More Classifieds Agency Ltd is the data controller for personal data processed through trade.more.co.ke. We are registered with the Office of the Data Protection Commissioner (ODPC) under number INST-379494498D2 and process personal data in line with the Data Protection Act 2019 and the Data Protection (General) Regulations 2021.
Data we collect
- Category
- Identity and contact
- Examples
- Name, job title, email, phone, business address
- Source
- You, at registration
- Category
- Business and verification
- Examples
- Company name, registration number, KRA PIN, trade licences, director ID or passport copies
- Source
- You, during verification
- Category
- Listings and communications
- Examples
- Product details, images, enquiries, messages between Users
- Source
- You and other Users
- Category
- Payment
- Examples
- M-Pesa number, transaction codes, billing address, last 4 card digits (full card data is held by our payment processor, not us)
- Source
- You and payment partners
- Category
- Technical
- Examples
- IP address, device, browser, pages visited, log files, cookies
- Source
- Your device, automatically
- Category
- Trade preferences
- Examples
- Sectors, target markets, products of interest
- Source
- You, and your use of the Portal
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, job title, email, phone, business address | You, at registration |
| Business and verification | Company name, registration number, KRA PIN, trade licences, director ID or passport copies | You, during verification |
| Listings and communications | Product details, images, enquiries, messages between Users | You and other Users |
| Payment | M-Pesa number, transaction codes, billing address, last 4 card digits (full card data is held by our payment processor, not us) | You and payment partners |
| Technical | IP address, device, browser, pages visited, log files, cookies | Your device, automatically |
| Trade preferences | Sectors, target markets, products of interest | You, and your use of the Portal |
We do not intentionally collect sensitive personal data, such as health or religious data. Do not upload it to the Portal.
Why we use your data and our lawful basis
- Purpose
- Creating and running your account, displaying listings, connecting buyers and sellers
- Lawful basis (DPA 2019, s. 30)
- Performance of a contract
- Purpose
- Verifying businesses and preventing fraud, money laundering and sanctions breaches
- Lawful basis (DPA 2019, s. 30)
- Legal obligation and legitimate interest
- Purpose
- Processing payments and issuing eTIMS tax invoices
- Lawful basis (DPA 2019, s. 30)
- Contract and legal obligation
- Purpose
- Security, troubleshooting and improving the Portal
- Lawful basis (DPA 2019, s. 30)
- Legitimate interest
- Purpose
- Sending trade alerts, newsletters and event invitations
- Lawful basis (DPA 2019, s. 30)
- Consent (you can withdraw any time)
- Purpose
- Complying with lawful requests from courts, KRA, DCI or regulators
- Lawful basis (DPA 2019, s. 30)
- Legal obligation
| Purpose | Lawful basis (DPA 2019, s. 30) |
|---|---|
| Creating and running your account, displaying listings, connecting buyers and sellers | Performance of a contract |
| Verifying businesses and preventing fraud, money laundering and sanctions breaches | Legal obligation and legitimate interest |
| Processing payments and issuing eTIMS tax invoices | Contract and legal obligation |
| Security, troubleshooting and improving the Portal | Legitimate interest |
| Sending trade alerts, newsletters and event invitations | Consent (you can withdraw any time) |
| Complying with lawful requests from courts, KRA, DCI or regulators | Legal obligation |
International transfers
The Portal serves cross-border trade, so data may be transferred outside Kenya, including to Users and service providers in other countries. We transfer data only where sections 48 to 50 of the Data Protection Act 2019 are met: appropriate safeguards are in place, the destination offers adequate protection, or you have consented. Users in the EU, UK, Hong Kong or other jurisdictions may also have rights under their local laws, and we will honour those where they apply.
How long we keep data
- Account data: while your account is active, then up to 24 months after closure.
- Payment and tax records: 7 years, as required by the Tax Procedures Act 2015.
- Verification and anti-fraud records: 7 years after the relationship ends, in line with anti-money-laundering rules.
- Marketing consent records: until withdrawn, plus 12 months.
We then delete or anonymise the data.
Your rights
Under the Data Protection Act 2019 you have the right to:
- be informed of how your data is used;
- access your personal data;
- correct false or misleading data;
- delete false, misleading or unlawfully held data;
- object to processing, including direct marketing;
- data portability, in a structured and machine-readable format;
- not be subject to decisions based solely on automated processing that significantly affect you.
To exercise a right, email our Data Protection Officer at willice@more.co.ke. We will respond within 7 days where possible, and within the time set by the Regulations in every case. If you are unhappy with our response, you may complain to the ODPC at www.odpc.go.ke.
Security
We use encryption in transit (HTTPS/TLS), access controls, staff confidentiality agreements and regular backups. No system is fully secure. If a breach is likely to harm you, we will notify the ODPC within 72 hours and inform you without undue delay, as section 43 of the Act requires.
Children
The Portal is for businesses and adults. We do not knowingly collect data from anyone under 18.
Contact
Data Protection Officer: Mr. Willice Ochieng Onyango, More Classifieds Agency Ltd, 204 Brickwood Apartments, Lantana Road, Westlands, Nairobi, Kenya. Email: willice@more.co.ke.