DATA PROTECTION & PRIVACY NOTICE

ZiZi Soko - Kenya's Cattle Marketplace Version: 1.0 Effective date: 3 October 2026 Applies to: zizisoko.co.ke and ZiZi Soko digital marketplace services Privacy contact: hello@zizisoko.co.ke | +254 759 298 658 Operator: ZiZi Soko, the operator of the ZiZi Soko cattle marketplace. The term "ZiZi Soko", "ZiZi", "we", "us" or "our"

in this Notice refers to the operator of the platform and its authorised personnel or service providers acting within the scope described below.

IMPORTANT LEGAL POSITION

This Notice is designed to provide the transparency required by Kenyan data protection law and to allocate responsibilities accurately between ZiZi Soko, livestock sellers, buyers, agents and other participants. It is not intended to exclude any duty or liability that Kenyan law does not permit to be excluded. No privacy notice can lawfully remove a data subject's statutory rights, prevent a complaint to the Office of the Data Protection Commissioner (ODPC), or excuse unlawful processing. Where liability is imposed by law, this Notice does not displace that liability.

ZiZi Soko operates a marketplace. It is not automatically the controller of every item of personal data appearing on or passing through the marketplace. In some processing activities ZiZi is a data controller; in others, where it processes personal data strictly on behalf of another controller under lawful instructions and a written agreement, ZiZi may act as a data processor. A participant who independently determines why and how personal data is used may be a controller in their own right.

The allocation below is intended to make that distinction clear.

1. PURPOSE AND SCOPE

1.1 Purpose

ZiZi Soko provides a digital marketplace through which farmers, cattle owners, buyers, agents and service providers may create, discover, discuss and arrange livestock transactions. Data processing is necessary to operate accounts, publish and manage listings, facilitate introductions, maintain platform security, support transaction workflows, respond to enquiries, prevent fraud, communicate service information and meet legal obligations.

This Notice explains what personal data may be processed, why it is processed, the lawful bases relied upon, when information is disclosed, the distinction between controller and processor roles, retention and deletion, security measures, user responsibilities, data subject rights, breach procedures and the circumstances in which ZiZi is not responsible for processing carried out independently by another participant or external provider.

1.2 Scope

This Notice applies to personal data processed through the ZiZi Soko website, mobile-responsive interfaces, listing forms, inquiry channels, customer support channels, agent workflows, administrative tools, transaction documentation, communications and related services controlled by ZiZi Soko. It applies to persons in Kenya and, where Kenyan law applies extraterritorially, to processing of persons located in Kenya by a person or entity not established or ordinarily resident in Kenya.

It does not govern the independent privacy practices of third-party websites, social media platforms, messaging providers, financiers, insurers, veterinary professionals, county offices, payment providers or other independent controllers. Those parties may issue their own notices and are responsible for their own processing.

1.3 Relationship with other ZiZi Soko documents

This Notice forms part of the ZiZi Soko privacy and compliance framework and should be read with applicable marketplace terms, seller/buyer terms, livestock sale and transfer documents, the Livestock Identification & Photo Schedule and any transaction-specific notices. A transaction-specific notice may impose additional requirements where a particular service involves identity verification, financing, insurance, veterinary records or other higher-risk processing.

2. WHO IS RESPONSIBLE FOR WHAT?

2.1 ZiZi Soko as a data controller

ZiZi is a controller where it determines the purposes and means of processing, including platform administration, account management, publication of marketplace listings, customer support, fraud prevention, security, product analytics, service improvement, direct marketing where lawfully authorised, and maintaining records necessary for legal claims and compliance.

2.2 ZiZi Soko as a data processor

ZiZi may act as a processor where a client, institutional partner or other controller determines the purposes and means of processing and ZiZi is engaged under a written contract to process specified personal data only on that controller's lawful instructions. In that role ZiZi will not determine the purposes of the processing except where a lawfully permitted processor function requires it, and any processing outside lawful instructions may result in ZiZi being treated as a controller for that activity under Kenyan law.

A controller that engages ZiZi as a processor is responsible for giving lawful instructions, establishing the purposes of processing and ensuring that the instructions, notices and requested processing are lawful. ZiZi is responsible for complying with processor-specific obligations applicable to the services it actually provides.

2.3 Independent controllers on the marketplace

Sellers, buyers, agents, financiers, insurers, veterinary professionals, transporters and other service providers may independently decide what information they collect, why they use it and whom they disclose it to. Where they make those decisions independently, they are separate controllers and ZiZi does not become responsible for their independent processing merely because the marketplace enabled contact between them.

For example, a farmer deciding to retain a buyer's telephone number after a sale for future commercial dealings is responsible for the lawful basis and safeguards for that later use. A financier deciding to conduct credit assessment is responsible for its own financial and credit data processing. A veterinary professional issuing a report is responsible for the personal data contained in that report to the extent the professional determines the purpose and means of that processing.

2.4 Role changes as the platform develops

The same organisation may be a controller for one processing activity and a processor for another.

ZiZi will assess role allocation by processing activity rather than using a single label for the entire platform. Contracts with processors and institutional partners will specify the subject matter, duration, nature, purpose, data types, data-subject categories, instructions, security requirements, confidentiality, deletion or return requirements and audit arrangements as required by applicable law.

