Privacy Policy
Effective date: [Insert date of publication] Last updated: 2026-08-23
This Privacy Policy explains how Outering Tours and Safaris Ltd (Company Number PVT-DLUL56M8), trading as "Stolink" ("we", "us") collects, uses, shares, and protects personal data through the Stolink platform (the "Platform"), in accordance with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 of Kenya.
We are the "data controller" for the personal data described below. Our data protection contact is [Data Protection Officer / Contact Person name and email — required if processing at scale under the DPA].
1. Who this policy applies to
- Customers — people who register a Platform account.
- Contacts — people we hold records for but who have not registered: (a) Kaisa Traders' pre-existing customer records, imported so the business can re-engage past buyers, and (b) people named as a purchase Beneficiary on someone else's referral Order.
- Visitors — anyone browsing the public catalogue without an account.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, phone number, password (stored as a salted hash, never in plain text), Google profile info if you use Google sign-in | You, directly |
| Order data | Device selected, financing option, deposit amount you report having available (deposit_at_hand), Beneficiary details, order status history | You, directly |
| Referral data | Your referral code, who referred you (parent_id), referral link click/attribution data stored via cookie or browser local storage for 30 days | You, and automatically on link click |
| Commission data | Earned/Approved/Paid commission records, payout requests, payout method details you provide (e.g. M-Pesa number, bank details) | You and our systems |
| Legacy contact data | Name, phone number, historical purchase records held by Kaisa Traders before the Platform existed | Kaisa Traders' pre-existing records (imported by us) |
| Communications data | SMS delivery status (pending/sent/delivered/failed), campaign engagement | Our SMS provider, Africa's Talking |
| Technical data | IP address, device/browser type, cookies, local storage identifiers | Automatically, when you use the Platform |
We do not collect payment card numbers or M-Pesa PINs directly — those are handled by the relevant payment channel or Financing Partner, not stored by us.
3. Why we collect it, and our legal basis
| Purpose | Legal basis under the Data Protection Act, 2019 |
|---|---|
| Creating and managing your account | Performance of a contract (Platform Terms of Service) |
| Processing Orders, linking you to legacy purchase history | Performance of a contract / legitimate interest in accurate service delivery |
| Referral tracking and Commission calculation/payout | Performance of a contract (Referral Program Terms) |
| Sending promotional SMS (and future WhatsApp) messages | Consent (see SMS Marketing Consent Policy), or legitimate interest for existing customer relationships where permitted, always with an opt-out |
| Fraud prevention (e.g. detecting fake referrals) | Legitimate interest |
| Complying with tax, consumer protection, or law enforcement obligations | Legal obligation |
4. Legacy contacts — why you may be in our system without signing up
If you've previously bought from Kaisa Traders, your name, phone number, and purchase history may already be in our system as an imported "Contact" record, even if you've never used the Platform. We do this to re-engage past customers with relevant offers. You have the same rights over this data as a registered Customer (see §8), including the right to object to further contact — reply STOP to any SMS, or contact us at stolinkapp@gmail.com, and we will honour the opt-out and, on request, delete or anonymize your Contact record where we are not otherwise required to keep it (e.g. for tax records of a completed sale).
5. Who we share data with
We share personal data only as needed to operate the Platform:
- Supabase (database, authentication) — our infrastructure provider, hosted at [confirm Supabase project region] and acting as our data processor.
- Cloudflare — hosting and content delivery for the Platform.
- Africa's Talking — our SMS gateway, used to deliver promotional and (if applicable) transactional SMS. Only the phone number and message content needed for delivery are shared.
- Google — if you sign in with Google, Google processes your authentication under its own privacy policy; we only receive the profile fields needed to create your account.
- Financing Partners (M-KOPA, Watu Simu, Onfon Mobile, MOGO Kenya) — for loan-financed Orders, we share the information needed for that partner to assess and onboard the Beneficiary (e.g. name, phone, deposit information). Once shared, the Financing Partner processes that data under its own privacy policy, independently of us.
- Kaisa Traders — as the retail business the Platform serves, for order fulfilment and reporting.
- Legal/regulatory bodies — where required by Kenyan law (e.g. KRA, courts, ODPC).
We do not sell personal data to third parties.
6. International data transfers
Some of our service providers (e.g. cloud infrastructure, Google) may process data outside Kenya. Where we transfer personal data outside Kenya, we do so only where the Data Protection Act, 2019 permits — including where the recipient country has adequate data protection safeguards, or under an appropriate contractual safeguard with the provider.
7. Data retention
We keep personal data for as long as needed for the purposes above, including:
- Account and order data: for the life of your account plus any period required for tax/accounting records (generally 7 years under Kenyan tax law).
- Referral/commission data: for the life of your account plus the statutory record-keeping period.
- Legacy contact data: until you opt out or request deletion, or it is no longer relevant to campaign targeting.
- Cookie/local-storage referral attribution: 30 days, then automatically expires.
8. Your rights
Under the Data Protection Act, 2019, you have the right to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request deletion or anonymization of your data, subject to our legal retention obligations;
- object to processing, including direct marketing;
- request a copy of your data in a portable format;
- lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, if you believe we have mishandled your data.
To exercise any of these rights, contact us at stolinkapp@gmail.com. We will respond within the timeframe required by the Data Protection (General) Regulations, 2021.
9. Security
We use industry-standard safeguards (Row Level Security on our database, encrypted connections, hashed passwords) to protect your data. No system is completely secure; if you suspect unauthorized access to your account, contact us immediately at stolinkapp@gmail.com.
10. Children
The Platform is not directed at, and we do not knowingly collect data from, anyone under 18. If we learn a Contact or Customer record belongs to a minor, we will take steps to delete it.
11. Cookies and local storage
We use cookies/local storage strictly necessary for the Platform to function, notably to remember a referral code (ref parameter) for 30 days so the correct Referral Partner is credited if you sign up. We do not currently use third-party advertising or analytics cookies.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified via the Platform or by email before they take effect.
13. Contact us
Data protection queries: [Data Protection Officer / Contact Person] · stolinkapp@gmail.com · P.O. Box 11068 G.P.O, Nairobi (Amani House, Outering Road, Pipeline, Embakasi)
You may also lodge a complaint with the Office of the Data Protection Commissioner, Kenya (odpc.go.ke).