Privacy notice

Chris Paffett operates BagsyThat personally in Kenya. The operator manages platform accounts, access and security. Each seller uses the customer information for its own transactions and has its own responsibilities. The platform also stores shop records to provide the seller’s tools. Only relevant authorised shop administrators and authorised platform administration can access private records. Anyone holding a private order link can view that order summary: keep it confidential.

We store seller/admin names or emails, password hashes and account permissions; customer names and phone numbers; ordered items, collection dates, payment methods, transaction references, amounts and seller-entered notes; agreement versions and acceptance dates; and limited security/activity records. We do not ask for M-Pesa PINs, bank passwords, card details or identity documents. Photos and descriptions supplied for published listings are public.

Customer details support the reservation and transaction you request. Account data supports providing and securing the service. Relevant processing uses contractual necessity or other appropriate lawful grounds, including legitimate interests where justified and balanced against your rights, or legal obligations where applicable. Accepting terms is not blanket privacy consent. We do not sell customer information or use it for unrelated marketing.

Checkout requires the information shown as required to identify and manage the order; a payment reference is needed only when declaring a relevant payment. If you do not provide required details, online reservation cannot be completed; you can contact the seller directly. Avoid unnecessary personal information in notes or item descriptions.

Application hosting, database records, listing photographs and backups use the external providers and locations disclosed below. Locations describe the configured processing/storage arrangements; they do not guarantee that all provider support access stays within that location.

Application hosting

Railway — EU West (Amsterdam, Netherlands)

Database records

Railway — EU West (Amsterdam, Netherlands)

Listing photographs

Railway — EU West (Amsterdam, Netherlands)

Backups

No automated backups configured — Not applicable - no backup copies

External processing may involve transfers outside Kenya. The operator must assess applicable safeguards and provider agreements before enabling public use. Naming a provider does not itself establish legal compliance.

Email delivery remains disabled. Following WhatsApp links opens a separate service governed by its own privacy terms. Data sent there is handled by that service and the seller. Provider and backup changes require an updated notice and assessment.

We use hashed passwords, signed sessions, family access checks and private order access controls. No system is perfectly secure. The private LAN demo uses HTTP and should use test data; public operation requires HTTPS. Essential cookies/session state support login, shop routing and checkout. Checkout can optionally remember your name and phone in this browser for one shop for up to 30 days. This is off unless you choose it; use Forget my details in checkout to remove it. It never remembers payment codes or private tracking links. Avoid using it on shared devices. This version does not add advertising analytics or marketing cookies. Private pages are excluded from indexing and should not be shared publicly.

The configured policy is to review personal details of closed orders after 24 months without further order changes. Authorised administrators use a preview and controlled anonymisation process; deletion is not automatic. Earlier verified erasure requests can be handled where lawful. Necessary records may be retained longer for an unresolved dispute or legal requirement, with a recorded hold. Financial totals can remain after personal details are removed. Backup copies need a defined expiry and protection; they must not be retained indefinitely or restored without reapplying completed erasure requests. Account, agreement and security records are retained only as needed for their purpose and applicable duties.

You may request access to or a copy of your information, correction, erasure where applicable, objection/restriction and portability where applicable. Consent can be withdrawn where processing relies on consent, without affecting earlier lawful processing. Contact the seller for shop information or the operator for platform information. We verify identity proportionately before sharing or changing records; knowing an order number alone is not sufficient. You may complain to Kenya’s Office of the Data Protection Commissioner. Contact us if you suspect a privacy or security incident.

Contact [email protected] for platform problems, privacy requests or reports of abuse. For item payments, refunds or collection, contact the seller shown on the shop.