3. PERSONAL DATA WE MAY PROCESS

3.1 Account and contact information

Name, telephone number, email address, account identifiers, password-related credentials or authentication records, profile information and communication preferences.

3.2 Seller and buyer information

Information used to describe a participant or facilitate a livestock transaction, including locality, county, trading location, farm or business name, occupation where volunteered, preferred contact channel, transaction history, inquiry references, communication records and information necessary to establish the identity or authority of a participant where verification is required.

3.3 Livestock listing information

Animal species, breed, sex, approximate or verified age, colour, horn status, ear-tag or identification-device number, brand mark, distinguishing features, location of the animal, price or pricing instructions, photographs, videos, veterinary information, vaccination or treatment information and other information deliberately supplied for a livestock listing or transaction record.

Animal-only information is not automatically personal data merely because it describes an animal. It becomes personal data where it relates to an identified or identifiable natural person, including through a seller profile, contact details, farm location, ownership record or other identifier.

3.4 Identification and verification information

Where legally necessary or contractually required for a specific service, ZiZi or an authorised service provider may process national ID or passport details, verification status, identity-document information, signatures or other proof of identity or authority. ZiZi will not require users to publish national ID numbers or identity-document images in a public marketplace listing. Such material should be supplied only through an authorised verification channel when specifically requested.

ZiZi does not ordinarily require biometric identifiers for a standard marketplace listing. Where biometric processing is introduced by ZiZi or a service provider, additional safeguards, lawful basis and any required notices or impact assessment will apply.

3.5 Payment and transaction information

Payment references, transaction amounts, invoice information, banking or mobile-money identifiers, transaction status, refunds and settlement records may be processed where payments or commissions are enabled. Where payment details are collected directly by an external payment provider, that provider may process the underlying financial credentials under its own privacy framework. ZiZi will seek to minimise the financial data it directly stores.

3.6 Device, technical and usage information

IP address, browser or device type, device identifiers, operating-system information, approximate location derived from technical signals, access times, pages or features used, referral information, error logs, security events and similar technical records needed to secure and improve the service.

3.7 Communications and support data

Information contained in emails, calls where lawfully recorded or documented, support requests, WhatsApp conversations where users choose that channel, dispute records, feedback, reports of suspected fraud and other communications with ZiZi.

3.8 Images, photographs and recordings

Photographs or videos uploaded to a listing may show animals, farms, homes, vehicles, employees, buyers, sellers, agents or bystanders. Where an identifiable person appears, the image may constitute personal data. Users must have an appropriate legal basis and authority to upload or disclose a person's image and should avoid unnecessary images of children, identity documents, financial documents, medical information or private domestic spaces.

4. HOW INFORMATION IS COLLECTED

4.1 Direct collection

ZiZi primarily collects personal data directly from the data subject through registration, listing forms, inquiries, customer support, verification requests, transaction documentation and other interactions with the platform.

4.2 Indirect collection

Information may be received indirectly where permitted by law, including from a participant who submits another person's contact information for a legitimate marketplace purpose, from public records or information deliberately made public, from a service provider acting lawfully, from a transaction counterparty, from an authorised agent, or where collection is necessary for fraud prevention, law enforcement, legal claims or protection of a person's interests.

Where another person's personal data is supplied to ZiZi, the person supplying it is responsible for having the necessary authority or lawful basis. ZiZi may request confirmation or refuse the submission where the basis is unclear.

5. PURPOSES OF PROCESSING

5.1 Marketplace operation

● Create and manage accounts; publish, rank, edit and remove listings; match buyer interest with seller listings; receive inquiries; provide reference numbers; facilitate introductions; coordinate agents; maintain listing records; and provide customer support.

5.2 Transaction support

● Generate or store transaction documentation; link an animal to a sale or transfer record; support due diligence; facilitate veterinary, insurance or financing services requested by users; manage commissions; process disputes; maintain evidence; and support legitimate post-sale administration.

5.3 Security and trust

● Authenticate users; detect suspicious behaviour; investigate fraud, scams, impersonation or abuse;

protect users and the platform; preserve logs; enforce platform rules; prevent unauthorised access;

and respond to security incidents.

5.4 Compliance and legal purposes

Comply with Kenyan law, court orders, regulatory requests and lawful government directions; maintain records required by tax, accounting or other applicable laws; establish, exercise or defend legal claims; and cooperate with law enforcement where legally required.

5.5 Service improvement

● Measure service usage, diagnose errors, conduct analytics, improve marketplace functionality, test new features, evaluate demand, and develop business operations using data in a manner consistent with the law and this Notice.

5.6 Communications and marketing

● Send service notices, security notifications, transaction updates and support communications.

Promotional communications will be sent only where there is a lawful basis, including consent where required, and will provide a simple opt-out mechanism. Transactional or legal notices are not treated as promotional merely because they mention the service.

6. LAWFUL BASES FOR PROCESSING

6.1 Applicable bases

ZiZi will process personal data only where a lawful basis exists. Depending on the activity, the basis may include consent; performance of a contract or steps requested before entering a contract;

compliance with a legal obligation; protection of vital interests; performance of a task carried out in the public interest or under official authority where applicable; or legitimate interests that are not overridden by the rights and freedoms or interests of the data subject.

