Privacy policy

1. JADE254 PRIVACY POLICY

Effective Date: 2 October 2025 Last Updated: 1 October 2026

Privacy Policy

At JADE254, we believe that building useful digital technology also means being responsible with the information entrusted to us.

This Privacy Policy explains how JADE254 collects, uses, stores, protects and otherwise processes personal information when you visit our website, create an account, use our products or services, communicate with us, or interact with businesses and content available through the JADE254 ecosystem.

JADE254 is being built as a connected digital commerce ecosystem that may include online business presence, business discovery, booking, point-of-sale and business management tools, payments and payment integrations, customer communication, automation, artificial intelligence and related digital services.

Please read this Privacy Policy together with our Terms of Service.

1. Who We Are

JADE254 is a digital technology platform built to help businesses establish their digital presence, connect with customers, transact and manage their business operations.

For purposes of this Privacy Policy:

“JADE254,” “we,” “us,” or “our” means JADE254 and the applicable legal entity operating the relevant JADE254 service.

Legal entity: JADE254 LIMITED Trading/brand name: JADE254 Registered address: JADE254 LTD Privacy contact: jade254kenya@gmail.com General support: jade254kenya@gmail.com

Where JADE254 operates different products, the relevant product may provide additional privacy notices where particular processing requires more specific information.

1. What This Privacy Policy Covers

This Privacy Policy applies to information processed through or in connection with:

jade254.com and related JADE254 websites; JADE254 accounts; JADE254 business profiles and pages; JADE254 Book; JADE254 POS; JADE254 business management and commerce services; JADE254 AI-powered products and tools; JADE254 WhatsApp or customer communication services; payment and payment-related integrations; customer support and communications; applications, software and other JADE254 services that link to this Privacy Policy.

Some JADE254 services may have additional terms or product-specific notices.

1. Information We Collect

The information we collect depends on how you interact with JADE254.

Information you provide directly

We may collect information such as:

Account information

name; email address; telephone number; username; password or authentication information; business role or account permissions.

Business information

business name; business description; business category; business location; operating hours; products and services; prices; images and media; contact information; booking information; business profile information.

Transaction and commerce information

sales records; invoices and receipts; customer records; supplier information; product and inventory information; purchasing information; payment status; transaction references; refunds and settlement information; other business records entered into JADE254 services.

Communication information

messages sent to us; support requests; feedback; information submitted through forms; communications between you and JADE254.

1. Information Collected Automatically

When you access JADE254 websites or services, certain technical information may be collected automatically.

This may include:

IP address; browser type; operating system; device information; approximate location derived from technical information; pages visited; referral information; interaction with our website; date and time of access; diagnostic information; security and authentication logs; information relating to cookies and similar technologies.

We use this information for purposes including security, service operation, analytics, troubleshooting and improving the JADE254 experience.

1. Information We Receive From Other Sources

We may receive information from third parties where appropriate and lawful.

Examples may include:

payment providers; authentication providers; messaging platforms; analytics providers; advertising platforms; business partners; service providers; publicly available sources; businesses using JADE254 services.

For example, where a payment or payment integration is used, we may receive information such as transaction references, payment status, amount, currency and other information necessary to reconcile or provide the relevant service.

1. Public Business Information

Some JADE254 products are designed to help businesses become discoverable online.

Business users may choose to publish information such as:

business name; business location; business description; opening hours; products or services; photographs; contact channels; booking information; publicly displayed links.

Information intentionally published as part of a public business profile may be visible to other people and may potentially be indexed by search engines.

Business users are responsible for ensuring that information they publish through JADE254 is accurate, lawful and appropriate to make public.

1. How We Use Personal Information

Depending on the service and circumstances, we may process personal information to:

create and manage accounts; provide JADE254 products and services; authenticate users; operate business profiles; process and reconcile transactions; facilitate bookings; provide customer support; communicate with users; send service notifications; maintain security; prevent fraud and abuse; diagnose technical problems; monitor reliability and performance; improve our products; understand how our services are used; develop new products and features; provide analytics; personalize relevant aspects of the service; send marketing communications where permitted; comply with legal obligations; protect our rights and users; investigate security incidents; enforce our Terms of Service.

We will process personal data only where we have an appropriate lawful basis.

Under Kenya's Data Protection Act, lawful processing may include consent, performance of a contract, legal obligations, protection of vital interests, public-interest grounds and legitimate interests where the applicable legal requirements are satisfied.

