Privacy & Data Protection Policy

This Privacy & Data Protection Policy explains how Adshop Online Limited ("Adshop", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you visit our website, create an account, submit or work on briefs, communicate through the platform, make or receive payments, upload portfolio material, subscribe to communications or otherwise use Adshop services.

Adshop generally acts as a data controller for account, platform, operational, payment-administration, marketing and analytics data because we determine why and how that personal data is processed. In limited engagements where a client instructs Adshop to process personal data solely on that client's behalf, Adshop may act as a data processor subject to the applicable contract and data-processing instructions.

We aim to process personal data in accordance with the Constitution of Kenya, the Data Protection Act, 2019 (Cap. 411C), the Data Protection (General) Regulations, 2021 as amended, and other applicable Kenyan data-protection requirements.

Our processing is guided by the principles of privacy, lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

Depending on how you use Adshop, we may collect identity and contact information such as your name, email address and phone number; account and role information; client company details; creative profile, skills and portfolio information; briefs, project files and approvals; chat and support messages; payment references, provider information and transaction status; newsletter and marketing preferences; device, browser, IP, security and usage information; and other information you choose to provide through the platform.

We do not intentionally request sensitive personal data unless it is necessary for a specific lawful purpose. Users should avoid placing unnecessary sensitive or third-party personal data in briefs, chats, uploads or portfolio material.

We may collect personal data directly from you when you register, complete a profile, submit a brief, upload files, communicate, make a payment, subscribe to a newsletter or contact support. We may also receive data from clients or creatives involved in a project, payment and financial-service providers, authentication providers, service providers, referrals, publicly available business sources, and other lawful sources.

Where personal data is obtained indirectly, we will handle it in accordance with applicable notice, fairness and purpose requirements.

We process personal data only where we have a lawful basis. Depending on the activity, this may include performance of a contract or steps requested before entering a contract, compliance with a legal obligation, your consent, or a legitimate interest that is not overridden by your rights and freedoms.

Purposes may include creating and securing accounts; matching and assigning creative work; managing briefs, approvals, timelines, files and communications; processing and reconciling payments; providing customer support; preventing fraud and abuse; maintaining audit and security records; operating AI-assisted briefing and workflow tools; administering newsletters and platform communications; improving services; resolving disputes; enforcing agreements; and complying with legal or regulatory obligations.

Adshop may store payment-provider names, payment references, receipt numbers, transaction status, amounts, timestamps, reconciliation information and related order records. Payment credentials and sensitive transaction processing may be handled by banks, mobile-money providers, card processors or other payment partners under their own legal and security obligations.

We use payment information to initiate or confirm transactions, reconcile orders, administer refunds or reversals, investigate disputes and maintain financial and audit records.

Briefs, chat messages, project files, approvals, revisions and delivery records may contain personal data. They are processed to deliver the relevant project and maintain a transparent project history between authorised participants.

Portfolio uploads may include titles, descriptions, categories, tags, sector information, client or project links, visibility settings, approval status and media files. Public portfolio publication is subject to platform permissions and approval controls. Users must not publish personal data, confidential work or third-party material unless they have the necessary authority and permissions.

Adshop may use AI-assisted tools to help users structure briefs, generate drafts, classify or summarise information, support moderation and improve workflows. Inputs, outputs and related metadata may be processed for those purposes and for security, quality and audit requirements.

Users should not submit unnecessary sensitive or confidential personal data to AI-assisted features. Where a decision with a significant effect on a person requires human review under applicable law or Adshop policy, we will not rely solely on automated output.

We may disclose personal data only where reasonably necessary to approved clients, creatives and administrators involved in a project; payment, banking and mobile-money providers; cloud, hosting and storage providers; email, authentication, analytics and communication providers; professional advisers; fraud-prevention and security providers; regulators, courts, law-enforcement agencies or other authorities where legally required; and prospective parties to a legitimate corporate transaction subject to appropriate safeguards.

Service providers that process personal data for Adshop are expected to process it only for authorised purposes and to apply appropriate confidentiality and security safeguards. Where required, Adshop will use written data-processing arrangements.

Some technology and service providers may process or store personal data outside Kenya. Where personal data is transferred outside Kenya, Adshop will seek to ensure that the transfer is permitted under applicable law and supported by an appropriate safeguard, legal basis or consent where required.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for legitimate operational, contractual, payment, accounting, tax, audit, fraud-prevention, dispute-resolution and legal-compliance requirements.

Retention periods vary by record type. When personal data is no longer required, we may delete, anonymise, pseudonymise or securely archive it as appropriate. Account closure does not automatically require deletion of records that Adshop must lawfully retain.

Adshop uses reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Measures may include authentication and access controls, role-based permissions, secure communications, audit trails, restricted administrative access, provider-specific payment controls and security monitoring.

No digital platform can guarantee absolute security. Users are responsible for keeping their credentials secure, using appropriate devices and notifying Adshop promptly if they suspect unauthorised access to their account.

Where Adshop becomes aware of a personal-data breach, we will assess the nature and likely risk of the incident, take reasonable containment and remediation steps, preserve relevant evidence and make notifications to affected data subjects and/or the Office of the Data Protection Commissioner where required by applicable law.

Subject to applicable law and any lawful exemptions, you may have the right to be informed about how your personal data is used; access personal data held about you; object to certain processing; request correction of inaccurate or misleading data; request deletion where legally applicable; withdraw consent where processing depends on consent; and raise a complaint concerning the handling of your personal data.

A request may require reasonable identity verification. Some requests may be limited where Adshop is required to retain or process information for contractual, legal, payment, security, dispute or legitimate business purposes.

Where permitted, Adshop may send service updates, newsletters or marketing communications relevant to our platform and services. You may use the unsubscribe mechanism in marketing emails or otherwise ask us to stop optional marketing communications. Transactional, security, account and project communications may still be sent where necessary to operate the service.

Adshop is primarily a business and professional creative-services platform and is not designed for children to create independent accounts. If personal data relating to a child is processed for a legitimate project, the party providing it must have the necessary authority, and Adshop will apply the protections required by applicable law.

Questions, requests or complaints about personal data may be submitted to Adshop through our published support channels. Where a dedicated privacy contact is configured, that contact will be displayed below.

You also have the right to lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC) where you believe your personal data has been processed contrary to applicable data-protection law.

We may update this Policy to reflect changes in law, regulation, technology, platform functionality or our data-handling practices. Material changes may be presented to registered users for renewed acceptance. The version shown at the top of this page identifies the current Policy.