6.2 Consent

Where consent is relied upon, it will be requested in a manner that is specific, informed and capable of being withdrawn. Withdrawal of consent does not invalidate processing already carried out lawfully before withdrawal. Withdrawal may affect the availability of a service where the relevant processing is necessary to provide that service or comply with another legal obligation.

6.3 Contract and legal obligation

Certain information is necessary to provide a marketplace service or to perform steps requested by the user. Other information may be required by applicable law, including records needed for legal claims, taxation, fraud prevention, regulatory compliance or court processes. Where a requested field is optional, ZiZi will avoid treating provision of that information as mandatory without a lawful reason.

6.4 Legitimate interests

Where relied upon, legitimate interests may include platform security, fraud prevention, maintaining service reliability, handling complaints, defending legal claims, communicating with existing users about operational matters and improving services. ZiZi will consider whether the processing is necessary and whether the interests or rights of the data subject override those interests.

7. TRANSPARENCY AT COLLECTION

7.1 Notices

Before or at the point personal data is collected, ZiZi will, where practicable, provide information about the fact of collection, purpose, relevant data categories, third-party recipients or categories, applicable safeguards, ZiZi contact details, whether provision is required by law or contract, whether provision is voluntary and the consequences of refusing information. This Notice is supplemented where appropriate by shorter just-in-time notices on individual forms or features.

7.2 Data minimisation

ZiZi will seek to collect adequate, relevant and limited information necessary for the stated purpose.

Users should not submit information simply because a form technically permits it. In particular, do not upload ID cards, bank credentials, PINs, passwords, one-time codes or private medical information into a public listing.

7.3 Accuracy

Participants are responsible for keeping information they submit accurate and current. ZiZi may remove, correct, restrict or reject information that is materially inaccurate, misleading, unlawful, defamatory, fraudulent or unsafe, subject to applicable rights and procedures.

8. PUBLIC LISTINGS, CONTACT DETAILS AND LIVESTOCK INFORMATION

8.1 Public nature of marketplace information

Information placed in a public marketplace listing is intended to be visible to persons who access the marketplace and may be copied, downloaded, cached, screenshotted or redistributed by third parties outside ZiZi's control. Users should therefore publish only information that they are authorised to make public.

8.2 Contact details

A seller or buyer may choose to make a telephone number, WhatsApp contact, business contact or other communication channel available to another participant. ZiZi may reveal contact information where this is necessary to facilitate a requested introduction, maintain the transaction workflow, enforce the law or protect legitimate interests, but will seek to limit disclosure to what is reasonably necessary.

8.3 Exact location

Farm or animal location can create physical-security and privacy risks. ZiZi may display approximate location, county, town or trading area rather than an exact residential or farm address. Exact location information should be disclosed only where necessary for a transaction or service and on a need-to-know basis.

8.4 Photographs and animal identification

ZiZi may encourage or require photographs showing the animal from multiple angles, its ear tag or identification device, distinguishing marks and handover context. Such material may support identification and traceability of the animal. If a person appears in a photograph, the image may also constitute personal data and will be handled accordingly.

Users must not upload images that contain another person's national ID number, bank information, signature, passwords or other confidential information unless legally authorised and necessary. ZiZi may blur, crop, restrict or remove such material.

9. SENSITIVE PERSONAL DATA

9.1 Higher protection

Kenyan law gives additional protection to sensitive personal data. Depending on the circumstances, this includes data revealing race, health status, ethnic social origin, conscience or belief, genetic or biometric data, property details, marital or family details, sex or sexual orientation, and other categories treated as sensitive by law.

9.2 ZiZi's approach

ZiZi does not seek sensitive personal data for an ordinary cattle listing unless a specific lawful purpose requires it. Where sensitive data is necessary, ZiZi will identify the applicable legal ground, apply additional safeguards and restrict access. A user must not post another person's sensitive personal data in a public listing merely for convenience.

Where a third-party professional such as a veterinary provider, insurer or financier independently determines the purpose and means of processing sensitive data, that professional is responsible for the processing it controls. ZiZi may nevertheless be responsible for any processing it undertakes itself or as a processor under written instructions.

9.3 Biometric and identity verification

If a future verification product uses biometric data or other high-risk identity technology, ZiZi will apply the higher legal requirements applicable to that processing, including any required impact assessment, safeguards, notices, consent or regulatory consultation. A separate feature notice may be issued.

10. CHILDREN AND VULNERABLE PERSONS

10.1 Children

ZiZi Soko is intended for users who are at least 18 years old. ZiZi does not knowingly solicit or permit a child under 18 to create a marketplace account in their own name. Where child data is processed incidentally, ZiZi will apply the additional protections required by Kenyan law and may seek consent from or verification by a parent or guardian where required.

If a parent, guardian or child believes that child data has been collected through the platform without a lawful basis, they may contact ZiZi at hello@zizisoko.co.ke. ZiZi may suspend or remove content pending verification and take other lawful measures.

10.2 Vulnerable persons

Where circumstances indicate that a person may be particularly vulnerable to fraud, coercion or exploitation, ZiZi may apply enhanced verification or restrict certain processing or disclosure where reasonably necessary to protect the person or comply with law.

11. DISCLOSURE AND SHARING OF PERSONAL DATA

11.1 Transaction participants

ZiZi may disclose relevant information to the buyer, seller or authorised agent involved in an inquiry or transaction where the disclosure is necessary to facilitate the service and is lawful. The receiving party is responsible for its own subsequent use of the information.

