Most recent amendment: August 2026
This Privacy Policy (“Policy”) explains how Bidzid Technologies Limited (“BidZid”, “we”, “us”, or “our”) collects, uses, shares, protects, and retains your Personal Data when you use the BidZid website and related digital services at bidzid.app (collectively, the “Platform”).
This Policy applies to all “Data Subjects” including:
- Buyers / Users
- Sellers / Vendors
- Job Applicants
- Website Visitors
- Business Partners / Prospects
- Other individuals who communicate with or otherwise interact with BidZid
1. OVERVIEW AND COMMITMENT
Bidzid Technologies Limited is committed to safeguarding Personal Data and processing it lawfully, fairly, and transparently in accordance with the Data Protection Act, 2019 (Kenya) and related regulations. BidZid will not process Personal Data in a manner incompatible with the purposes stated in this Policy.
Bidzid Technologies Limited is a duly registered Data Controller under the laws of Kenya, Data Controller Registration Number (ODPC NO.) _________________.
2. KEY DEFINITIONS
In this Policy:
“Personal Data” means any information relating to an identified or identifiable natural person.
“Processing” means any operation performed on Personal Data including collection, recording, storage, use, disclosure, sharing, alteration, retrieval, and deletion.
“Data Subject” means an individual to whom Personal Data relates.
“Buyer” or “User” means a person who registers, browses, bids on, wins, or purchases an item through the Platform.
“Seller” or “Vendor” means an individual or business that lists items for auction or sale through the Platform.
2.1 DATA PROTECTION PRINCIPLES
Bidzid Technologies Limited processes Personal Data in accordance with the following principles:
- Lawfulness, fairness and transparency;
- Purpose limitation – Personal Data is collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
- Data minimisation – Only Personal Data necessary for the stated purposes is collected;
- Accuracy – Personal Data is kept accurate and up to date;
- Storage limitation – Personal Data is retained only for as long as necessary;
- Integrity and confidentiality – Appropriate technical and organisational measures are implemented to safeguard Personal Data.
3. SUMMARY OF INFORMATION
| Item | Details |
| Data Controller | Bidzid Technologies Limited Shanzu Rd, Westlands, Nairobi, Kenya Email: info@bidzid.app |
| Data Controller Registration Number (ODPC NO.) | _________________ |
| Data Protection Officer (DPO) / Privacy Contact | Interim Privacy / Data Protection Contact Email: support@bidzid.app |
| Your Rights | You may exercise your rights at any time through available Platform privacy controls or by emailing support@bidzid.app. You have the right to: Be informed about the use of your Personal Data and access Personal Data held about youRectify inaccurate, false, incomplete, or misleading Personal DataRequest erasure/deletion, subject to applicable legal retention requirementsRestrict processing where applicableObject to processing, including direct marketing and relevant profiling/automated processingRequest data portability where applicableWithdraw consent at any time where processing is based on consentLodge a complaint with the Office of the Data Protection Commissioner (ODPC) |
PURPOSES OF PROCESSING When You Are a BUYER / USER
| Purpose Category | How We Use Your Data |
| Contractual Purposes | Create and manage your account; authenticate access; enable browsing, bidding, auction participation and purchases; process payments and refunds; issue transaction confirmations; connect you with Sellers following a successful transaction; support delivery/collection arrangements; provide customer support; manage returns and disputes; facilitate communications; enable ratings and feedback; and optimise Platform functionality. |
| Legal & Compliance | Comply with tax, eTIMS, consumer protection and regulatory requirements; prevent and investigate fraud; respond to lawful court, regulator or law-enforcement requests; enforce BidZid Terms; and establish, exercise or defend legal claims. |
| Security & Fraud Prevention | Monitor transactions and account activity for suspicious or abusive behaviour; use device, IP, transaction and access data to protect accounts and the Platform; verify information where necessary; and cooperate with law enforcement when legally required. |
| Statistics & Research | Analyse bidding, purchasing and usage trends; improve Platform features and recommendation algorithms; conduct voluntary surveys; understand user behaviour; and develop new or improved services. |
| Marketing & Communications | Send essential service notifications such as outbid, watchlist, auction-ending, winning-auction, payment and account notices; and, where permitted and subject to applicable consent/preferences, send offers, promotions, personalised recommendations and other marketing by email, SMS/WhatsApp or similar channels. |
When You Are a SELLER / VENDOR
| Purpose Category | How We Use Your Data |
| Commercial Relationship | Create and manage Seller accounts; enable product listings, auctions and sales; share relevant transaction details with Buyers after a successful transaction; manage seller payouts and the 8% BidZid platform fee; provide reporting information; and maintain the commercial relationship. |
