Privacy Policy

1. Overview

At PetsNCompanions.org ("Platform," "we," "us," or "our"), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and related services.

We comply with the Kenya Data Protection Act, 2019 (DPA) and other applicable privacy laws. By accessing or using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Services.

✅ Our Commitment: We never sell your personal data to third parties. Your trust is our priority.

2. Information We Collect

We collect several types of information to provide and improve our Services:

Personal Information (from Pet Owners & Professionals)

Contact Details: Full name, email address, phone number, physical address (optional)
Payment Information: MPESA transaction details, card information (processed securely via PCI-compliant providers; we do not store full card numbers)
Account Information: Username, password (hashed), profile photo, bio, service categories (for professionals)
Verification Documents: For Service Providers and Affiliates — national ID, business permit, or other identification required by Kenyan law

Pet Information

Basic Details: Pet name, species, breed, age, weight, color, microchip number (if applicable)
Health Information: Vaccination records, medical conditions, allergies, medications, behavioral notes, vet contact information
Photos & Media: Images of your pets uploaded to the platform (visible to Service Providers you book)

Technical & Usage Information

Device Data: IP address, browser type, device type, operating system, mobile network information
Location Data: Approximate location derived from IP address (required for matching with local Service Providers)
Usage Data: Pages visited, features used, booking history, search queries, time spent on platform, click patterns

Affiliate/Marketer Information (NEW)

Affiliate Data: Unique referral links, conversion tracking, commission earned, payout history
Verification Data: National ID or Passport (for KYC compliance before payouts)
Payout Information: MPESA phone number or bank account details

3. How We Use Your Information

We use the information we collect for legitimate business purposes under the Kenya DPA:

Service Provision: To create and manage your account, facilitate bookings, process MPESA/card payments, and deliver requested services
Communication: To send service-related communications (booking confirmations, reminders, account updates), respond to inquiries, and (with your consent) send marketing messages about new features or promotions
Personalization: To tailor your experience, recommend relevant Service Providers, and show content based on your location and preferences
Platform Improvement: To analyze usage trends, debug issues, develop new features, and improve user experience
Security & Fraud Prevention: To protect the platform, detect fraudulent activities (including affiliate referral fraud), verify identities, and enforce our Terms of Service
Affiliate Payouts: To track referrals, calculate commissions (10%), and process payouts to verified Affiliates
Legal Compliance: To comply with the Kenya Data Protection Act, respond to lawful requests from authorities, and protect our legal rights

4. Information Sharing & Disclosure

We may share your information in the following circumstances:

With Service Providers: When you book a service, necessary pet and contact information is shared with the specific Vendor to facilitate service delivery.
With Trusted Partners: We engage third-party companies for payment processing (e.g., MPESA integration, Stripe), analytics (e.g., Google Analytics), email delivery, and customer support. These partners are contractually bound to protect your data.
For Legal Reasons: If required by law, subpoena, court order, or to protect our legal rights, safety, or property, or to comply with the Office of the Data Protection Commissioner (ODPC) Kenya.
Aggregated Data: We may share anonymized, aggregated data that cannot identify you for research, analytics, or promotional purposes.
Affiliate Referrals: When you sign up via an Affiliate link, we share with the Affiliate that a referral was successful (but not your personal identity).

🔒 We Do Not Sell Your Personal Information: PetsNCompanions does not and will never sell your personal data to third parties for their marketing purposes.

5. Data Protection & Security

We implement robust technical and organizational measures to protect your information as required by the Kenya DPA:

Encryption: Industry-standard SSL/TLS encryption for data in transit (HTTPS). Sensitive data (passwords, ID documents) is encrypted at rest.
Secure Infrastructure: Data stored on secure servers hosted within [Kenya/Region - specify based on your hosting] with firewalls and intrusion detection systems.
Payment Security: Use of PCI-DSS compliant payment processors for card payments; MPESA transactions are processed via Safaricom's secure API. We do not store full payment card numbers.
Access Controls: Strict internal access controls — only authorized personnel with a legitimate business need can access personal data.
Regular Audits: Ongoing security assessments, vulnerability scans, and penetration testing. We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing.
Data Backups: Regular, encrypted backups to prevent data loss. Backups are retained in accordance with our retention policy.
Breach Notification: In the event of a data breach, we will notify the ODPC and affected users within 72 hours as required by the Kenya DPA.

While we strive to protect your data, no internet transmission or storage is 100% secure. We cannot guarantee absolute security but we maintain industry-standard protections to safeguard your information.

6. Your Rights Under the Kenya Data Protection Act

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal information:

Right to Access: Request a copy of the personal data we hold about you (free of charge for the first request).
Right to Correction: Request correction of inaccurate or incomplete personal data.
Right to Deletion ("Right to be Forgotten"): Request deletion of your personal data where there is no compelling reason for continued processing.
Right to Object: Object to processing of your data for direct marketing or where processing is based on legitimate interests.
Right to Data Portability: Request transfer of your data to another service provider in a structured, machine-readable format.
Right to Lodge a Complaint: You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) Kenya if you believe we have violated your rights.
Marketing Opt-Out: Unsubscribe from marketing communications at any time via the "unsubscribe" link in emails or your account settings.
Account Deletion: Request deletion of your account via your account settings or by contacting us.

How to Exercise Your Rights: To exercise these rights, please contact us at privacy@petsncompanions.org. We will respond within 30 days as required by the Kenya DPA. We may need to verify your identity before processing your request.

📞 ODPC Kenya Contact: Office of the Data Protection Commissioner — www.odpc.go.ke | Email: info@odpc.go.ke

7. Cookies & Tracking Technologies

We use cookies and similar technologies to improve your experience:

Essential Cookies: Required for platform operation (login, session management, security). Cannot be disabled.
Preference Cookies: Remember your settings and preferences for a better experience.
Analytics Cookies: Help us understand how users interact with our platform (e.g., Google Analytics).
Marketing Cookies: Used for affiliate tracking and (with your consent) targeted advertising.

You can manage cookie preferences through your browser settings or our cookie consent banner. Blocking essential cookies will impair Platform functionality.

8. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will take steps to delete such information promptly.

9. Data Retention Policy

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

Data Type	Retention Period	Reason
Account information (active users)	Until account deletion + 30 days	To maintain your account and services
Account information (deleted accounts)	30 days after deletion request	Grace period for account restoration
Transaction & payment records	7 years (Kenya tax/legal requirement)	Tax and legal compliance
Affiliate commission records	5 years	Audit and dispute resolution
Pet health records	Until account deletion	Service provision and convenience

After the retention period expires, your data will be securely deleted or anonymized.

10. Affiliate & Marketer Data Processing

If you join our Affiliate Program, we process additional information to track referrals, calculate commissions, and issue payouts.

Referral Tracking: We use cookies and unique links to track which Affiliate referred you. This does not expose your identity to the Affiliate.
Commission Calculation: We track successful paid sign-ups to calculate the 10% commission earned by Affiliates.
KYC Verification: Before any payout, Affiliates must provide valid identification (National ID or Passport) to prevent fraud and comply with anti-money laundering best practices.
Fraud Detection: We monitor for self-referrals, fake accounts, and other fraudulent activities. Data is used to protect the integrity of the program.

📌 Affiliate Privacy Note: Your identity and personal information are not sold or shared outside of PetsNCompanions. Payout information is shared only with our payment processors (MPESA/Bank).

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes via email (to registered users) and/or by posting a prominent notice on the Platform at least 14 days before the effective date.

Your continued use of the Platform following the effective date of the revised Privacy Policy constitutes your acceptance of the changes. Please review this policy regularly for the latest information.