1. Legal Bases for Processing

Where applicable, we may rely on one or more of the following legal bases:

Consent

Where you have provided consent for a specific purpose, we may process the relevant information for that purpose.

You may withdraw consent where applicable, although withdrawal does not invalidate processing already carried out lawfully before withdrawal.

Contract

We may process information where necessary to provide services you have requested or to take steps before entering into a contractual relationship.

Legal obligation

We may process information where required to comply with applicable law, regulation, court orders or lawful governmental requests.

Legitimate interests

We may process information where necessary for legitimate business interests, such as security, fraud prevention, service improvement and operational administration, provided applicable legal requirements are satisfied and your rights are appropriately considered.

Other lawful grounds

We may rely on another lawful basis where permitted by applicable law.

1. Payments

JADE254 may integrate with third-party payment providers and financial service providers.

Depending on the service, these may include mobile money, card or other electronic payment services.

Where a third-party payment provider processes a payment, that provider may independently process information under its own terms and privacy policy.

JADE254 may receive information necessary to:

identify the transaction; confirm payment; reconcile transactions; provide receipts; process refunds; manage settlements; detect fraud; maintain accurate business records.

JADE254 does not control the independent privacy practices of third-party payment providers.

1. Cookies and Similar Technologies

JADE254 may use cookies, pixels, SDKs, local storage and similar technologies.

These technologies may be used for:

essential website functionality; authentication; security; remembering preferences; analytics; measuring website performance; understanding user interactions; advertising and campaign measurement.

Where required, JADE254 will seek appropriate consent before placing or using non-essential tracking technologies.

Our website may use services such as analytics or advertising technologies provided by third parties, which may include Google Analytics, Meta Pixel and TikTok Pixel, depending on the website configuration.

Third-party providers may receive technical or usage information according to their own policies.

You may be able to manage cookies through your browser or through controls provided by our website.

1. Analytics and Advertising

We may use analytics and advertising technologies to understand how people discover and interact with JADE254.

This can include measuring:

website visits; traffic sources; page interactions; conversions; advertising performance; campaign effectiveness.

Where required by law, appropriate consent will be obtained.

We do not sell your personal information merely because you visit our website.

1. Artificial Intelligence

Some JADE254 products may use artificial intelligence, machine learning or automated technologies.

Depending on the product, information may be processed to:

generate responses; assist users; automate business communications; provide recommendations; generate or transform content; improve product functionality; help users perform business tasks.

AI-generated outputs may be inaccurate, incomplete or inappropriate in particular circumstances. Users remain responsible for reviewing important outputs before acting on them.

Where third-party AI services are used, information submitted to those services may be processed by the relevant provider in accordance with applicable contractual, technical and privacy arrangements.

Users should not submit sensitive personal information to an AI feature unless they are authorized to do so and the relevant product permits it.

1. Business Users and Customer Data

JADE254 may process information belonging to a business's customers, employees, suppliers or other contacts.

Where a business uses JADE254 to manage personal information about its own customers or other individuals, the business may be responsible for determining why that information is collected and how it should be used.

Depending on the processing activity, JADE254 may act as:

a data controller, where JADE254 determines the purposes and means of processing; or a data processor, where JADE254 processes information on behalf of a business according to the business's instructions.

The parties' respective responsibilities may also be defined by additional agreements.

Business users must only collect and submit information to JADE254 where they have a lawful basis and are authorized to do so.

1. How We Share Information

We may share information where reasonably necessary and lawful with:

Service providers

Companies that help us operate JADE254, including providers of:

hosting; databases; cloud infrastructure; authentication; analytics; communications; customer support; security; payment processing; software infrastructure; AI services. Business users

Where necessary to provide a JADE254 service, information may be shared with the business or organization connected to that service.

Payment and financial service providers

Information may be exchanged with payment providers to facilitate transactions, refunds, reconciliation and settlement.

Legal and regulatory authorities

We may disclose information where required by law, court order, lawful request or regulatory requirement.

Corporate transactions

Information may be transferred as part of a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, subject to applicable law.

With your direction or consent

We may share information when you instruct us to do so or otherwise provide appropriate consent.

1. Third-Party Services

JADE254 depends on an ecosystem of technology providers to deliver certain services.

These providers may independently process information according to their respective terms and privacy policies.

JADE254 is not responsible for the privacy practices of third parties outside our control.

We seek to select service providers appropriate to the nature of information being processed and to apply appropriate contractual and technical safeguards.

1. International Data Transfers

Some technology providers used by JADE254 may process information from locations outside Kenya.

