Legal

Privacy notice

Last updated 19 Oct 2026

Who we are

Ekomara is operated by ENOMARA Investments Ltd, Nairobi, Kenya (“we”). Businesses use it to answer and follow up the customers who contact them. Questions or requests about personal data: [email protected].

Two kinds of data, two roles

• Your Ekomara account. When you sign up or join a workspace, we decide how your account data is used, so we are its controller.
• A business’s conversations and contacts. The messages, contact details and records a business brings into its workspace belong to that business. The business is the controller of that data; we process it only on its behalf and on its instructions, as its data processor.

If you are a customer of a business that uses Ekomara and have a question about your messages or details, please contact that business first. If you write to us instead, we will pass your request to the business and help it answer.

Workspace members: what we collect and why

• Your account — your name, email address and password. The password is checked by our sign-in service and is never stored in readable form.
• Your work in a workspace — the workspaces you belong to, your role and teams, and what you do there, such as replies, notes and assignments. The business keeps these as part of its own records.
• Emailed codes — sign-in, password reset and verification codes. We keep only a keyed hash of each code, never the code itself, and each code expires after ten minutes.
• Security records — our sign-in service keeps a record of sign-ins, including the IP address used, for a limited period to protect accounts, for example against password guessing.
• Audit records — important changes, such as who changed a setting and when. Here we keep a salted hash of your IP address, never the address itself.
• Your choices — if you tell us whether you want product news by email, we record your answer with its date and the version of this notice.
• Cookies — only the cookies that keep you signed in. We use no advertising or analytics cookies.

We use this data to run your account, keep Ekomara secure, answer you and meet our legal obligations. We rely on our contract with you or your business, on our legitimate interest in keeping the service secure, and, for product news, on your consent.

Businesses’ data: what we process for them

A business’s workspace can hold:

• messages between the business and its customers, anything shared in them, and whether they were delivered and read;
• customer contact details such as names and phone numbers, and the notes, leads, tasks and consent records the team adds;
• the business’s own catalogue and price list.

We use this data only to provide Ekomara to that business. We do not sell it, use it for advertising, or use one business’s data for another.

WhatsApp and Meta

Ekomara connects to WhatsApp only when a business links its own WhatsApp Business number through Meta’s WhatsApp Business Platform. Messages between that business and its customers then pass through Meta’s systems as well as ours, and Meta’s own terms and privacy policy cover its part. The access token a business gives us for its number is stored encrypted.

No artificial intelligence

Ekomara does not use artificial intelligence on conversations or personal data, and it makes no automated decisions that have legal or similarly significant effects on anyone.

Who else sees data

• People in a workspace, according to the roles the business gives them.
• Service providers that help us run Ekomara, such as hosting and network protection. They get only what their task needs and act on our instructions.
• Meta, for a business that connects WhatsApp, as described above.
• Authorities, when the law requires it.

We do not sell personal data.

Where data is processed

Some processing happens outside Kenya: WhatsApp messages pass through Meta’s systems, and our hosting and service providers may be located abroad. When personal data leaves Kenya, we transfer it only as the Kenya Data Protection Act, 2019 allows.

How long we keep it

• Your account data, for as long as your account is open. When an account is closed, sign-in is switched off; the record of work done in a workspace stays with that business.
• A business’s workspace data, for as long as the business uses Ekomara. When it leaves, we delete or return the data as it instructs, unless the law requires us to keep some of it.
• Security and audit records, for as long as we need them to protect the service and to answer questions about what happened.

How we protect it

Connections to Ekomara are encrypted. Access tokens for connected channels are encrypted at rest, codes are stored only as keyed hashes, IP addresses in the audit log only as salted hashes, and inside a workspace people see only what their role allows. No system is perfectly secure: if a breach puts personal data at risk, we will tell the businesses and people affected, and the Data Protection Commissioner, as the law requires.

Your rights

Under the Kenya Data Protection Act, 2019 you may ask what personal data we hold about you, get a copy, have it corrected or deleted, or object to how we use it, and you may withdraw a consent at any time. Write to [email protected] and we will answer within the time the law allows. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner. For data a business holds about you as its customer, the business answers your request, and we help it.

Children

Ekomara is a tool for businesses and is not meant for anyone under 18.

Changes

When this notice changes, the date at the top changes with it.

See also the terms of use.