This policy explains how Taimba Ltd (“Taimba”, “we”, “us”) collects, uses and
protects personal data when you use taimba.co.ke, order produce from us, or
supply produce to us. We handle personal data in line with Kenya’s
Data Protection Act, 2019.
Taimba Ltd is the data controller. Our office is at G.F. Corvin Complex, Off Outering Road,
Nairobi, Kenya. For any question about this policy or your data, contact
wecare@taimba.co.ke or
+254 745 777 222.
What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and contact details | Name, business name, phone number, email address, delivery address, county and ward | You, when you register or place an order |
| Order and transaction data | Items ordered, quantities, delivery dates, invoices, payment references, amounts | Generated when you trade with us |
| Payment data | M-Pesa transaction code, the phone number used to pay, payment status | Safaricom’s M-Pesa (Daraja) service. We never see or store your M-Pesa PIN |
| Supplier data | Farm group name, membership numbers, crops, volumes, collection point, payment account | You and our field officers |
| Website data | Pages viewed, approximate location from IP address, device and browser type | Collected automatically, and only where you allow analytics cookies |
| Enquiries | What you write in a contact, farmer-registration or trade-account form | You |
Why we use it, and on what basis
- To take and deliver your orders — performance of a contract with you.
- To take payment and issue invoices — performance of a contract, and legal obligation for tax records.
- To collect produce from farm groups and pay for it — performance of a contract.
- To answer enquiries and support you — our legitimate interest in running the business, or your consent.
- To send delivery and order notifications by SMS or email — performance of a contract.
- To send marketing such as price lists or newsletters — your consent, which you can withdraw at any time.
- To improve the website using aggregated analytics — your consent through the cookie banner.
- To meet legal obligations — tax, accounting and regulatory requirements.
Who we share it with
We do not sell personal data. We share it only with:
- Payment providers — Safaricom (M-Pesa) and our bank, to process and reconcile payments.
- Delivery and logistics staff and partners — the name, address and phone number needed to deliver your order.
- Service providers who host the website, send our SMS and email, and provide analytics, under contract and only on our instructions.
- Professional advisers and authorities where we are required to by law.
Where data is stored
The website and its database are hosted with our hosting provider. Some service providers
(for example email and analytics) may process data outside Kenya. Where that happens we rely
on contractual safeguards and only use providers that offer an adequate level of protection,
as required by the Data Protection Act, 2019.
How long we keep it
- Order, invoice and payment records: seven years, to meet tax and accounting requirements.
- Account and supplier records: for as long as the account is active, and two years after it goes dormant.
- Enquiry messages: two years.
- Analytics data: up to 14 months in aggregated form.
- Marketing consent records: until you withdraw consent, plus proof of withdrawal.
Cookies
The site uses a small number of cookies:
- Strictly necessary — your shopping basket, checkout session and login. These cannot be switched off.
- Analytics — anonymous statistics about how the site is used, so we can improve it. Set only if you accept them.
You can accept or decline non-essential cookies in the banner shown on your first visit, and
change your mind at any time by clearing the site’s cookies in your browser.
Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your data is used — this policy;
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data deleted where we no longer need it;
- object to processing, including direct marketing;
- request that we restrict processing while a concern is investigated;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing already carried out.
To exercise any of these, email wecare@taimba.co.ke.
We respond within the timelines set by the Act. If you are not satisfied, you can complain to
the Office of the Data Protection Commissioner (ODPC), Kenya —
odpc.go.ke.
Security
The site runs over HTTPS with a valid TLS certificate. Access to customer, supplier and
payment records is limited to staff who need it, protected by individual accounts and strong
passwords. Payment authorisation happens inside M-Pesa — we never see or store your M-Pesa PIN
or any card details. We keep the site, its plugins and its server patched, and we take regular
backups.
Children
Taimba is a business-to-business service and is not directed at children. We do not knowingly
collect data from anyone under 18.
Changes
We may update this policy. The date at the top shows when it last changed, and material
changes are notified to account holders by email or SMS.