Where personal information is transferred outside Kenya, we will seek to comply with applicable data protection requirements and use appropriate safeguards where required.

The location of infrastructure or service providers may change as JADE254 grows and its technology architecture evolves.

1. Data Security

We take reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss or destruction.

Security measures may include:

authentication controls; access controls; encryption where appropriate; audit logging; monitoring; secure software development practices; backups and recovery measures; vulnerability management; least-privilege access; incident response processes.

However, no internet or information system can be guaranteed to be completely secure.

You are responsible for protecting your account credentials, devices and authentication methods.

1. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Retention periods depend on factors including:

the type of information; why it was collected; whether an account remains active; contractual requirements; legal obligations; dispute resolution; fraud prevention; security requirements.

Transaction and financial records may need to be retained for longer periods where required by law or legitimate business requirements.

Where information no longer needs to be retained, we may delete, anonymize or otherwise securely dispose of it as appropriate.

Kenya's Data Protection Act expressly requires retention to be limited to what is reasonably necessary subject to specified exceptions.

1. Your Data Protection Rights

Subject to applicable law and relevant exceptions, you may have rights including:

the right to be informed about processing; the right to access personal information; the right to correct inaccurate or misleading information; the right to object to certain processing; the right to request deletion or erasure where applicable; the right to request restriction of processing where applicable; the right to data portability where applicable; the right to withdraw consent where processing relies on consent; rights relating to certain automated decision-making and profiling.

Kenya's Data Protection Act provides specific rights relating to objection, portability, rectification and erasure, including a statutory portability period in applicable circumstances.

1. Automated Decision-Making

Some JADE254 products may use automation, algorithms or artificial intelligence to assist with particular functions.

Where applicable law gives you a right not to be subjected to a decision based solely on automated processing that produces legal or similarly significant effects, we will respect that right and applicable safeguards.

Kenya's Data Protection Act specifically addresses decisions based solely on automated processing and provides rights relating to reconsideration in applicable circumstances.

1. Children's Privacy

JADE254 is primarily designed for businesses, adults and general users.

We do not knowingly collect children's personal information for purposes that are unlawful or unauthorized.

Where a JADE254 service may involve children, any collection or processing of children's personal data will be subject to the safeguards required by applicable law.

Parents or guardians who believe that a child has provided personal information to JADE254 inappropriately may contact us.

1. Marketing Communications

Where legally permitted and where appropriate, we may send information about:

new products; product updates; business features; offers; events; educational content; important announcements.

You can unsubscribe from promotional communications using the instructions provided in the communication or by contacting us.

Service and security communications may still be sent where necessary to operate your account or provide requested services.

1. Data Breaches

JADE254 maintains processes for identifying, investigating, containing and responding to personal data security incidents.

Where a breach meets the applicable legal threshold, we will make required notifications to the relevant authority and affected individuals within the periods required by law.

Under section 43 of Kenya's Data Protection Act, a controller must notify the Data Commissioner without delay and within 72 hours of becoming aware of a qualifying breach, while a processor must notify its controller without delay and, where reasonably practicable, within 48 hours.

1. Your Responsibilities

You are responsible for:

keeping your account information accurate; protecting passwords and authentication details; ensuring you have authority to submit information belonging to other people; complying with applicable privacy laws when using JADE254; collecting customer information lawfully; providing appropriate notices to your customers where required; publishing only information that you are authorized to publish.

1. Changes to This Privacy Policy

We may update this Privacy Policy from time to time as JADE254 develops new products, introduces new technologies, changes its data practices or responds to legal or regulatory developments.

When we make material changes, we may provide additional notice where appropriate.

The latest version will be published on this page with its effective date.

1. Contact Us

For questions, concerns, requests or complaints concerning privacy or personal information, contact:

JADE254 [LEGAL ENTITY NAME] [REGISTERED ADDRESS] Privacy: [PRIVACY EMAIL] Support: [SUPPORT EMAIL]

When submitting a data request, we may need to verify your identity before processing the request.

1. Complaints

We encourage you to contact JADE254 first so that we can investigate and attempt to resolve your concern.

Nothing in this Privacy Policy limits your right to pursue a complaint with the Office of the Data Protection Commissioner (ODPC) or seek another remedy available under applicable law.

1. Governing Framework

This Privacy Policy is intended to operate consistently with applicable data protection and privacy laws, including the laws applicable in Kenya.

Where mandatory data protection rights in another jurisdiction apply to your processing, those rights will apply to the extent required by law.

JADE254 — Technology for the connected digital economy.