Data Protection Policy

1. Who We Are

MarineCatch Africa Limited is a technology company incorporated in Kenya, operating a digital seafood supply chain infrastructure platform. We connect fishers, suppliers, buyers, processors, and logistics partners through technology.

Data Controller: MarineCatch Africa Limited, Diani, Kwale County, Kenya.

Contact: info@marinecatchafrica.com | +254 707 939 810

2. Data We Collect

From Fishers and Suppliers

• Full name, phone number, email address
• Location and landing site information
• Catch data: species, weight, date, gear type
• M-Pesa number for payment processing
• BMU membership and fishing licence details (where applicable)

From Buyers and Processors

• Business name, contact person, phone, email
• Delivery addresses and procurement preferences
• Order history and payment records
• LPO and invoice data

Platform Data

• Transaction records, inventory movements
• WhatsApp and USSD interaction logs
• Device and access information
• API usage data (for enterprise partners)

3. How We Use Your Data

• To process orders, payments, and fisher payouts
• To provide inventory visibility and traceability services
• To send transaction notifications via WhatsApp and SMS
• To generate invoices, receipts, and compliance documents
• To improve platform performance and develop new features
• To comply with legal and regulatory requirements

4. Data Ownership

You own your data. Specifically:

• Inventory data — belongs to the fisher or supplier who logged it
• Pricing data — belongs to the party who set it
• Customer relationships — belong to the party who brought them to the platform
• Business data — belongs to your organisation

MarineCatch Africa owns the platform software, aggregated anonymous market insights, and analytics models derived from platform-wide data.

5. Data Confidentiality

We take commercial confidentiality seriously:

• Your pricing information is not visible to competitors on the platform
• Your customer list is not shared with other platform participants
• Your inventory data is only visible based on your chosen visibility settings (public, partner-only, or private)
• API partners can only access data you explicitly authorise

6. Data Security

• All data is transmitted over HTTPS (TLS encryption)
• Data is stored on AWS infrastructure in Africa (Cape Town region)
• Access to production systems is restricted to authorised personnel
• Passwords are hashed using bcrypt — never stored in plain text
• Regular automated database backups
• M-Pesa transactions processed through Safaricom Daraja API

7. Data Sharing

We only share data with:

• Safaricom — for M-Pesa payment processing
• Africa's Talking — for USSD session delivery
• Meta (WhatsApp) — for WhatsApp Business API messaging
• AWS — for cloud infrastructure and data storage
• Regulatory authorities — when required by Kenyan law

All third-party providers are bound by their own data protection policies and applicable law.

8. Your Rights

Under Kenya's Data Protection Act, 2019, you have the right to:

• Access your personal data held by MarineCatch Africa
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to processing of your data
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time

9. Data Retention

• Transaction records are retained for 7 years (tax compliance)
• Catch and traceability records are retained for 5 years
• Account data is retained while your account is active
• Lead/inquiry data is retained for 12 months

10. Cookies and Analytics

Our website uses minimal data collection. We do not use third-party advertising cookies. Basic server logs are maintained for security purposes.

11. Changes to This Policy

We may update this policy as the platform evolves. Significant changes will be communicated via email or WhatsApp notification. Continued use of the platform constitutes acceptance of the updated policy.

12. Complaints and Contact