| Compliance & Due Diligence | Conduct Seller KYC; verify government-issued identification; collect KRA PIN and business registration documents for business Sellers; comply with tax/eTIMS, consumer and other applicable requirements; prevent fraud; and respond to lawful regulatory or legal requests. |
| Customer Service & Support | Provide technical and marketplace support; assist with listings and transactions; facilitate communication between Buyers and Sellers; and manage complaints, returns and disputes. |
When You Are a JOB APPLICANT
| Purpose Category | How We Use Your Data |
| Recruitment & Assessment | Evaluate suitability for current or future roles; conduct interviews; assess qualifications and experience; verify references; and perform background checks where relevant and lawful. |
| Communications | Provide recruitment updates; respond to application inquiries; schedule interviews; and communicate about current or future opportunities where appropriate. |
When You Are a PROSPECT (Business Inquiry)
| Purpose Category | How We Use Your Data |
| Pre-Contractual Engagement | Respond to service, vendor, commercial or partnership inquiries; provide information or quotations where relevant; manage negotiations; and evaluate potential business relationships. |
| Marketing & Follow-Up | Send information regarding BidZid services related to your inquiry and conduct reasonable business-development follow-up, subject to consent or other applicable lawful basis where required. |
When You Are a WEBSITE VISITOR
| Purpose Category | How We Use Your Data |
| Website Interaction | Enable website use and login/session functionality; respond to inquiries and comments; remember relevant preferences; analyse traffic and engagement; improve Platform performance and recommendations; and maintain security of BidZid’s digital infrastructure. |
LAWFUL BASIS FOR PROCESSING
| Legal Basis | Description |
| Performance of a Contract | Processing necessary to provide BidZid marketplace services to Buyers and Sellers, including accounts, listings, bidding, transactions, refunds, disputes and seller payouts. |
| Compliance with Legal Obligations | Processing required under Kenyan law, including tax/eTIMS, consumer protection, data protection, record-keeping, fraud prevention and other applicable regulatory requirements. |
| Legitimate Interests | Platform security; fraud and misuse prevention; service improvement; analytics; product/auction recommendations; operational efficiency; and establishment, exercise or defence of legal claims. |
| Consent | Optional marketing communications; non-essential cookies/analytics where consent is required; voluntary surveys; and other optional processing activities. |
| Legal Claims | Establishment, exercise or defence of legal claims and handling disputes or complaints. |
DATA SHARING If You Are a BUYER / USER
| Recipient Category | Purpose of Sharing |
| Buyers and Sellers / Vendors | Following a successful sale or winning auction, to share the name, phone number, email address where provided, delivery/collection address, and relevant order/listing details needed to complete delivery, collection, returns or dispute resolution. |
| Payment Service Provider (Paystack) | To process Buyer payments and refunds and facilitate Seller payouts. BidZid does not provide Paystack with more Personal Data than is reasonably necessary for payment processing. |
| IT & Hosting Service Providers | To host, secure and maintain Platform infrastructure, including HostPinnacle Kenya. |
| Analytics Service Providers | To measure traffic, usage and Platform performance, including Google Analytics where enabled. |
| Technology / Communications / Support Providers | Where engaged, to provide operational, security, communications or support services required for the Platform. |
| Professional Advisers | Where necessary, to obtain legal, tax, accounting, audit or other professional advice and to establish, exercise or defend legal claims. |
| Business Partners | Where you have provided consent, another lawful basis applies, or an appropriate data sharing arrangement is in place. |
| Public & Regulatory Authorities | Where required by law, court order or a valid regulatory request, including the ODPC, KRA, courts and law-enforcement authorities. |
| Other Lawful Recipients | Where disclosure is otherwise required or permitted by applicable law and appropriate data protection safeguards are applied. |
4. DATA WE COLLECT
Bidzid Technologies Limited may collect the following categories of Personal Data depending on how you interact with the Platform:
4.1 Registration & Account Data
- Full name
- Email address
- Mobile number
- Physical / delivery address
- Password hash / login credentials
4.2 Auction & Transaction Data
- Bids and bid history
- Winning auctions, orders, and transaction identifiers
- Payment, refund, and payout status/history
- Delivery / collection address and contact instructions
- Ratings, feedback, returns, dispute, and complaint records
4.3 Payment Data
Payments are processed through Paystack. BidZid may receive or retain:
- Billing amounts and transaction references
- Masked payment identifiers and payment status
BidZid does not store full card numbers, card security codes, or equivalent full card credentials.
