Privacy Policy

2.2.1 Data You Provide Directly

When you create an account or contact us, we may collect your full name; email address; mobile phone number; username and password (stored in hashed form); and any other information you choose to provide.

2.2.2 Behavioural and Interaction Data

We automatically collect data about how you use the Platform, including search queries entered; products viewed, saved, or compared; outbound clicks to seller websites; time spent on pages; scroll depth and interaction patterns; and referral sources.

2.2.3 Technical Data

We collect technical identifiers automatically when you access the Platform, including IP address; device type, model, and operating system; browser type and version; session identifiers and timestamps; and cookie data as further described in our Cookie Policy.

2.2.4 Commercial Attribution Data

Where Compea operates under affiliate or referral arrangements, we collect outbound click data, attribution signals, and conversion indicators sufficient to validate referral commissions.

We process your personal data for the following purposes:

• Operating, maintaining, and improving the Platform and its features;
• Generating comparison outputs, rankings, and personalised recommendations;
• Tracking attribution and validating affiliate commissions;
• Detecting and preventing fraud, abuse, and unauthorised access;
• Communicating with you regarding your account, queries, or platform updates;
• Complying with our legal obligations under Kenyan and applicable law;
• Conducting anonymised analytics to understand usage trends; and
• Supporting marketing communications where you have given your consent.

We do not sell your personal data. We may share your data with analytics and performance monitoring providers (currently Google Analytics and Metricool, described in our Cookie Policy); infrastructure and cloud hosting providers; affiliate and commission tracking networks; fraud detection and cybersecurity service providers; and regulatory authorities, law enforcement agencies, and courts where we are legally required to do so. All third-party processors are required to implement appropriate technical and organisational security measures and to process data only on our documented instructions.

We retain personal data only for as long as necessary for the purposes for which it was collected. Account data is retained for the duration of your account and for up to three (3) years following account closure to support fraud investigation and regulatory compliance. Behavioural and attribution data may be retained in anonymised or pseudonymised form for analytical purposes beyond this period.

Under the Kenya Data Protection Act 2019, you have the following rights in respect of your personal data: the right to access a copy of the personal data we hold about you; the right to rectification of inaccurate or incomplete data; the right to erasure of your personal data in certain circumstances; the right to object to processing based on legitimate interests; the right to data portability in a structured, machine-readable format; the right to withdraw consent where processing is based on consent; and the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). To exercise any of the above rights, please contact us at info@compea.co.ke. We will respond within thirty (30) days of receiving a verifiable request.

We implement appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, and destruction. These measures include encrypted data transmission (TLS), hashed password storage, role-based access controls, and regular security reviews. No method of electronic transmission or storage is entirely secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ODPC and, where required, affected individuals in accordance with applicable law.

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or regulatory requirements. When we make a material change to this Policy, we will notify you by one or more of the following means: by displaying a prominent notice on the Platform; by sending an email to the address associated with your registered account; or by updating the effective date and version number shown at the top of this document. Your continued use of the Platform after the updated Policy has come into effect constitutes your acceptance of the changes. We encourage you to review this Policy periodically. If you do not agree with any changes, you should cease using the Platform and, where applicable, delete your account.

The Platform is not directed at or intended for use by individuals under the age of eighteen (18). Compea Ltd does not knowingly collect, process, or retain personal data from anyone under the age of eighteen. As stated in the Terms and Conditions, use of the Platform constitutes a representation and warranty by the user that they are at least eighteen years of age. If we become aware that personal data has been collected from a user who is under eighteen, we will take immediate steps to delete that data and terminate the relevant account. If you have reason to believe that a minor has provided personal data to us, please contact us at info@compea.co.ke so that we can take appropriate action.