Privacy Policy

Ujenzi ("Ujenzi", "we", "us") is a construction marketplace operated by Alphawonders Solutions, based in Nairobi, Kenya. For the purposes of the Data Protection Act, 2019 (the "Act"), Alphawonders Solutions is the data controller for personal data processed through ujenzi.online.

Questions about this policy or about your data can be sent to privacy@ujenzi.online.

It covers the ujenzi.online website and any Ujenzi account you hold — whether you use Ujenzi to buy materials, to hire a fundi, to post a project, or to list yourself as a fundi, contractor or supplier. It does not cover the practices of the other businesses and individuals you transact with through Ujenzi; they are separate data controllers for the data you give them directly.

We collect only what we need to run the marketplace:

• Account data — your name, email address, phone number, country and account type. Your password is stored only as a cryptographic hash; we never see it.
• Fundi, contractor and supplier profile data — profession, years of experience, skills, certifications, hourly or daily rates, town and county, travel radius, biography and any portfolio images you upload.
• Order data — the items in your cart, delivery address and contact phone number, delivery notes, order history and the payment method you selected. We do not collect or store card numbers.
• Hire request data — the job title and description, job location, dates, the rate you offer and any notes you add to a request.
• Communications — messages you send us by email or through the platform, and our replies.
• Technical data — IP address, browser and device information, pages visited and error logs. We store an authentication token and a guest-cart session identifier in your browser's local storage.

We do not ask for sensitive personal data as defined in section 2 of the Act (such as health, biometric or genetic data, or data on your race, religion or political affiliation). Please do not include such information in profile text, job descriptions or reviews.

Under section 30 of the Act we rely on the following bases:

• Performance of a contract — creating and securing your account, processing orders and hire requests, arranging delivery, and providing support.
• Legitimate interests — keeping the platform safe and free from fraud, debugging, measuring how the service is used, and improving it. We balance these interests against your rights and you can object (see section 8).
• Consent — where you subscribe to marketing emails or newsletters. You can withdraw consent at any time, and every marketing email carries an unsubscribe link.
• Legal obligation — keeping tax and transaction records, and responding to lawful requests from regulators or courts.

Ujenzi is a marketplace, so some information is deliberately public. If you create a fundi, contractor or supplier profile, your name, profession, skills, town and county, rates, rating, completed-job count and biography are visible to anyone browsing the site. Your phone number is shown to signed-in users so that clients can reach you.

When you place an order or send a hire request, the supplier or fundi receives the details they need to fulfil it — typically your name, phone number, and the delivery or job location. Do not share information through Ujenzi that you are not comfortable giving to the other party.

• Hosting and infrastructure providers who run our servers, database and email delivery on our instructions.
• Payment providers — where a payment is made by M-Pesa, Safaricom processes the transaction and we receive confirmation details such as the amount, the paying number and the reference.
• Professional advisers and authorities — where we are required by law, or where it is necessary to establish, exercise or defend a legal claim.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

Some of our infrastructure and email providers store data on servers outside Kenya. Where that happens we rely on the safeguards in sections 48 and 49 of the Act: we transfer data only to providers who are bound by contractual commitments to protect it to a standard comparable to Kenyan law, and only where the transfer is necessary to perform our contract with you.

Under Part IV of the Act you have the right to:

• be informed of how your data is being used — this policy;
• access the personal data we hold about you;
• have inaccurate or misleading data corrected;
• have your data deleted, where we no longer have a lawful reason to keep it;
• object to processing based on our legitimate interests, and to stop marketing at any time;
• receive a copy of the data you gave us in a portable format;
• not be subject to a decision based solely on automated processing that significantly affects you — Ujenzi does not make such decisions.

To exercise any of these, email privacy@ujenzi.online from the address on your account. We aim to respond within seven days, and in any event within the timelines set out in the Data Protection (General) Regulations, 2021. We will ask you to confirm your identity before acting on a request.

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC), Britam Tower, Upper Hill, Nairobi — odpc.go.ke.

• Account and profile data — for as long as your account is open, and for 12 months after you close it so that we can resolve any dispute that arises.
• Order, invoice and payment records — seven years, as required by the Tax Procedures Act, 2015.
• Hire requests and reviews — for as long as the profile they relate to is live, since they form part of a fundi's track record.
• Support emails — three years from the last message.
• Server and error logs — 90 days.

When you ask us to delete your account we remove or anonymise your personal data except where we are legally required to keep it, in which case we restrict it from further use.

Ujenzi uses your browser's local storage to keep you signed in and to remember a guest cart before you create an account. These are strictly necessary for the site to work. We do not currently run third-party advertising or cross-site tracking cookies. If that changes we will update this policy and ask for your consent first.

Traffic to ujenzi.online is encrypted in transit, passwords are hashed, and access to production data is limited to the people who need it to operate the service. No system is perfectly secure, so we ask you to use a strong, unique password and to tell us immediately if you think your account has been compromised.

If a breach occurs that presents a real risk to your rights and freedoms, we will notify the ODPC within 72 hours of becoming aware of it and inform you as required by section 43 of the Act.

Ujenzi is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the service changes. The "last updated" date at the top always reflects the current version, and we will notify account holders by email before a material change takes effect.

Data protection enquiries: privacy@ujenzi.online
General enquiries: hello@ujenzi.online
Alphawonders Solutions, Nairobi, Kenya.

See also our Terms of Service.