11.2 Service providers and processors

ZiZi may engage vendors for hosting, database services, cloud storage, website delivery, security, analytics, communications, customer support, email, SMS, payment processing, document management, fraud detection and related functions. Where the vendor acts as a processor, ZiZi will use written contractual arrangements and appropriate instructions and safeguards required by law.

11.3 Independent professional partners

Where requested by a participant, information may be shared with independent veterinary professionals, insurance providers, financing partners, transport providers, cooperatives or other transaction-service providers. Unless a written arrangement provides otherwise, such recipients may act as independent controllers for the processing they determine.

11.4 Public authorities and legal disclosure

ZiZi may disclose personal data where required or authorised by law, court order, regulatory process or lawful request; where necessary to prevent or investigate fraud or crime; where necessary to establish, exercise or defend legal claims; or where necessary to protect the vital interests of a person.

11.5 Business restructuring

If ZiZi Soko is reorganised, financed, merged, sold, acquired or transfers part of its business or assets, personal data may be transferred as part of that transaction subject to applicable law, appropriate safeguards and the purposes disclosed in this Notice.

11.6 No sale of personal data as a business asset

ZiZi does not sell personal data as a commodity. Any commercial use, advertising, direct marketing, data analysis or disclosure will remain subject to a lawful basis, the purposes described in this Notice and applicable Kenyan law.

12. THIRD-PARTY MESSAGING, SOCIAL MEDIA AND EXTERNAL SERVICES

12.1 WhatsApp and similar channels

Where a user chooses to communicate through WhatsApp or another messaging service, that provider may process message content, identifiers, metadata and other information under its own terms and privacy practices. ZiZi cannot control the provider's independent processing, availability, security architecture, retention or jurisdiction. Users should not send passwords, PINs, one-time codes, full bank credentials or other unnecessary confidential information through a public or third-party channel.

12.2 Social-media groups and referrals

ZiZi may advertise or receive leads through social-media platforms, farmer groups or community channels. A post, comment or message on an external platform is governed by that platform's rules as well as this Notice to the extent ZiZi later receives the information. ZiZi is not responsible for the privacy settings, security or subsequent use of content by the external platform or by other group members.

12.3 External links

Links to external websites or services are provided for convenience or transaction purposes. ZiZi does not control those websites and this Notice does not govern their processing. Users should read the privacy notices of those services before submitting information.

13. DATA PROCESSORS AND PROCESSOR CONTRACTS

13.1 Processor controls

Where ZiZi is a processor, it will process personal data only on documented lawful instructions from the relevant controller, subject to the processing required by law. Processor arrangements will address the subject matter, duration, nature and purpose of processing; types of personal data; categories of data subjects; controller rights and obligations; confidentiality; security measures; sub-processing;

deletion or return; and audit or inspection arrangements as required by applicable law.

13.2 Sub-processors

ZiZi may use sub-processors to provide infrastructure or specialised functions where permitted by the controller agreement. ZiZi will impose appropriate contractual obligations on relevant sub-processors and will remain responsible for its contractual obligations to the controller to the extent required by law.

13.3 Processor liability boundary

Where ZiZi acts strictly as a processor, it does not become automatically liable for every consequence of the controller's decision, instruction or independent processing. Kenyan law specifically distinguishes processor liability and may impose liability where the processor breaches processor-specific obligations or acts outside or contrary to lawful controller instructions. The allocation of liability will therefore depend on the actual processing role and the facts of the event.

14. CROSS-BORDER PROCESSING AND CLOUD SERVICES

14.1 International infrastructure

ZiZi may use cloud, hosting, security, communications or other service providers whose infrastructure or personnel are located outside Kenya. Cross-border processing may therefore occur even where the business and users are in Kenya.

14.2 Safeguards

Where personal data is transferred outside Kenya, ZiZi will apply the safeguards and lawful conditions required by the Data Protection Act and applicable Regulations, including appropriate contractual, organisational or jurisdictional safeguards and any consent or other ground required for the relevant transfer. Sensitive personal data transferred outside Kenya requires the additional protection prescribed by Kenyan law.

14.3 User choice and service continuity

A refusal to permit lawful cross-border processing may make a particular feature unavailable where the service depends on a provider located outside Kenya. ZiZi will not use this limitation to avoid a legal requirement or to defeat a data subject's statutory rights.

15. SECURITY OF PERSONAL DATA

15.1 Security programme

ZiZi will implement reasonable technical and organisational measures appropriate to the nature of the personal data and the risks of the processing. Measures may include access controls, authentication, least-privilege permissions, encryption or pseudonymisation where appropriate, secure transmission, backup and recovery, logging, vulnerability management, staff confidentiality requirements, incident response and periodic review of safeguards.

15.2 No absolute security guarantee

No online system, device, transmission channel or third-party service is completely secure. ZiZi therefore does not warrant absolute security or guarantee that unauthorised access, loss, interception or disruption can never occur. This is a risk statement, not a waiver of ZiZi's statutory obligation to implement appropriate safeguards.

15.3 User security obligations

Users must keep passwords and access codes confidential; use strong authentication where available;

not share account credentials; report suspected compromise promptly; avoid sending unnecessary sensitive information; and ensure that devices used to access the platform are reasonably secured.

