Busivra Privacy Policy

Busivra is a digital commerce platform that provides businesses with tools to establish an online presence, manage products and services, communicate with customers, receive orders, process or facilitate payments through third-party providers, and access other business capabilities.

Busivra may process information relating to:

• Merchants and their account users;
• Customers who interact with merchant storefronts;
• Orders and transactions;
• Products and services;
• Customer communications;
• Payment-related information;
• Website and platform usage; and
• Technical and security information.

Depending on how you use Busivra, we may collect the following categories of information.

When a merchant creates an account, we may collect:

• Business name;
• Business contact information;
• Phone number;
• Email address;
• Business address or location;
• Business category or type;
• Account credentials;
• Subscription and billing information;
• Storefront configuration;
• Business logo and images; and
• Other information provided during account setup.

Merchants may provide:

• Product names;
• Product descriptions;
• Prices;
• Product images;
• Categories;
• Product specifications;
• Stock or availability information;
• Discounts and promotional information;
• Business hours;
• Fulfilment options; and
• Other information displayed through their storefront.

When customers interact with a merchant through Busivra, information may be collected or provided by the customer or merchant, including:

• Name;
• Phone number;
• Email address;
• Delivery or pickup information;
• Order information;
• Products purchased or requested;
• Customer enquiries;
• Communication history;
• Preferences provided by the customer; and
• Other information necessary to process or support a transaction.

The merchant is responsible for ensuring that information it collects from its customers is collected and used lawfully.

Busivra may integrate with third-party payment providers such as M-Pesa, Paystack, banks, or other payment services.

Where payment is processed by a third-party provider, Busivra may receive limited information necessary to identify or reconcile the transaction, such as:

• Transaction reference;
• Payment status;
• Amount;
• Currency;
• Date and time of payment;
• Merchant account information; and
• Other transaction information provided by the payment provider.

Busivra does not intend to store customers' full card numbers, card security codes, or other sensitive payment credentials where such information is processed directly by the relevant payment provider.

Payment providers may collect and process payment information under their own privacy policies and terms.

When you use Busivra, we may automatically collect technical information such as:

• IP address;
• Browser type;
• Device type;
• Operating system;
• Log information;
• Pages or features accessed;
• Approximate usage times;
• Error and diagnostic information; and
• Security-related information.

We use this information to operate, secure, maintain, and improve Busivra.

We may use information for purposes including:

To:

• Create and maintain merchant accounts;
• Operate merchant storefronts;
• Display products and business information;
• Process and manage orders;
• Facilitate customer communication;
• Provide payment integrations;
• Provide customer support;
• Manage subscriptions and billing; and
• Provide other Busivra capabilities.

We may use information to:

• Understand how features are used;
• Identify technical problems;
• Improve usability;
• Develop new capabilities;
• Improve platform performance; and
• Test and maintain the service.

Where practical and appropriate, information used for analytics and product improvement may be aggregated or de-identified.

We may process information to:

• Detect suspicious activity;
• Prevent fraud and abuse;
• Protect accounts;
• Investigate security incidents;
• Maintain system integrity; and
• Enforce our Terms of Service.

We may use contact information to send:

• Account notifications;
• Security alerts;
• Subscription and payment reminders;
• Service-related announcements;
• Support communications;
• Important changes to the service; and
• Other communications necessary to provide the service.

Where required by applicable law, we will obtain appropriate consent for marketing communications.

Busivra processes personal information on lawful grounds applicable under Kenyan data-protection law.

Depending on the circumstances, processing may be necessary for:

• Providing a service requested by the individual or merchant;
• Performing a contractual obligation;
• Complying with a legal or regulatory obligation;
• Protecting legitimate business or security interests;
• Detecting and preventing fraud or abuse;
• Responding to requests or exercising legal rights; or
• Obtaining consent where consent is required.

Where processing relies on consent, the individual may withdraw that consent subject to applicable legal requirements and circumstances.

Withdrawal of consent does not necessarily affect processing that was lawful before the withdrawal.

Busivra may process information on behalf of merchants when providing services such as storefronts, order management, customer management, and communication tools.

In these circumstances, the merchant may determine the purposes for which certain customer information is collected and used.

Merchants are responsible for:

• Providing appropriate privacy notices to their customers;
• Collecting information lawfully;
• Using customer information only for lawful purposes;
• Responding to customer requests where applicable;
• Keeping customer information accurate where required; and
• Complying with applicable data-protection requirements.

Busivra may process such information as necessary to provide the contracted service and fulfil our obligations to the merchant.

Depending on the specific processing activity, Busivra may act as a data controller, data processor, or in another legally applicable role.

Busivra does not sell personal information to third parties.

We may share or disclose information where reasonably necessary to operate Busivra, including with:

We may use third-party providers for services such as:

• Cloud hosting;
• Database infrastructure;
• Image and file storage;
• Payment processing;
• Messaging and communication;
• Email delivery;
• Analytics;
• Security;
• AI services;
• Technical monitoring; and
• Customer support.