4.4 Technical & Device Data
- Device type and operating system
- Browser type and version
- IP address
- Platform usage and access logs
- Cookie/session identifiers and error or security logs
4.5 Communications Data
- Customer support interactions
- Emails and messages sent to or from BidZid
- Auction, transaction, and notification preferences
- Inquiries, feedback, and complaints
4.6 Seller / Vendor Verification & Payout Data
- Government-issued identification or passport details for sellers
- KRA PIN (for business sellers)
- Company / business registration documents (for business sellers)
- Bank account and mobile-money details for payouts
- Physical / business address
- Optional vendor profile photograph
4.7 Recruitment Data
- CV / resume, qualifications, and employment history
- Contact details, application correspondence, and interview/reference information
- Background-check information where lawfully undertaken and relevant to the role
5. PURPOSES AND LEGAL BASES FOR PROCESSING
Bidzid Technologies Limited processes Personal Data for the following purposes and legal grounds:
5.1 Contractual Performance
To:
- Register and manage Buyer and Seller accounts
- Enable product listings, bidding, auctions, purchases, and other marketplace transactions
- Process payments, refunds, seller payouts, and the applicable 8% BidZid platform fee
- Provide customer support, facilitate Buyer-Seller communications, and manage returns or disputes
5.2 Compliance with Law
To:
- Carry out Seller KYC and comply with tax, eTIMS, consumer protection, and other regulatory obligations
- Prevent and investigate fraud and respond to lawful requests from courts, regulators, or law enforcement
- Retain transaction and other records for the periods required by applicable law
5.3 Legitimate Interests
To:
- Improve and personalise the Platform, including product and auction recommendations
- Maintain Platform security and prevent misuse or abusive activity
- Analyse usage and transaction trends and improve operational efficiency
5.4 Consent
Where consent is legally required, for:
- Optional promotional emails, SMS/WhatsApp messages, and other marketing communications
- Non-essential analytics cookies and similar technologies
- Voluntary surveys and other optional processing activities
Provision of certain Personal Data is mandatory in order to create an account and use relevant BidZid services. Failure to provide required information may result in an inability to register, bid, sell, receive payouts, or use certain Platform features. Optional information, marketing preferences, and voluntary profile information are provided at your choice.
6. DATA PROCESSING BY CATEGORY OF DATA SUBJECT
6.1 For Buyers / Users
Purpose: Provide Platform services; create and manage accounts; enable bidding and purchases; process payments and refunds; facilitate delivery or collection arrangements; provide auction and transaction notifications; manage disputes; provide support; and, where permitted, send promotions.
Data Categories: Account data, auction and transaction data, payment references, technical/device data, delivery information, communications, and preferences.
Legal Bases: Performance of a contract; compliance with legal obligations; legitimate interests for security, fraud prevention and service improvement; and consent for optional processing where required.
6.2 For Sellers / Vendors
Purpose: Register and verify Sellers; enable product listings and auctions; facilitate sales and Buyer communications; process payouts and BidZid commission; provide support; and manage returns or disputes.
Data Categories: Identity/KYC data, business registration information, contact and address details, payout information, listing and transaction data, technical data, communications, and optional vendor profile information.