Where a user voluntarily discloses information to another participant, ZiZi cannot retrospectively make that disclosure confidential.

15.4 Security review and high-risk processing

Where processing is likely to result in high risk to the rights and freedoms of data subjects, including processing involving sensitive data, children, biometrics, large-scale processing, innovative technology, large-scale monitoring or linked datasets, ZiZi will assess whether a Data Protection Impact Assessment is required and implement measures arising from that assessment before the relevant processing begins or materially changes.

16. PERSONAL DATA BREACHES

16.1 Internal response

ZiZi maintains an incident-response approach for suspected loss, destruction, alteration, unauthorised disclosure, access or acquisition of personal data. Incidents may include hacked accounts, compromised credentials, malicious insiders, lost devices, accidental disclosure or security failures at an external provider.

16.2 Regulatory notification

Where a breach triggers the statutory notification threshold, ZiZi will notify the Data Commissioner without delay and within the period prescribed by Kenyan law, currently 72 hours from becoming aware of a qualifying breach for a controller. Where notification is late, the reasons for delay will be provided as required by law.

16.3 Processor notification

Where ZiZi is acting as a processor and becomes aware of a personal data breach, ZiZi will notify the relevant controller without delay and, where reasonably practicable, within 48 hours of becoming aware of the breach, consistent with section 43(3) of the Data Protection Act.

16.4 Communication to affected persons

Where the law requires or a risk assessment indicates that communication is appropriate, ZiZi may notify affected data subjects and provide information or protective instructions. Communication may be delayed or restricted only where permitted by law, including where necessary and proportionate for the prevention, detection or investigation of an offence.

16.5 Third-party incidents

If an incident occurs within an independent external service over which ZiZi has no operational control, ZiZi will take reasonable steps available to it under its contract or relationship with that service. The external provider remains responsible for its own legal obligations as controller or processor, as applicable.

17. RETENTION, DELETION AND DISPOSAL

17.1 General rule

Personal data will be kept in identifiable form for no longer than is necessary for the purpose for which it was collected, subject to lawful retention required for legal claims, fraud prevention, accounting, tax, regulatory compliance, contractual rights, security or other legal obligations.

17.2 Default retention schedule

ZiZi adopts the following default internal schedule, subject to lawful holds, shorter deletion where appropriate and longer retention where required by law:

Data category Default period Action after period Core account and profile While account is active and up to Delete or anonymise unless a lawful retention information 24 months after last meaningful reason applies.

activity Listings, animal While published and up to 24 Delete, anonymise or archive only where legally photographs and listing months after removal, sale necessary.

metadata closure or expiry Identity verification records Normally up to 12 months after Secure deletion unless needed for a live dispute, verification or completion of the legal obligation or fraud investigation.

relevant transaction Transaction, commission For the period required by Secure disposal or anonymisation when no longer and dispute records applicable tax, accounting, legally or operationally necessary.

contractual or legal requirements Data category Default period Action after period Customer support and Normally up to 24 months after Delete or anonymise, subject to legal claims or communications closure of the matter ongoing investigations.

Security and audit logs Normally up to 24 months, with Secure deletion or anonymisation.

shorter or longer periods based on security requirements or incidents Consent and marketing For as long as needed to prove Delete or anonymise when no longer needed.

preferences consent, honour opt-out choices and comply with legal requirements Backups According to the applicable Automatic overwrite or secure destruction in the backup cycle, ordinarily not normal backup cycle.

exceeding 90 days for routine backup copies Retention periods are operational defaults, not a licence to keep information indefinitely. A legal hold, court order, regulatory inquiry, fraud investigation, tax requirement or unresolved dispute may justify temporary retention beyond a standard period. Where a purpose ends and no lawful retention ground remains, the information will be deleted, anonymised or securely disposed of.

18. DATA SUBJECT RIGHTS

18.1 Available rights

Under Kenyan law, a data subject may have the right to be informed about the use of personal data;

access personal data held about them; object to processing; request correction of false or misleading information; request deletion or erasure where the legal conditions are met; request data portability where applicable; withdraw consent where consent is the basis; seek safeguards concerning certain automated decision-making; and exercise other rights provided by the Data Protection Act and Regulations.

18.2 How to make a request

Requests should be sent to hello@zizisoko.co.ke and should state the request being made, the account or transaction to which it relates and enough information for ZiZi to locate the relevant record. ZiZi may request reasonable evidence of identity or authority where necessary to prevent unauthorised disclosure. A person acting for a data subject must have appropriate authority under Kenyan law.

18.3 Response and verification

ZiZi will respond within the timelines required by law and may ask clarifying questions where the request is too broad to identify the relevant processing. Where a request is refused in whole or in part, ZiZi will provide reasons to the extent required by law and will preserve any applicable right to complain to the ODPC.

18.4 Limits to deletion or objection

Deletion, objection or other rights may be limited where continued processing is necessary for a legal obligation, a court or regulatory process, establishment or defence of legal claims, fraud prevention, vital interests, or another lawful purpose recognised by Kenyan law. ZiZi will not use an exception more broadly than necessary.

18.5 Identity and third-party data

A request does not automatically entitle a person to access another participant's personal data, confidential business information, privileged material, security credentials or information whose disclosure would unlawfully prejudice another person. ZiZi may redact or withhold such material where legally permitted or required.

