Skip to content
LEYBASE

Legal

Privacy Policy

Last updated: 10 November 2026

Draft for legal review. This document is a working draft prepared for LEYBASE and must be reviewed by a qualified Kenyan advocate before launch. Bracketed items are pending business registration details.

This policy explains how LEYBASE [registered business name to be confirmed] collects and processes personal data in line with the Kenya Data Protection Act, 2019 and its Regulations. Data-controller registration: [ODPC registration — pending].

1. Data we collect

  • Account data: name, email, phone number, hashed password.
  • Order data: products, recipient phone numbers, amounts, order references, delivery status.
  • Payment data: the M-Pesa phone number, amount, M-Pesa receipt number and result returned by Safaricom. We never receive or store your M-Pesa PIN.
  • Gift-card data: codes/PINs delivered to you, stored encrypted and shown only to your logged-in account.
  • Support data: messages you send us via WhatsApp, email or forms.
  • Technical data: IP address, device/browser information and security logs; aggregated usage analytics that exclude payment data and gift-card codes.

2. Why we use it (lawful basis)

  • To perform our contract with you: process payments, deliver products, send order notifications.
  • Legal obligations: tax records (including eTIMS), anti-fraud and record-keeping duties.
  • Legitimate interests: security, fraud prevention, service improvement.
  • Consent: marketing messages (you can withdraw at any time).

3. Who we share it with

Only as needed to provide the Service: Safaricom (M-Pesa payments), our airtime and gift-card suppliers (recipient number and order details), Meta (WhatsApp messaging), SMS/email providers, hosting providers, and authorities where required by law. Some suppliers process data outside Kenya; where they do, we apply the safeguards required by the Data Protection Act.

4. Retention

Transaction and tax records are retained for the period required by Kenyan tax law (currently at least five years). Account data is kept while your account is active and deleted or anonymised after closure, except where we must retain it by law. Gift-card codes are retained only as long as needed for support and dispute handling.

5. Your rights

You have the right to be informed, to access your data, to object, to correct or delete inaccurate data, and to data portability. To exercise these rights, contact support@leybaseafrica.com. We respond within the statutory period. You may complain to the Office of the Data Protection Commissioner (ODPC).

6. Security

We use HTTPS, password hashing, encryption of gift-card codes at rest, access controls and audit logging. No system is perfectly secure; we will notify you and the ODPC of qualifying breaches as required by law.

7. Contact

Data-protection queries: support@leybaseafrica.com · Contact page.