Privacy Policy

1. Who we are (Data Controller)

Sella is operated by Ngomma Value Added Services Limited, a company incorporated in Kenya, which acts as the data controller for the personal data described here. For any privacy matter — including to reach our data protection contact — email admin@sella.co.ke.

2. Information we collect

• Account details you provide: name, display name, email, phone number, password (stored only as a secure hash), and a profile or shop photo if you add one.
• Verification data used to confirm sellers: phone (OTP) verification, and details you submit when applying to become a Verified Seller.
• Listings & content you post: titles, descriptions, photos, prices, condition, location and category. Photos may be processed to generate image features used for search and "similar item" matching, and to add a watermark.
• Transaction & payment data: orders, bookings, tickets, wallet top-ups, M-Pesa/STK push references, payout details (M-Pesa or bank) and commission records. We do not store your M-Pesa PIN or full card details — payments are handled by our payment partner (Safaricom M-Pesa / Daraja).
• Communications: in-app messages, enquiries, reviews, and support emails or SMS.
• Social login: if you sign in with Google or Facebook, we receive your name and email from them to create or access your account.
• Device & usage data: IP address, browser/device type, pages and listings viewed, referring pages, ad performance, and similar diagnostics, collected via cookies and similar technologies.
• Interest & activity data: if you are signed in and accept personalisation cookies, we record which categories and products you view, save or contact, to build an interest profile (see section 4).
• Approximate location derived from the county you select or from your IP address, to show relevant local listings.

3. Cookies & similar technologies

When you first visit, a banner asks you to Accept cookies. We use the following categories:

• Strictly necessary — sign-in/session, security (including reCAPTCHA bot-protection), load-balancing and remembering your cookie choice. These are always on because the Platform cannot work without them.
• Functional — remembering preferences such as language, region/currency and light/dark theme.
• Analytics — understanding traffic and how the Platform is used (e.g. Google Analytics) so we can improve it.
• Personalisation — building your interest profile to show you more relevant listings, recommendations and offers (see section 4).

You can change or withdraw your choice at any time by clearing your browser's site data for sella.co.ke (which makes the banner appear again), or through your browser's cookie settings. Blocking some cookies may affect how the Platform works.

4. Personalisation & our promotion engine

To make the marketplace more useful, we maintain an interest profile for signed-in users who have accepted personalisation cookies. We record the categories and items you browse, save or enquire about, and use that to rank listings, power "recommended for you" and "similar item" features, and tailor the promotions, emails or SMS we send.

• This profiling applies only to signed-in ("known") users who accepted personalisation cookies. We do not build interest profiles for logged-out visitors.
• It is based on your activity within Sella; we do not track you across other companies' websites.
• You can stop it at any time by withdrawing personalisation consent (section 3) or deleting your account (section 12). You can opt out of marketing separately (section 11).

5. How we use your data

• Create and manage your account and shop, and display your listings to buyers.
• Enable buyers and sellers to contact and transact with each other.
• Verify sellers, score and screen listings, and detect and prevent fraud, scams, spam and abuse to keep the Platform safe.
• Process payments, commissions, payouts and withdrawals through our payment partner.
• Personalise content and recommendations, and — with your consent — send marketing and promotions.
• Send service messages (order updates, tickets, receipts, verification, payout status) by email/SMS.
• Provide customer support, resolve disputes, and analyse and improve the Platform.
• Comply with our legal, tax and regulatory obligations.

6. Legal bases for processing

We process personal data where: you have given consent (e.g. personalisation and marketing, which you can withdraw); processing is necessary to perform a contract with you (operating your account and transactions); we have a legitimate interest (security, fraud prevention, improving and securing the Platform); or we must comply with a legal obligation.

7. Automated processing

We use automated tools to help moderate listings (AI content scoring) and to flag possible fraud or duplicate accounts. These tools assist our team; decisions that significantly affect you — such as rejecting a listing or restricting an account — are subject to human review. If you believe an automated outcome was wrong, contact us and we will review it.

8. How we share data

• With other Users as needed to transact — a seller sees a buyer's name, phone and delivery details for an order, and your public listings, shop and reviews are visible to everyone.
• Service providers (processors) who help us run the Platform and may use the data only to provide their service to us, including: cloud/server hosting; our email provider (Zoho Mail); our SMS gateway; the payment processor (Safaricom M-Pesa / Daraja); Google (sign-in, reCAPTCHA, Analytics); Meta/Facebook (login); and AI providers used for content moderation and image-similarity features.
• Authorities where required by law, court order, or to protect rights, safety and property.
• Business transfers: if Sella is involved in a merger, acquisition or asset sale, data may be transferred subject to this Policy.

We do not sell your personal data.

9. International transfers

Some of our service providers (for example email, analytics, login or AI processing) may store or process data outside Kenya. Where this happens, we take steps to ensure your data receives a level of protection consistent with the Data Protection Act, 2019, including appropriate safeguards or your consent where required.

10. Data retention

We keep personal data only as long as necessary for the purposes above — generally for the life of your account, and thereafter only as required to meet legal, tax, accounting, dispute-resolution and fraud-prevention obligations. Transaction and payout records are typically retained for up to 7 years to satisfy financial and legal requirements. When data is no longer needed, it is deleted or anonymised.

11. Security

We use technical and organisational measures — including hashed passwords, encryption in transit (HTTPS), access controls, admin two-step verification, and masking of sensitive data in our admin tools — to protect your information. No system is completely secure, so we cannot guarantee absolute security, but we work hard to safeguard your data and will notify you and the regulator of serious breaches as required by law.

12. Your rights

Under the Data Protection Act, 2019 you have the right to:

• Be informed about how your data is used.
• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data — you can edit most details in Settings.
• Delete your account and data — see Delete your account & data.
• Object to or restrict certain processing, and withdraw consent (including personalisation and marketing) at any time.
• Request portability of data you provided.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya (odpc.go.ke).

To exercise any right, email admin@sella.co.ke from your registered address. We respond within the timeframes set by law.

13. Marketing choices

You can opt out of marketing emails using the unsubscribe link in any promotional email, by adjusting your preferences, or by contacting us. We will still send essential service messages related to your account and transactions.

14. Children

The Platform is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

15. Third-party links

The Platform may link to third-party websites and services that have their own privacy practices. We are not responsible for their content or policies; please review them separately.

16. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date above shows when. Significant changes will be notified through the Platform or by email where appropriate. Continued use after an update means you accept the revised Policy.

17. Contact us

For any privacy question or request, contact our data protection contact at Ngomma Value Added Services Limited:
Email: admin@sella.co.ke
You may also complain to the Office of the Data Protection Commissioner, Kenya, at odpc.go.ke.