Legal Bases: Performance of a contract; compliance with legal and tax obligations; legitimate interests for platform integrity and fraud prevention; and consent where required.
6.3 For Job Applicants
Purpose: Receive and assess applications; communicate about recruitment; conduct interviews, reference checks, and lawful background checks; and consider applicants for current or future roles.
Data Categories: Contact details, CV/resume, qualifications, employment history, application correspondence, interview/reference information, and any lawfully obtained background-check information.
Legal Bases: Steps taken at your request before entering into an employment relationship; legitimate interests in recruitment; compliance with legal obligations; and consent where required.
7. DATA RECEIVERS & DISCLOSURE
Bidzid Technologies Limited may share Personal Data with the following recipients where necessary and lawful:
7.1 Service Providers
- Payment processor (Paystack)
- Website hosting and IT service providers, including HostPinnacle Kenya
- Analytics providers, including Google Analytics where enabled
- Other technology, communications, security, or support providers if engaged from time to time
Where a third party acts as a processor on BidZid’s behalf, BidZid will require appropriate contractual, confidentiality, security, and data protection safeguards consistent with applicable law.
7.2 Buyers & Sellers / Vendors
- Following a sale or winning auction, BidZid may share the Buyer’s and Seller’s name, phone number, email address where provided, delivery or collection address, and relevant order/listing details as necessary to complete delivery, collection, returns, or dispute resolution.
7.3 Legal & Regulatory Authorities
- Where required by Kenyan law, a court order, or a valid regulatory or law-enforcement request, including requests from the Office of the Data Protection Commissioner (ODPC) or Kenya Revenue Authority (KRA).
7.4 Business Partners & Other Recipients
Personal Data may be shared with business partners or other recipients where you have provided consent, where a lawful basis permits the sharing, or where an appropriate data sharing arrangement is in place.
8. INTERNATIONAL DATA TRANSFERS
Personal Data may be processed or transferred outside Kenya where necessary for services used by BidZid. Such transfers will only take place where permitted under applicable Kenyan data protection law, including where:
- The receiving country or recipient provides an adequate level of data protection; or
- Appropriate safeguards are in place, such as contractual safeguards or another lawful transfer mechanism.
9. DATA RETENTION
Bidzid Technologies Limited retains Personal Data only for as long as necessary to fulfil the purposes described in this Policy and to comply with applicable legal, tax, audit, fraud-prevention, dispute, and regulatory obligations.
Indicative retention periods include:
- Account Data – retained while the account remains active and thereafter for as long as reasonably necessary for legal, fraud-prevention, audit, or dispute purposes;
- Auction, Transaction and Payment Records – retained for a minimum of seven (7) years for tax, eTIMS, financial reporting, and audit requirements;
- Seller Verification, Business and Payout Data – retained for the duration of the Seller relationship and thereafter as required for legal, tax, audit, fraud-prevention, or dispute purposes;
- Marketing Data – retained until consent is withdrawn, the individual opts out, or the information is no longer required for the relevant marketing purpose;
- Recruitment Data – retained for up to two (2) years unless a longer period is required or permitted by law;
- Dispute and Legal Records – retained for the duration of the relevant matter and applicable statutory limitation periods.
Upon expiry of applicable retention periods, Personal Data is securely deleted or irreversibly anonymised where appropriate.
10. SECURITY OF PERSONAL DATA
Bidzid Technologies Limited implements appropriate technical and organisational safeguards designed to protect Personal Data, including:
- Secure encrypted databases and SSL/TLS encryption for data transmitted through the Platform, where applicable
- Access controls and authentication measures designed to restrict unauthorised access
- Security monitoring, reviews, and measures designed to prevent unauthorised alteration, disclosure, loss, or misuse
- Incident response procedures and other organisational measures appropriate to the nature of the processing
However, no system is completely secure and absolute security cannot be guaranteed.
