout details, and the date you accepted our terms.
Affiliates	Registration details, referral links and clicks, and commission and payout records.
Everyone	Technical data such as IP address, browser and device type, pages visited, and session cookies; your email address if you subscribe to our newsletter; and messages you send to support.

3. Why we use it

To perform your order or account: take payment, hold it in escrow, pass your delivery details to the seller, track the order, release or refund the payment and handle disputes.
Legal obligations: record-keeping, tax, and responding to lawful requests.
Legitimate interests: preventing fraud and abuse, securing the platform, improving the service, and customer support.
Consent: newsletters and marketing, which you can withdraw at any time.

We record the version of our Terms you accepted and when, as proof of the agreement.

4. Who we share it with

Sellers receive the buyer’s name, phone number and delivery details for orders they must fulfil, and nothing more than needed.
Safaricom (M-Pesa / Daraja) processes your mobile-money payment.
Service providers that host our website and send our emails, under confidentiality and security commitments.
Affiliates see only that a referred sale happened and the commission earned, not the buyer’s identity.
Authorities where the law requires it or to protect against fraud or harm.

We do not sell your personal data. If data is processed outside Kenya (for example by an email or hosting provider), we take steps to make sure it is protected as the Data Protection Act requires.

5. How long we keep it

We keep order and payment records for as long as needed for the purposes above and to meet legal, tax and dispute-handling needs (generally up to seven years for financial records). Account data is kept while your account is open and for a reasonable period afterwards. Newsletter data is kept until you unsubscribe.

6. Cookies and local storage

We use essential cookies to keep sellers and affiliates logged in securely, and your browser’s local storage to remember your cart, your recent orders on this device, and an affiliate referral so the right affiliate is credited. You can clear these in your browser settings; parts of the site may then stop working as expected.

7. Security

We use measures such as encrypted connections, hashed passwords, access controls and per-payment secrets to confirm payment notifications. No system is perfectly secure; if a breach affects you we will notify you and the Office of the Data Protection Commissioner as the law requires.

8. Your rights

Under the Data Protection Act you may ask to access your data, correct it, object to or restrict some processing, withdraw consent, request deletion where we no longer need it, and receive a copy of your data. Email support@onrizo.com with your tracking code or account email. We may need to keep some records to meet legal duties or to resolve a dispute. If you are unhappy with our response you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).

9. Children

Onrizo is not intended for people under 18 and we do not knowingly collect their data. Contact us if you think a child has given us personal data.

10. Changes and contact

We may update this policy and will change the version date at the top. Questions: support@onrizo.com. See also our Terms & Conditions.