19. DIRECT MARKETING AND COMMERCIAL COMMUNICATIONS

19.1 Direct marketing

Where ZiZi uses personal data for direct marketing, it will do so in accordance with the Data Protection Act and General Regulations. Where consent is required, consent will be obtained. Promotional messages will identify the sender and provide a clear, simple, accessible opt-out mechanism. ZiZi will honour valid opt-out requests.

19.2 Service and transaction messages

Operational messages necessary for account security, listing status, transaction coordination, service requests, dispute handling or legal notices may continue even after promotional marketing is declined because they are not being sent solely for direct marketing purposes.

19.3 No unlawful marketing by users

A user must not obtain information through ZiZi and then use it for unsolicited bulk marketing, harassment, mass solicitation or another unlawful purpose. ZiZi may suspend access, delete content or restrict disclosure where misuse is detected or reasonably suspected.

20. COOKIES, ANALYTICS AND SIMILAR TECHNOLOGIES

20.1 Essential technologies

ZiZi may use cookies or similar technologies required for authentication, security, session management, load balancing, fraud prevention and core website functionality.

20.2 Analytics and preferences

Where analytics, performance measurement or preference technologies are used, ZiZi will seek to configure them in a manner consistent with data minimisation and lawful processing. Non-essential technologies requiring consent will not be treated as mandatory unless their processing is otherwise lawfully justified and disclosed.

20.3 Browser controls

Users may be able to restrict cookies through browser controls, but disabling essential cookies may impair account functionality, listing creation, secure login or other platform features.

21. USER RESPONSIBILITIES AND REPRESENTATIONS

21.1 Lawful authority to upload data

By submitting personal data to ZiZi, a user represents that, to the best of their knowledge and after taking reasonable steps, they have the authority or lawful basis required to provide that data for the purpose for which it is being submitted. This is particularly important where the user uploads another person's telephone number, identity document, signature, photograph, farm information or other personal data.

21.2 Accuracy of listings

Users are responsible for the accuracy of their livestock and contact information. ZiZi may rely on information supplied by users and may display it as submitted unless it has reason to edit or remove it.

A listing or verification badge is not a guarantee that the animal, seller, ownership, health status or transaction facts are true unless a separate verification service expressly confirms that fact.

21.3 Security and disclosure by users

Once a user voluntarily discloses information directly to another participant, including by telephone, WhatsApp, in-person meeting, email or a document exchanged outside ZiZi, that external recipient controls the subsequent use of the information subject to that recipient's legal duties. ZiZi cannot guarantee or police what an independent participant does after receiving information lawfully disclosed to them.

21.4 Prohibited material

Users must not upload or transmit passwords, PINs, one-time codes, full payment credentials, malicious software, another person's confidential records without authority, unlawful surveillance material or content that violates applicable law. ZiZi may remove, quarantine or restrict such information and may preserve evidence for legal or security purposes.

22. LIABILITY, LIMITATIONS AND RESPONSIBILITY ALLOCATION

22.1 No blanket exclusion

Nothing in this Notice excludes or limits liability, regulatory powers, compensation rights or other remedies that cannot lawfully be excluded under the Constitution, the Data Protection Act, consumer law, contract law or another applicable written law.

22.2 Independent-user processing

To the fullest extent permitted by law, ZiZi is not responsible for an independent participant's processing of personal data where that participant determines the purpose and means of that processing independently and the event is not caused by processing for which ZiZi is legally responsible. This includes independent use of contact details, copies of listings, photographs, documents or communications after a participant receives them lawfully.

Nothing in this clause transfers away a duty that remains legally imposed on ZiZi as controller or processor. Where ZiZi determines the purposes and means of the relevant processing, or acts outside lawful processor instructions, responsibility will be assessed under the Data Protection Act and other applicable law.

22.3 External service providers

ZiZi depends on hosting, communications, analytics, payment, security and other external services. To the extent an external provider independently determines the purposes and means of processing, that provider is responsible for its own legal obligations. Where the provider acts as ZiZi's processor, ZiZi will use contractual and organisational measures appropriate to the risk and the law, but no contractual framework can guarantee that an external system will never experience an incident.

22.4 Marketplace role limitations

ZiZi is not the seller or buyer of an animal merely because it hosts a listing or facilitates contact.

Unless a separate written agreement expressly provides otherwise, ZiZi does not assume the identity, ownership, health, valuation, suitability, legal title, financing approval, veterinary diagnosis, insurance coverage or contractual performance obligations of the transaction participants. Those matters remain with the relevant participant or professional provider.

Where ZiZi provides a specific verification or documentation service, the scope of that service will be defined by the relevant terms or document. A verification activity does not automatically amount to a guarantee of every underlying fact.

22.5 Lawful allocation of processor liability

Where ZiZi acts as a data processor, its liability for damage will be assessed under section 65 of the Data Protection Act. The Act specifically addresses processor liability where the processor has failed to comply with a processor-specific obligation or has acted outside or contrary to the controller's lawful instructions. A controller may remain responsible for its own processing decisions and instructions.

These statutory allocations cannot be replaced by a private disclaimer.

23. COMPLAINTS, ENFORCEMENT AND ESCALATION

23.1 Complaint to ZiZi

A data subject should first contact ZiZi at hello@zizisoko.co.ke where the complaint concerns ZiZi's own processing and the matter can reasonably be addressed internally. ZiZi will investigate complaints, preserve relevant records where necessary and communicate the outcome or next step within a reasonable period and any statutory timelines that apply.

23.2 Office of the Data Protection Commissioner

Kenyan law permits a data subject or an aggrieved person to lodge a complaint with the Data Commissioner. The complaint mechanism is administered by the Office of the Data Protection Commissioner. ZiZi does not restrict or condition a person's statutory right to approach the ODPC.

23.3 Contact details for the ODPC

The Office of the Data Protection Commissioner is the statutory regulator for data protection in Kenya.

Its current public contact details include the ODPC website at www.odpc.go.ke, email info@odpc.go.ke, telephone 020 7801800, and its Nairobi office at Britam Towers, Hospital Road, Upperhill. Current contact details published by the ODPC should be checked when a formal complaint is made.

23.4 Regulatory powers

The Data Commissioner may investigate complaints and may issue enforcement notices, penalty notices and other measures available under the law. The Data Protection Act provides an administrative penalty ceiling of up to KShs 5,000,000 or, for an undertaking, up to 1% of annual turnover of the preceding financial year, whichever is lower, subject to the Act and the circumstances of the infringement.

24. RECORDS, AUDITABILITY AND ACCOUNTABILITY

24.1 Internal records

ZiZi will maintain records reasonably necessary to demonstrate accountability, including records of processing activities where required, data-sharing arrangements, processor contracts, security measures, incidents, complaints, data-subject requests, retention decisions, consent or opt-out records where relied upon, and impact assessments where required.

24.2 Data protection impact assessments

Where a processing operation is likely to result in high risk, ZiZi will consider and conduct a Data Protection Impact Assessment before the processing begins or materially changes, including for processing that falls within the high-risk categories identified by the Data Protection (General) Regulations, 2021. Where the assessment indicates a high residual risk requiring prior consultation, ZiZi will follow the statutory consultation process.

24.3 Registration

ZiZi will assess whether it is required to register with the ODPC as a data controller, data processor or both, taking into account the Data Protection Act and the Registration Regulations. A small entity may fall within the statutory exemption where it satisfies the turnover and employee thresholds, but that exemption does not remove all data-protection obligations and does not apply to certain listed purposes. Registration status does not replace the requirement to comply with substantive data-protection duties.

25. GOVERNING LAW AND INTERPRETATION

25.1 Applicable law

This Notice is governed by the laws of Kenya. The Constitution of Kenya, the Data Protection Act, 2019, the applicable Data Protection Regulations and other applicable written laws prevail over any inconsistent wording in this Notice.

25.2 Severability

If any provision of this Notice is found invalid, unlawful or unenforceable, that provision will apply only to the extent permitted by law and the remaining provisions will continue in force to the extent they can operate independently.

25.3 Statutory rights preserved

A reference to a limitation, allocation of responsibility or operational procedure does not remove a data subject's rights under mandatory Kenyan law. Where legislation changes, this Notice will be interpreted and updated to reflect the law.

26. CHANGES TO THIS NOTICE

26.1 Updates

ZiZi may update this Notice to reflect changes in the law, the ODPC framework, the marketplace, new technologies, new third-party services, new processing activities or changes in risk. The version and effective date shown at the beginning of the Notice will identify the current published version.

26.2 Material changes

Where a change materially affects how personal data is processed or materially expands the purposes of processing, ZiZi will provide an appropriate notice and obtain fresh consent where the law requires consent.

27. PRIVACY CONTACT

27.1 Primary contact

Questions, access requests, correction requests, deletion requests, objections, complaints and privacy enquiries may be sent to hello@zizisoko.co.ke or +254 759 298 658. To protect data subjects, ZiZi may require reasonable verification before disclosing personal data or changing account security information.

27.2 Security incidents

Suspected personal-data breaches should be reported promptly using the same contact details.

Reports should state the affected account or transaction, what happened, when it happened if known, and what information may have been exposed. Users should not send passwords or one-time authentication codes in a breach report.

APPENDIX A - PROCESSING RESPONSIBILITY MATRIX

The following matrix describes ZiZi's intended role by common processing activity. The actual role is determined by the facts, the purpose and means of the processing, applicable contracts and the law.

Processing activity Typical ZiZi role Primary responsibility Account registration and platform Controller ZiZi determines why and how account administration information is used to operate the marketplace.

Publishing seller listings and Controller ZiZi determines the platform purpose and marketplace search means; sellers remain responsible for the lawfulness of data they submit.

Handling a buyer inquiry through Controller for platform ZiZi manages the platform workflow; the ZiZi processing; recipient may recipient controls subsequent independent be independent controller use.

Processing data under a written Processor Client/controller sets purpose and means; ZiZi client instruction follows documented instructions.

Cloud hosting/database/storage Processor to ZiZi where Vendor follows contract and instructions; ZiZi vendor acts only on ZiZi remains accountable for vendor selection and instructions oversight to the extent required.

WhatsApp or external messaging External provider controls ZiZi controls only the processing it undertakes chosen by user its own service processing before or after the external channel.

Veterinary examination/report Usually independent Veterinary provider controls professional controller processing unless contractually instructed otherwise.

Financing/credit assessment Usually independent Financier controls lending or credit controller assessment purposes and compliance.

Insurance underwriting/claims Usually independent Insurer or broker controls insurance-specific controller processing.

Fraud/security monitoring Controller ZiZi determines the security and conducted by ZiZi fraud-prevention purposes and means.

Legal compliance, court or regulator Controller or processor Disclosure is made only where a lawful basis disclosures according to underlying role or legal authority exists.

and legal context Marketing by ZiZi Controller ZiZi determines its own promotional purposes and must comply with direct-marketing requirements.

APPENDIX B - INFORMATION GOVERNANCE RULES FOR LISTINGS

Information Publish publicly? ZiZi handling rule Animal breed, sex, approximate Generally yes, where Use only what is relevant and accurate; remove age, colour and distinguishing supplied for a listing misleading or unlawful content.

features Animal photographs Generally yes Do not intentionally include unnecessary personal data, identity documents or private information in the background.

Approximate Generally yes Use approximate location where possible to county/town/location reduce physical-security risks.

Exact home/farm address Normally no Disclose only where necessary for transaction fulfilment or a lawful service and limit access.

Seller telephone/WhatsApp Only where seller chooses or Do not publish a participant's number without number disclosure is otherwise authority.

lawful National ID number or passport No Never place in a public listing. Use controlled number verification channels.

Bank account details, PINs or No Do not upload. ZiZi may remove or restrict such one-time codes content.

Veterinary records Only where necessary and Restrict access where records contain personal lawfully supplied data; distinguish animal information from person information.

Buyer/seller handover Only where participants Handle identifiable people as personal data.

photograph have appropriate authority Avoid unnecessary publication.

and it serves the stated purpose APPENDIX C - SECURITY AND PRIVACY CONTROL BASELINE

● Role-based access: only personnel with a business need should access personal data relevant to their role.

● Least privilege: administrative privileges should be limited, authenticated and reviewed.

● Secure transmission: personal data should be transmitted over secure channels where available and appropriate.

● Secure storage: databases, object storage and backups should use access controls and appropriate encryption or equivalent safeguards where risk requires.

● Secret management: API keys, passwords, tokens and credentials must not be stored in public repositories or client-side code where they could be exposed.

● Logging: material access, security events and administrative actions should be logged to support incident response and accountability, subject to retention limits.

● Backups: backups should be protected and tested for restoration and should follow the retention cycle in this Notice or the relevant processor contract.

● Incident response: suspected breaches should be triaged promptly, contained, investigated, documented and escalated according to statutory requirements.

● Vendor governance: third parties processing personal data for ZiZi should be assessed for contractual, security and privacy safeguards appropriate to their role and risk.

● Privacy by design: new features that introduce sensitive, child, biometric, large-scale, innovative or linked-dataset processing should be assessed before launch where the law requires a DPIA.

APPENDIX D - LEGAL AND REGULATORY FRAMEWORK REVIEWED

This Notice has been prepared against the Kenyan data-protection framework identified by the Office of the Data Protection Commissioner and the published Kenyan legal texts available as at 3 October 2026. The principal framework includes:

● Constitution of Kenya, 2010, Article 31, including the constitutional right to privacy.

● Data Protection Act, 2019 (No. 24 of 2019), including provisions on data protection principles, data subject rights, lawful processing, children, sensitive personal data, direct marketing, security, processor contracts, breach notification, cross-border transfers, enforcement and compensation.

● Data Protection (General) Regulations, 2021 (Legal Notice 263 of 2021), including consent, commercial use, retention, sharing, processor contracts, data protection impact assessment, sensitive data and cross-border safeguards.

● Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (Legal Notice 265 of 2021), including controller/processor registration, exemptions, registration thresholds and registration obligations.

● Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 (Legal Notice 264 of 2021), including complaint handling, investigation, enforcement notices and penalty notices.

● Office of the Data Protection Commissioner guidance and materials on consent, data protection policies, data protection impact assessments, children, biometrics, cross-border data transfers, data sharing, data controllers/processors and processing by MSMEs.

● Other sector-specific and generally applicable Kenyan laws that may affect particular transactions, including tax, consumer, criminal, employment, communications, electronic transactions, livestock, veterinary, insurance, financing and court or regulatory processes. The specific law applicable to a transaction depends on the facts and is not replaced by this Notice.

REGULATORY UPDATE NOTE

The ODPC published a draft notice on 11 September 2026 proposing additional categories of sensitive personal data for specified cross-border transfers, including certain foreign-origin data treated as sensitive in its jurisdiction of origin. The material was published as a draft for public participation, not as a statement that those proposed categories were already operative law. ZiZi will monitor enacted changes and update this Notice where necessary.

SOURCE NOTE

The legal framework above was checked against the Office of the Data Protection Commissioner materials and published Kenya Law texts available at the effective date of this Notice. The key statutory provisions reflected in this document include sections 25-30, 31-49 and 56-65 of the Data Protection Act, and the corresponding provisions of the 2021 Regulations. This Notice is a public-facing compliance document, not a substitute for transaction-specific legal advice or a data protection impact assessment where one is legally required.

ZiZi Soko - Kenya's Cattle Marketplace | +254 759 298 658 | hello@zizisoko.co.ke