1. Who We Are At Tropikal Brands Afrika Limited (TBAL), safeguarding your privacy and protecting your personal information is our priority. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the Kenya Data Protection Act, 2019 (DPA) and relevant laws.

Our website address is: https://www.tropikal.co.ke.

By using any of our services or website, you agree to the practices described in this policy.

2. Information We Collect We may collect personal information from you when you:

• Make a purchase through our platforms or distributors

• Contact us or request information

• Visit our website or social media platforms

• Participate in surveys or promotions

Types of information collected include:

• Full name

• Contact information (email, phone number, address)

• Payment details (when making transactions)

• Feedback and communication details

• Website usage data (IP address, browser type, device info, etc.)

3. Comments When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

4. Media If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

5. How We Use Your Information Your personal data may be used for:

• Processing and fulfilling your orders for products and services

• Communicating with you about orders, deliveries, or customer service

• Providing you with updates, offers, and relevant information about Tropikal Brands Afrika Limited products

• Improving our services based on feedback and analysis

• Complying with applicable laws and regulations

We will only use your data where we have a legal basis to do so, such as contractual necessity, consent, or legal obligation.

6. Data Storage and Security We take appropriate technical and organizational measures to safeguard your data, including:

• Access controls and secure storage systems

• Encryption of sensitive data

• Password protection and regular password updates for internal systems

• Regular audits and assessments by our ICT team and audit team

7. Cookies and Tracking If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

You can manage your cookie preferences through your browser settings.

8. Embedded Content from Other Websites Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

9. Who We Share Your Data With Your personal data may be shared with:

• Trusted third-party service providers who help us operate our business (e.g., payment processors, logistics partners)

• Legal or regulatory authorities when required by law

If you request a password reset, your IP address will be included in the reset email.

We do not sell or rent your personal information to third parties.

10. Where Your Data Is Sent Visitor comments may be checked through an automated spam detection service.

11. How Long We Retain Your Data In accordance with Section 39 of the Kenya Data Protection Act (2019), Tropikal Brands Afrika Limited retains personal data only for as long as necessary to fulfill the specific purposes for which it was collected, or to satisfy applicable legal, regulatory, accounting, or reporting requirements.

Our statutory data retention periods are defined as follows:

• Website Data, Comments & User Logs: Retained for a period of 7 years in line with legal, administrative, and security record-keeping requirements.

• Registered User Profiles: Retained for the active lifecycle of your account plus 7 years following account closure or inactivity for audit purposes.

• Commercial & Transactional Data: Retained for 7 years to comply with statutory tax, statutory accounting, and commercial auditing obligations under Kenyan law.

• Customer Support & Inquiries: Retained for up to 7 years to resolve legal claims, system diagnostics, and quality assurance evaluations.

Upon the expiration of the mandatory 7-year retention period, or following a successful data erasure request where statutory retention is not required, we securely delete, destroy, or permanently anonymize your personal data.

12. What Rights You Have Over Your Data Under the Kenya Data Protection Act (2019), you have the right to:

• Access your personal data held by us

• Request correction of inaccurate or incomplete information

• Request deletion or erasure of your personal data where applicable

• Object to or restrict certain types of data processing

• Request transfer of your personal data to another provider (Data Portability)

• Withdraw consent where consent was the basis for processing

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, statutory, or security purposes.

To exercise these rights, contact our Data Protection Officer (DPO) / QMR officer at the details below.

13. Contact Us For any questions, requests, or concerns regarding this Privacy Policy or your data, please contact:

Data Protection Officer (DPO) / QMR Officer Tropikal Brands Afrika Limited Email: [email protected] Phone: +254 720 463 841