11. DATA SUBJECT RIGHTS
Under the Data Protection Act, 2019, you may have rights including:
- Right to be informed about how your Personal Data is used and to access Personal Data held about you
- Right to request correction of inaccurate, false, incomplete, or misleading Personal Data
- Right to request erasure or deletion, subject to legal and contractual retention requirements
- Right to request restriction of processing where applicable
- Right to data portability where applicable
- Right to object to processing, including marketing and relevant profiling or automated processing
- Right to withdraw consent where processing is based on consent and to lodge a complaint with the Office of the Data Protection Commissioner (ODPC)
Requests may be submitted to BidZid’s privacy / data protection contact at support@bidzid.app.
12. COOKIES AND SIMILAR TECHNOLOGIES
BidZid uses cookies and similar technologies to:
- Enable essential Platform functionality, login sessions, account security, and user preferences
- Analyse website traffic, usage patterns, and Platform performance
- Support user experience and product/auction recommendations where applicable
Cookies currently used by BidZid are categorised as:
- Strictly Necessary / Functional – required for site operation, login sessions, security, and user preferences
- Analytics – used to understand and improve Platform performance, including WooCommerce/Dokan analytics and Google Analytics where enabled
- Advertising / Remarketing – BidZid does not currently use advertising or remarketing cookies such as Meta Pixel or Google Ads tracking. If such technologies are introduced, BidZid will update its notices and consent mechanisms where required.
Consent for non-essential cookies is obtained where required by law. Users may manage or withdraw cookie consent through available cookie settings and browser/device controls.
13. CHILDREN’S DATA
BidZid’s account, bidding, selling, and transaction services are intended only for persons aged eighteen (18) years or older.
BidZid does not knowingly permit persons under eighteen (18) years of age to register an account, bid, sell, or enter into transactions through the Platform.
If BidZid becomes aware that Personal Data has been collected from a person under eighteen (18) years in connection with an account or transaction, BidZid will take reasonable steps to:
- Verify the age of the individual where appropriate;
- Restrict or disable the relevant account or transaction where necessary; or
- Delete the Personal Data where appropriate, subject to any lawful requirement to retain particular records.
A parent or legal guardian who believes that a minor has provided Personal Data to BidZid may contact support@bidzid.app to request review and appropriate action.
14. AUTOMATED DECISION-MAKING & PROFILING
BidZid may use automated systems to:
- Provide personalised product or auction recommendations
- Analyse Platform use to improve the relevance and quality of the user experience
BidZid does not currently use automated systems to reject or block transactions, suspend users, or assign fraud-risk scores.
Current recommendation processes are not intended to produce legal or similarly significant effects on users. If BidZid introduces automated decision-making with significant effects, it will implement applicable safeguards, including human review where required by law.
15. DATA BREACH NOTIFICATION
In the event of a Personal Data breach that meets the notification threshold under applicable law, Bidzid Technologies Limited shall:
- Notify the Office of the Data Protection Commissioner without undue delay and, where required, within seventy-two (72) hours of becoming aware of the breach;
- Notify affected Data Subjects where required because the breach is likely to result in a risk of harm to their rights and interests;
- Implement appropriate containment, remedial, and mitigation measures.
16. CHANGES TO THIS POLICY
Bidzid Technologies Limited may update this Policy where necessary due to:
- Changes in legal or regulatory requirements
- Platform evolution, technology changes, or new features
- Business or operational developments
Where required by law, BidZid will notify Users of material changes.
The updated Policy will take effect from the date stated at the top of the Policy. Continued use of the Platform after the effective date will be subject to the updated Policy, to the extent permitted by law.
17. CONTACT INFORMATION
Data Controller: Bidzid Technologies Limited
Address: Shanzu Rd, Westlands, Nairobi, Kenya
Privacy / Data Protection Contact: support@bidzid.app
General Contact: info@bidzid.app
You may also contact the Office of the Data Protection Commissioner (ODPC) in Kenya regarding unresolved complaints under the Data Protection Act, 2019.
18. LEGAL BASIS AND CONSENT CLARIFICATION
Bidzid Technologies Limited processes Personal Data on the legal bases described in this Policy, including performance of a contract, compliance with legal obligations, legitimate interests, and consent where required by law.
Where processing is based on consent (including optional marketing communications, non-essential cookies, analytics where consent is required, or other optional processing), you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Withdrawal of consent may be exercised through available Platform privacy/cookie settings or by contacting support@bidzid.app.