1. Introduction

Mosmos is a lifestyle commerce platform operated by Asenatech Limited (“Asenatech”, “Mosmos”, “we”, “us” or “our”).

We are committed to protecting your privacy and handling personal data lawfully, fairly, transparently and securely.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you access or use the Mosmos website, mobile applications, Mosmos Discover, Mosmos Merchant, Layaway services, Bookings and other related products and services.

This Policy applies to customers, prospective customers, representatives of Partner Merchants, business contacts and other individuals whose personal data we process in connection with Mosmos.

Asenatech is registered with the Office of the Data Protection Commissioner of Kenya (ODPC) as both a data controller and a data processor. Our role depends on the circumstances and purpose of the processing, as explained in this Policy.

By using Mosmos, you acknowledge that you have had the opportunity to read this Policy. Where consent is the applicable lawful basis for processing, we will seek consent as required by law.

2. Our Role in Processing Personal Data

2.1 As a data controller

Asenatech acts as a data controller when it determines the purposes and means of processing personal data. This includes processing necessary to operate Mosmos, manage customer accounts, administer Bookings, track Booking Payments, provide customer support, maintain platform security and improve our services.

2.2 As a data processor

Asenatech acts as a data processor when it processes personal data on behalf of a Partner Merchant or another client that determines the purposes and means of processing.

In these circumstances, we process personal data in accordance with the client’s documented instructions, the applicable agreement and relevant data protection law.

The client remains responsible for the processing activities for which it acts as controller. Asenatech remains responsible for its own obligations as a processor.

Where a Partner Merchant independently determines how and why it processes your personal data, that merchant may act as a separate data controller.

3. Personal Data We Collect

The personal data we collect depends on how you interact with Mosmos and which services you use.

3.1 Identity and contact information

This may include:

  • First name, middle name and surname.
  • Telephone number and email address.
  • County, town, street or other address information you provide.
  • Date of birth, gender or other profile information, where collected and relevant to a specified purpose.
  • Identification information, where reasonably necessary for verification or another lawful purpose.

We aim to collect only information that is adequate, relevant and necessary for the purpose for which it is processed.

3.2 Account and profile information

This may include:

  • Account identifier and registration details.
  • Profile information and preferences.
  • Phone verification status.
  • Account creation, updates and relevant activity.
  • Information needed to provide access to your Bookings, payment history and relevant purchase documents.

3.3 Booking and purchase information

When you create or participate in a Booking, we may process:

  • The product or service selected.
  • The relevant Partner Merchant.
  • The purchase price or Booking Value.
  • Booking Payments made and the outstanding amount.
  • Payment history and Booking status.
  • Reservation and offer details, where applicable.
  • Product fulfilment, delivery and collection information.
  • Warranty and other relevant purchase documents.
  • Cancellation, refund or customer-support information associated with the Booking.

3.4 Payment and transaction information

We may process information required to administer and reconcile payments, including:

  • Payment amounts and transaction references.
  • Transaction dates and times.
  • Payment method and transaction status.
  • Payment confirmations and reconciliation records.
  • Refund and settlement information.

Payment credentials may be collected or processed directly by banks, mobile money providers or other payment service providers. Their handling of such information is subject to their own applicable terms and privacy notices.

3.5 Partner Merchant and business information

Where you represent or work with a Partner Merchant or another business, we may process:

  • Business and merchant account information.
  • Your name, position and business contact details.
  • Information needed to onboard and administer merchant accounts.
  • Booking, transaction and fulfilment information.
  • Business communications and relevant account activity.

3.6 Communications and support information

We may process information contained in your enquiries, feedback, complaints, support requests and other communications with Mosmos.

3.7 Technical and usage information

When you access our website, applications or digital services, we may collect technical information such as:

  • IP address.
  • Browser, device and operating system information.
  • Pages viewed and navigation activity.
  • Access dates and times.
  • Referral source and diagnostic information.
  • Cookie and similar technology data, where applicable.

We use this information to operate, secure, troubleshoot and improve our digital services.

4. How We Collect Personal Data

We may collect personal data:

  • Directly from you when you register, complete your profile, create a Booking, make a payment or contact us.
  • Through a Partner Merchant when it creates or administers a Booking involving you.
  • From banks, mobile money providers and payment service providers in connection with transactions.
  • Automatically when you use our website, applications or other digital services.
  • From other third parties where permitted by law and relevant to the purpose for which the information is processed.

Where personal data is collected from another source, we will provide information about the processing as required by applicable law.

5. Why We Process Personal Data

We process personal data for specified and lawful purposes, including the following.

5.1 Providing Mosmos services

To:

  • Create and manage customer accounts.
  • Create and administer Bookings.
  • Record and reconcile Booking Payments.
  • Display amounts paid, outstanding balances and Booking status.
  • Send payment updates, reminders and service notifications.
  • Facilitate reservations and purchase fulfilment.
  • Provide access to relevant purchase and warranty documents.
  • Communicate with Partner Merchants regarding relevant Bookings.
  • Respond to enquiries and provide customer support.

