How Manabu Quest collects, uses, and protects your personal data

Effective Date: 2 April 2025

Last Updated: 2 April 2025

Prepared by: Legal Compliance Team, Manabu Quest International Limited

1. Introduction

Manabu Quest International Limited (“Manabu Quest”, “we”, “us”, or “our”) is committed to protecting the personal data of all individuals who interact with our Platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the Data Protection Act, 2019 of Kenya (“DPA”) and any regulations made thereunder.

As a registered data controller under the DPA, Manabu Quest processes personal data lawfully, fairly, and transparently. This Policy applies to all customers, registered account holders, guest checkout users, business clients, and visitors to www.manabuquest.com.

By using the Platform, you consent to the collection and use of your personal data as described in this Privacy Policy. You have the right to withdraw consent at any time, subject to legal or contractual obligations.

2. Data Controller Information

3. Personal Data We Collect

3.1 Data You Provide Directly

We collect the following categories of personal data that you provide to us:

• Identity Data: full name, business name (for B2B customers);
• Contact Data: email address, phone number;
• Delivery Data: physical delivery address;
• Payment and Financial Data: mobile money details, bank transfer information, masked card details;
• Institutional Data: school or organisation name and address (for institutional/B2B orders);
• Account Data: username, password (stored in encrypted form), purchase history.

3.2 Data Collected Automatically

When you access the Platform, we automatically collect:

• Device and Technical Data: IP address, browser type and version, operating system;
• Usage Data: pages visited, time spent, referring URLs, click patterns;
• Cookie and Tracking Data: session cookies, preference cookies, and analytics data (see our Cookies Policy for full details).

4. Legal Basis for Processing

Under the Data Protection Act, 2019, Manabu Quest processes your personal data on the following lawful bases:

Consent: processing for marketing communications and non-essential cookies, which you may withdraw at any time.

Contractual Necessity: processing required to fulfil your order, manage your account, and arrange delivery;

Legal Obligation: processing required to comply with tax, financial reporting, and other statutory obligations under Kenyan law;

Legitimate Interests: processing for fraud prevention, platform security, and business analytics, where such interests are not overridden by your rights;

5. How We Use Your Personal Data

We use your personal data for the following purposes:

• To process and fulfil your orders, including delivery coordination;
• To manage your account and provide customer support;
• To process payments and prevent fraudulent transactions;
• To send order confirmations, delivery updates, and transactional communications;
• To send marketing communications where you have consented to receive them;
• To comply with our legal and regulatory obligations under Kenyan law;
• To improve our Platform, products, and services through analytics;
• To respond to disputes, complaints, and legal claims.

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

We may share your personal data with trusted third-party service providers who assist us in operating our business, subject to strict data processing agreements:

• Courier and logistics partners (including but not limited to Sendy, G4S, and DHL) for order delivery;
• Payment processors for the secure processing of M-Pesa, card, and bank transfer transactions;
• Cloud hosting and IT infrastructure providers;
• Analytics and marketing platform providers.

6.2 International Data Transfers

Given that some of our product suppliers are based in China, the United Kingdom, and India, limited data sharing may occur with international parties. Any such transfer will be subject to adequate safeguards as required under the DPA, 2019 and applicable data transfer frameworks.

6.3 Legal Disclosures

We may disclose your personal data to law enforcement authorities, regulatory bodies, or courts where required by Kenyan law or a valid court order.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal data may be transferred as part of the transaction, subject to the same protections as described in this Policy.

7. Data Retention

Manabu Quest retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Transaction and order data: seven (7) years, in accordance with the Tax Procedures Act, 2015;
• Account data: for the duration of your account, plus two (2) years following account closure;
• Marketing data: until you withdraw consent;
• Cookie data: as specified in our Cookies Policy.

8. Your Data Rights

Under the Data Protection Act, 2019, you have the following rights with respect to your personal data:

• Right of Access: to obtain a copy of the personal data we hold about you;
• Right to Rectification: to request correction of inaccurate or incomplete data;
• Right to Erasure: to request deletion of your personal data, subject to legal retention obligations;
• Right to Object: to object to processing based on legitimate interests or for direct marketing;
• Right to Restriction: to request that we restrict processing in certain circumstances;
• Right to Data Portability: to receive your data in a structured, machine-readable format;
• Right to Withdraw Consent: to withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our Data Protection contact at info@manabuquest.com. We will respond within thirty (30) days as required under the DPA, 2019.

9. Data Security

Manabu Quest implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include SSL/TLS encryption, access controls, secure payment processing, and regular security assessments. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be posted on the Platform with the revised effective date. We will notify registered account holders of material changes by email. Continued use of the Platform after notification constitutes acceptance of the revised Policy.

11. Contact Us

For all data protection and privacy queries, please contact: