Privacy Policy

This Privacy Policy explains how SME4ME ("we," "our," "us," or "the Platform") collects, uses, shares, and protects your personal data when you access or use our services. It is designed in compliance with the Kenyan Data Protection Act (2019), relevant Capital Markets Authority (CMA) regulations, and other applicable laws. By using SME4ME, you consent to the collection and use of your information as described in this Policy.

1. Scope

This Privacy Policy applies to all users of SME4ME, including SMEs seeking investment, investors, co-founders, and business buyers or sellers. It continues to apply even after your relationship with SME4ME has ended.

2. Information We Collect

a. Non-Personally Identifiable Information (Non-PII)

Includes browser type, device type, IP address, pages visited, clickstream data, cookies, and analytics.

b. Personally Identifiable Information (PII)

Includes full name, contact details, date of birth, ID/passport details, financial information, business documents, social media profiles, and investment history.

3. How We Use Your Information

• To create and verify accounts.
• To enable SME–investor matching, business listings, and transactions.
• To comply with legal and regulatory obligations, including KYC and AML requirements.
• To improve platform performance, security, and user experience.
• To communicate with you about your account, opportunities, and updates.

4. Legal Basis for Processing

We process your information on the following grounds:

• Consent (when you register or provide data).
• Legal obligations (e.g., CMA compliance, Data Protection Act, AML/CFT requirements).
• Contractual necessity (to provide services).
• Legitimate interest (to operate and improve SME4ME).

5. Sharing of Information

We may share your information with:

• Verified investors and SMEs for the purposes of matchmaking.
• Regulatory authorities such as the CMA and financial regulators when required.
• Third-party service providers (e.g., KYC processors, payment partners).
• Legal or enforcement agencies when required by law.

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data only for as long as is necessary for the purposes set out in this Policy, and as required by law (e.g., regulatory record-keeping obligations).

7. Data Security

We implement technical, administrative, and physical safeguards to protect your data. This includes encryption, secure servers, restricted access, and periodic audits. However, no system is 100% secure and we cannot guarantee absolute security.

8. Cookies & Tracking

SME4ME uses cookies, analytics, and similar technologies to enhance your experience. You can control cookie preferences via your browser settings.

9. Your Rights

Under the Kenyan Data Protection Act, you have the right to:

• Access your personal data.
• Request correction or deletion.
• Withdraw consent at any time.
• Object to or restrict processing.
• Request data portability.

Requests can be made by contacting privacy@sme2me.co.ke

10. Cross-Border Transfers

If your data is transferred outside Kenya, we ensure adequate safeguards are in place, including compliance with applicable data protection requirements.

11. Children's Privacy

SME4ME services are not directed to persons under 18 years of age. We do not knowingly collect data from minors.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Updates will be posted on the Platform with the effective date indicated. Continued use of SME4ME after updates constitutes acceptance.

13. Contact Information

For questions, concerns, or to exercise your rights, please contact us at privacy@sme2me.co.ke