Privacy Policy

When you create an account, place an order, or contact us, we collect information you voluntarily provide. This includes: • Full name and username • Email address and phone number • Delivery address (hostel name, room number, or campus location) • Payment details (processed securely — we do not store raw card data) • Profile photo (optional) • Messages and communications you send to our support team

When you use LitMall, certain data is collected automatically through your device and browser: • IP address and approximate location • Device type, operating system, and browser version • Pages visited, products viewed, and time spent on the platform • Referring URLs (how you arrived at LitMall) • Cookies and similar tracking technologies (see Section 7)

Every time you place an order, we record transaction data including: • Items purchased, quantities, and prices • Order timestamps and delivery confirmations • Payment method type (e.g., M-Pesa, card) — not full payment credentials • Any special delivery instructions you provide

We use your personal information to: • Process and fulfil your orders accurately and on time • Send order confirmations, delivery updates, and receipts • Verify your identity and maintain account security • Provide customer support and resolve disputes

We analyse aggregated and anonymised data to: • Understand which products and categories are most useful to students • Improve website performance, navigation, and the overall shopping experience • Fix bugs, test new features, and optimise delivery logistics

We may contact you to: • Send important account and order notifications (these are non-optional) • Share promotional offers, new arrivals, or student deals — only if you have opted in • Request feedback or reviews after a completed order • Notify you of changes to our policies or platform

We use data to detect and prevent fraud, unauthorised access, and abuse of the platform. We may also process your data to comply with applicable Kenyan laws and regulations.

LitMall processes your personal data on the following legal grounds: • Contract Performance: Processing is necessary to fulfil your order and provide the services you've requested. • Legal Obligation: We may process data where required to comply with applicable Kenyan law, including the Kenya Data Protection Act, 2019.

LitMall does not sell, rent, or trade your personal information to any third party for their own marketing purposes. Full stop.

We share limited data with trusted third-party service providers who help us operate LitMall, including: • Payment processors (paystack) — to handle transactions securely • Cloud hosting providers — to store and serve platform data reliably All service providers are bound by data processing agreements and are only permitted to use your data for the specific purpose for which it was shared.

We may disclose your information if required to do so by law, court order, or government authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of LitMall, our users, or the public.

In the unlikely event of a merger, acquisition, or sale of LitMall's assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our platform before your data becomes subject to a different privacy policy.

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy: • Account data: Retained for as long as your account is active. If you delete your account, we will delete or anonymise your data within 30 days, except where retention is required by law. • Order records: Retained for a minimum of 7 years for accounting and legal compliance purposes, in line with Kenyan tax regulations. • Support communications: Retained for up to 2 years after your last interaction. • Marketing data: Retained until you withdraw consent or unsubscribe. • Usage and analytics data: Retained in anonymised or aggregated form indefinitely. When your data is no longer needed, we securely delete or anonymise it so it can no longer be associated with you.

Cookies are small text files stored on your device when you visit a website. They help us recognise your browser, remember your preferences, and understand how you use LitMall.

• Essential Cookies: Required for core functionality such as keeping you logged in and maintaining your cart. These cannot be disabled. • Preference Cookies: Remember your settings such as language preferences and delivery address defaults. • Analytics Cookies: Help us understand how users navigate LitMall so we can improve the experience. Data is aggregated and anonymised. • Marketing Cookies: Used only if you have opted in to receive personalised promotions.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the platform. You can also opt out of marketing cookies by updating your preferences in your account settings.

Under the Kenya Data Protection Act, 2019, and applicable privacy principles, you have the following rights regarding your personal data: • Right to Access: You may request a copy of the personal data we hold about you at any time. • Right to Rectification: If your data is inaccurate or incomplete, you have the right to have it corrected. • Right to Erasure: You may request that we delete your personal data where it is no longer necessary for the purposes it was collected, subject to legal retention obligations. • Right to Restrict Processing: You may ask us to pause processing your data in certain circumstances, for example while we verify a correction request. • Right to Data Portability: You may request your data in a structured, commonly used, and machine-readable format. • Right to Object: You may object to processing based on our legitimate interests or for direct marketing purposes. • Right to Withdraw Consent: Where processing is based on consent (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of prior processing. To exercise any of these rights, please contact us at privacy@litmall.co.ke. We will respond within 30 days of receiving your request.

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your information against unauthorised access, loss, misuse, or disclosure. These measures include: • HTTPS encryption across the entire LitMall platform • Secure storage of passwords using industry-standard hashing algorithms • Strict access controls limiting who within our team can access personal data • Regular security reviews of our platform and infrastructure • Secure, tokenised payment processing — we never store raw card numbers While we take every reasonable precaution, no system is completely immune to risk. In the event of a data breach that is likely to result in harm to you, we will notify affected users and the relevant Kenyan authorities in accordance with legal requirements.

LitMall is intended for use by individuals who are at least 18 years of age, or who are at least 16 years old with the supervision and consent of a parent or guardian. We do not knowingly collect personal data from children under the age of 16. If we become aware that we have inadvertently collected such data, we will take immediate steps to delete it. If you believe a child under 16 has provided us with personal information, please contact us at privacy@litmall.co.ke.

LitMall may contain links to third-party websites, payment gateways, or social media platforms. This Privacy Policy applies only to LitMall. We are not responsible for the privacy practices of external sites and encourage you to review their respective privacy policies before submitting any personal information to them.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will: • Update the "Last Updated" date at the top of this page • Notify you via email (if you have an account with us) • Display a prominent notice on the LitMall platform Your continued use of LitMall after the effective date of any update constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please reach out to us: LitMall Data Privacy Email: frankgladyswairegi@gmail.com Phone: +254 707 913 754 Address: LitMall Nakuru, Kenya We aim to respond to all privacy-related enquiries within 30 days.