Privacy Policy

1. Introduction

Bewama Investments ("Bewama", "we", "us") is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights under the Kenya Data Protection Act, 2019 (DPA 2019).

By using our website (bewama.com) or placing an order, you agree to this Policy. If you do not agree, please do not use our services.

2. Data We Collect

We collect personal data that you provide to us directly and data generated through your use of the platform:

• Account information: full name, email address, phone number, company name, and role.
• Order & quote data: products requested, quantities, delivery addresses, and special instructions.
• Payment data: payment method and transaction references. We do not store full card numbers or mobile money PINs.
• Usage data: pages visited, search queries, cart contents, browser type, IP address, and device identifiers.
• Communications: messages or enquiries you send us via quote forms or email.

3. How We Use Your Data

We process your personal data for the following purposes:

• To create and manage your account.
• To process and fulfil orders and quote requests.
• To send order confirmations, shipping updates, and customer support communications.
• To send marketing communications where you have given consent (you may opt out at any time).
• To improve our platform, detect fraud, and ensure security.
• To comply with our legal and regulatory obligations in Kenya.

4. How We Share Your Data

We do not sell your personal data. We share it only with:

• Supabase Inc.: our database and authentication infrastructure provider. Data is stored on secure servers.
• Payment processors (e.g. Rotsi / M-Pesa, PayPal): solely to process your transactions.
• Logistics partners (e.g. Pickup Mtaani): only the name, phone, and delivery address needed to complete your order.
• Email / SMS providers (Resend, Africa's Talking): to deliver transactional notifications.
• Law enforcement or regulators when required by law or court order.

All third-party processors are contractually bound to process your data only on our instructions and in compliance with applicable law.

5. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords, row-level security on our database, and access controls. Despite these measures, no system is completely secure. Please notify us immediately at info@bewama.com if you suspect unauthorised access to your account.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Specifically:

• Account data: retained until you request deletion, plus a 30-day grace period.
• Order & financial records: retained for 7 years to comply with Kenyan tax law (Income Tax Act, Cap. 470).
• Marketing consent records: retained for 3 years after the last interaction.

7. Cookies

We use essential cookies to keep you signed in and remember your cart. We do not use third-party advertising cookies. You can disable cookies in your browser settings, but some features may not work correctly.

8. Your Rights under the Kenya DPA 2019

As a data subject, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten") of your data, subject to legal retention obligations.
• Object to processing for direct marketing purposes at any time.
• Data portability — receive your data in a structured, machine-readable format.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

To exercise any of these rights, contact us at info@bewama.com. We will respond within 21 days as required by the DPA 2019.

9. Children's Privacy

Our platform is not intended for individuals under 18. We do not knowingly collect data from minors. If you believe a minor has submitted data to us, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Policy from time to time. We will notify registered users by email of material changes. The "Effective date" at the top of this page indicates when the Policy was last revised.

11. Contact Us

For any privacy-related questions or requests: