Legal
Privacy Policy
Last Updated: 15 March 2026
1. Introduction
This Privacy Policy describes how LavingtonPost Limited collects, uses, and protects your personal data in compliance with the Kenya Data Protection Act, 2019, GDPR, and CCPA.
2. Information We Collect
- Information You Provide: Identity data (name, Kenyan ID), contact data (phone, email), verification data (location confirmation). - Information Automatically Collected: Device data (IP address), location data (precise GPS for geofencing). - Third Parties: M-Pesa (payment verification), Google/Apple (analytics).
3. How We Use Your Information
- Service Provision: Verify Lavington residency, process payments, send service notifications. - Safety and Security: Prevent fraud, enforce community guidelines, comply with Kenyan laws. - Personalization: Recommend relevant content and local businesses.
4. Legal Basis for Processing
We process data based on consent, contract (Terms of Service), legal obligation (Kenyan regulations), and legitimate interests.
5. Data Sharing and Disclosure
- Service Providers: Payment processors (M-Pesa), cloud hosting. - Legal Requirements: To comply with Kenyan court orders, Police investigations, Office of the Data Commissioner. - We do not sell your personal data.
6. Data Retention
- Account Data: While active plus 2 years. - Transaction Records: 7 years (KRA requirement). - Location Data: 30 days for verification, then anonymized.
7. Data Subject Rights (Kenya DPA)
You have the right to access, correction, erasure (right to be forgotten), restriction, and portability. To exercise rights, contact dpo@lavingtonpost.com. Response time: 30 days.
8. Data Security
- Technical Measures: Encryption in transit and at rest, secure data centers in Kenya. - Breach Notification: We will notify the Office of Data Commissioner and affected users within 72 hours of discovering a breach.
9. International Transfers
Data is primarily processed in Kenya. If transferred internationally, Standard Contractual Clauses are used.
11. Contact
First Contact: dpo@lavingtonpost.com Kenyan Authority: Office of the Data Protection Commissioner (ODPC)
Questions about this policy?
Email our Data Protection Officer at dpo@lavingtonpost.com