Where necessary to provide a service you request, the lawful basis may be the performance of a contract or taking steps at your request before entering into a contract.

5.2 Operating Partner Merchant services

To onboard and manage Partner Merchants, administer merchant accounts, facilitate transactions, manage Bookings, reconcile payments and provide relevant technology services.

Where we process information on behalf of a Partner Merchant, the applicable processing instructions and agreement govern that activity, subject to applicable law.

5.3 Communications

To send information about your account, Bookings, payments, security, service changes and other operational matters.

These communications may be necessary to provide the services you use or to meet legal obligations.

5.4 Marketing and promotions

To communicate relevant Mosmos services, Partner Merchant offers, Mosmos Discover promotions and other marketing information where permitted by law.

Where consent is required, we will obtain it before processing personal data for that purpose.

You may opt out of marketing communications at any time using the available opt-out mechanism or by contacting us. Opting out will not prevent essential account, payment or service communications.

5.5 Security and fraud prevention

To protect accounts and transactions, detect and investigate suspected fraud or misuse, maintain system security, protect customers and Partner Merchants, and establish, exercise or defend legal claims.

5.6 Legal and regulatory compliance

To comply with applicable laws, regulatory obligations, lawful requests, court orders and other legal requirements.

5.7 Analytics and service improvement

To understand how our services are used, troubleshoot technical issues, improve the customer experience and develop relevant functionality.

Where reasonably possible, we use aggregated or anonymised information for analytics and business intelligence.

5.8 Lawful bases for processing

Depending on the activity, we rely on one or more lawful bases recognised under applicable data protection law, including:

  • Performance of a contract or taking steps at your request before entering into a contract.
  • Compliance with a legal obligation.
  • Your consent, where consent is required or is the applicable basis.
  • Legitimate interests, where permitted by law and where those interests do not override your rights and freedoms.
  • Other lawful grounds applicable to the particular processing activity.

Where processing is based on consent, you may withdraw that consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How We Share Personal Data

We do not sell your personal data.

We may disclose personal data to the following categories of recipients where necessary for a specified and lawful purpose.

6.1 Partner Merchants

We may share information needed to identify, administer, reserve, fulfil or otherwise manage a purchase associated with a Booking.

The information shared will depend on the transaction and may include customer contact information, product details, Booking status and relevant fulfilment information.

6.2 Payment and financial service providers

We may share or receive transaction information from banks, mobile money providers, payment service providers and other financial institutions to process, verify, reconcile or refund payments.

6.3 Technology and operational service providers

We may engage service providers that support our operations, including providers of:

  • Cloud infrastructure and hosting.
  • Software and technology services.
  • Communications and messaging.
  • Payment integration and transaction processing.
  • Analytics and diagnostics.
  • Cybersecurity and technical support.
  • Customer support and other operational services.

Where a service provider processes personal data on our behalf, we will take appropriate steps to ensure that the arrangement is governed by suitable contractual and data protection safeguards.

6.4 Professional advisers

We may disclose relevant information to lawyers, auditors, accountants and other professional advisers where reasonably necessary.

6.5 Regulators and public authorities

We may disclose personal data where required or permitted by law, including to courts, regulators, law enforcement agencies and other competent authorities.

6.6 Corporate transactions

If Asenatech is involved in a merger, acquisition, restructuring, investment, sale of assets or similar transaction, relevant personal data may be disclosed to appropriate parties subject to applicable law and appropriate confidentiality and data protection safeguards.

6.7 Other disclosures

We may disclose personal data where you have authorised the disclosure or where another lawful basis permits it.

7. Processing Personal Data on Behalf of Clients

When Asenatech acts as a data processor, we process personal data on behalf of the relevant client and in accordance with the applicable agreement and documented instructions.

Depending on the service, this may involve hosting or managing account information, processing Booking information, maintaining transaction records, supporting payment reconciliation or providing merchant technology.

In these circumstances, we will:

  • Process personal data only as permitted by the applicable instructions and law.
  • Apply appropriate technical and organisational security measures.
  • Restrict access to authorised personnel and service providers.
  • Maintain appropriate confidentiality safeguards.
  • Provide reasonable assistance to the client with applicable data protection obligations.
  • Notify the relevant controller of a personal data breach in accordance with applicable legal and contractual requirements.
  • Return or delete personal data at the end of the relevant engagement as required by the applicable agreement, subject to lawful retention requirements.

If your request concerns information that we process solely on behalf of a client, we may direct you to that client or assist you in exercising your rights through the appropriate process.

8. Partner Merchants and Independent Processing

Partner Merchants may independently process personal data for their own business purposes, including product delivery, collection, warranty administration, after-sales service and customer support.

Where a Partner Merchant determines the purposes and means of its own processing, that merchant may act as an independent data controller and its own privacy notice may apply.

You should review the relevant merchant’s privacy information where appropriate.

Mosmos will share personal data with Partner Merchants only to the extent reasonably necessary for the relevant purpose or otherwise permitted by law.