These providers may process information on our behalf or as independent service providers according to their own terms and applicable agreements.

We may disclose information where reasonably necessary to:

• Comply with applicable law;
• Respond to lawful requests from authorities;
• Protect the rights or safety of Busivra, merchants, customers, or others;
• Investigate fraud or security incidents; or
• Establish, exercise, or defend legal claims.

If Busivra is involved in a merger, acquisition, restructuring, financing, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable legal requirements.

Busivra may use artificial-intelligence services to provide features such as:

• Product description assistance;
• Product tagging;
• Category suggestions;
• Product information enrichment;
• Marketing assistance;
• Customer communication assistance; and
• Other AI-assisted business capabilities.

Where information is sent to an AI service, we aim to limit the information provided to what is reasonably necessary for the relevant function.

AI-generated information may contain errors or inaccuracies.

Merchants remain responsible for reviewing and approving AI-generated business or product information before publishing or relying on it where Busivra provides a review-and-approval workflow.

Busivra will not intentionally use customer personal information to train general-purpose AI models unless permitted by applicable law and our applicable agreements or otherwise disclosed to the relevant users.

Where merchants connect WhatsApp or another communication service to Busivra, Busivra may process messages and related information necessary to provide the requested functionality.

The use of third-party communication platforms is also governed by the privacy policies and terms of those platforms.

Merchants are responsible for using communication functionality lawfully and for obtaining any consent required for marketing or other communications.

Busivra may use cookies or similar technologies to:

• Keep users signed in;
• Maintain security;
• Remember preferences;
• Support platform functionality;
• Understand platform usage; and
• Improve the service.

You may be able to control cookies through your browser or device settings. Disabling certain cookies may affect the operation of some Busivra features.

Busivra takes reasonable technical and organisational measures designed to protect personal information against:

• Unauthorised access;
• Loss;
• Destruction;
• Alteration;
• Disclosure; and
• Other unlawful processing.

These measures may include access controls, authentication, encryption where appropriate, secure infrastructure, monitoring, and other security practices.

However, no internet service can guarantee absolute security.

You are responsible for maintaining the security of your account credentials and devices.

Busivra retains information for as long as reasonably necessary for the purposes for which it was collected, including:

• Providing the service;
• Maintaining business and customer records;
• Meeting legal or regulatory obligations;
• Resolving disputes;
• Preventing fraud;
• Maintaining security;
• Enforcing agreements; and
• Maintaining appropriate backups.

When information is no longer reasonably required, Busivra may delete, anonymise, or otherwise securely dispose of it, subject to applicable legal and legitimate retention requirements.

Busivra may use service providers or infrastructure located outside Kenya.

Where personal information is transferred outside Kenya, Busivra will take reasonable steps to ensure that the transfer and processing are carried out in accordance with applicable Kenyan data-protection requirements.

Subject to applicable law, individuals may have rights relating to their personal information, including the right to:

• Be informed about the use of their personal information;
• Request access to personal information;
• Request correction of inaccurate information;
• Request deletion where legally applicable;
• Object to certain processing;
• Request restriction of processing in applicable circumstances;
• Withdraw consent where processing is based on consent;
• Request information about how their personal information is processed; and
• Exercise other rights provided under applicable law.

Requests may be submitted using the contact details provided in this Privacy Policy.

We may need to verify your identity before responding to certain requests.

Where Busivra processes information on behalf of a merchant, we may direct the request to the relevant merchant where appropriate.

Busivra is intended for businesses and users who are legally capable of using the service.

Merchants must not knowingly use Busivra to unlawfully collect personal information from children.

If you believe that Busivra has collected personal information from a child in circumstances where it should not have, please contact us so that we can investigate and take appropriate action.

Busivra may contain links to or integrations with third-party websites and services.

Busivra does not control the privacy practices of those third parties.

Your use of third-party services is subject to their own terms and privacy policies.

We encourage you to review those policies before providing personal information to third-party services.

Busivra may send service-related communications necessary to operate your account.

Where required by law, we will obtain consent before sending promotional or marketing communications.

You may unsubscribe from marketing communications using the available unsubscribe mechanism or by contacting us.

You may continue to receive important transactional or service-related communications even after opting out of marketing communications.

Information that a merchant chooses to publish through a Busivra storefront may become publicly accessible.

Merchants should not publish sensitive personal information that is not necessary for operating their business.

Busivra is not responsible for personal information that a merchant intentionally publishes publicly through its storefront.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or privacy practices.

Where material changes are made, we may notify users through email, the Busivra dashboard, the website, or another reasonable method.

The updated Privacy Policy will become effective on the date stated in the updated version.

Your continued use of Busivra after the effective date of an updated Privacy Policy constitutes acknowledgement of the updated policy, to the extent permitted by applicable law.