9. Cookies and Similar Technologies

Our website and digital services may use cookies and similar technologies to:

  • Enable essential website functionality.
  • Remember preferences.
  • Understand website usage.
  • Diagnose technical issues.
  • Improve performance and user experience.
  • Support analytics and other permitted functions.

You may configure your browser to restrict or reject cookies. Certain website functions may not operate correctly if essential cookies are disabled.

Where required by law, we will obtain consent before using non-essential cookies or similar technologies.

10. International Transfers of Personal Data

Some technology and service providers may store or process personal data outside Kenya.

Where personal data is transferred outside Kenya, we will comply with applicable data protection law and take appropriate steps to ensure that the transfer is lawful and that suitable safeguards are in place.

Depending on the circumstances, this may include contractual safeguards, other legally recognised transfer mechanisms or consent where legally required.

You may contact us for further information about international transfers relevant to your personal data, subject to applicable legal and security limitations.

11. Data Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction.

Depending on the relevant system and processing activity, these measures may include:

  • Access controls and authentication.
  • Restrictions on access according to operational responsibilities.
  • Secure infrastructure and data handling procedures.
  • System monitoring and security reviews.
  • Confidentiality obligations for relevant personnel.
  • Procedures for identifying, responding to and managing security incidents.

No electronic system or method of transmission can be guaranteed to be completely secure. We continually seek to maintain appropriate safeguards in light of the nature of the information and the risks associated with processing it.

12. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or for the period permitted or required by applicable law.

Retention periods depend on factors such as:

  • The nature and sensitivity of the information.
  • The duration of your account or Booking.
  • The status of a transaction or customer relationship.
  • Accounting, tax and other legal requirements.
  • Security and fraud prevention needs.
  • Disputes, complaints and legal claims.
  • Contractual obligations and regulatory requirements.

When personal data is no longer required, we will take appropriate steps to delete, anonymise or otherwise dispose of it securely, subject to applicable retention requirements.

Where we act as a processor, retention and deletion will also be governed by the relevant client’s lawful instructions and the applicable agreement.

13. Your Data Protection Rights

Subject to applicable law, you may have the right to:

  • Be informed about the use of your personal data.
  • Request access to personal data we hold about you.
  • Request correction of inaccurate, incomplete or misleading personal data.
  • Request deletion or erasure of personal data where applicable.
  • Object to the processing of personal data in circumstances provided by law.
  • Request restriction of processing where applicable.
  • Request portability of personal data where applicable.
  • Withdraw consent where processing is based on consent.
  • Exercise applicable rights concerning decisions based solely on automated processing, including profiling.
  • Lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

Some rights are subject to legal conditions and exceptions. For example, we may need to retain certain transaction records to comply with legal obligations or to establish, exercise or defend legal claims.

To exercise your rights, contact us using the details in Section 17. We may request information reasonably necessary to verify your identity and protect your personal data from unauthorised disclosure.

We will respond to requests in accordance with applicable legal requirements.

14. Account and Data Deletion Requests

You may request deletion of your Mosmos account or personal data by contacting support[at]mosmos.africa.

We will assess each request in accordance with applicable law and the nature of the information concerned.

Where deletion is appropriate, we will take reasonable steps to delete or anonymise the relevant personal data. Where continued retention is legally required or otherwise permitted, we may retain the necessary information for purposes such as legal compliance, accounting, transaction records, fraud prevention, security or dispute resolution.

Some information may remain temporarily in secure backup systems until it is deleted in accordance with our backup and retention procedures.

Deleting your account does not automatically cancel or resolve outstanding contractual, Booking or transaction matters. Any applicable cancellation, refund or fulfilment process will be handled under the relevant terms.

15. Children’s Privacy

Mosmos is intended for individuals who have the legal capacity to enter into the relevant transaction, subject to applicable law and the terms of the service.

We do not knowingly collect children’s personal data for purposes that are not permitted by law. Where a service or transaction involves a child, we will apply the applicable legal requirements, including requirements concerning parental or guardian consent and the protection of children’s personal data.

If you believe that a child has provided personal data to Mosmos in circumstances that may be inconsistent with applicable law, please contact us so that we can review the matter.

16. Complaints and the Office of the Data Protection Commissioner

If you have a concern about how Mosmos or Asenatech processes your personal data, we encourage you to contact us first so that we can investigate and respond.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC).

Official website: https://www.odpc.go.ke/

Contacting Mosmos first does not remove or limit your right to approach the ODPC in accordance with applicable law.

17. Contact Us

For questions, data protection requests or complaints concerning this Privacy Policy or our processing of personal data, contact:

ASENATECH LIMITED
Operator of Mosmos
10th Floor, ABC Place
Waiyaki Way, Nairobi, Kenya

Email: support[at]mosmos.africa

Please indicate that your enquiry concerns privacy or personal data so that it can be directed to the appropriate person.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, business practices, technology or legal and regulatory requirements.

Where a change is material, we will provide notice through the Mosmos platform, email, SMS or another appropriate communication channel where required or appropriate.

The latest version will be published at:

https://mosmos.africa/privacy/

The effective or last-updated date will be revised whenever the Policy is updated.