Becof Organic Chemicals

    Privacy Policy

    Last updated: 23 October 2026

    1. Introduction

    Becof Organic Chemicals Limited ("Becof", "we", "us", or "our") is committed to protecting the privacy and personal data of everyone who visits becoforganicchemicals.com, creates an account, places an order, applies to become a distributor, or otherwise interacts with our platform (collectively, the "Services"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it.

    This Policy is written to comply with the Data Protection Act, 2019 of Kenya and its subsidiary regulations, including the Data Protection (General) Regulations, 2021. If you access our Services from outside Kenya, other data protection laws that apply to you (such as the EU/UK GDPR) may also give you additional rights; nothing in this Policy limits rights you have under a law that applies to you.

    2. Who We Are

    Becof Organic Chemicals Limited is a private limited company incorporated in Kenya, with its production facility in Ongata Rongai, Kajiado County. We are the "data controller" for the personal data described in this Policy — the entity that decides why and how your personal data is processed.

    • Company: Becof Organic Chemicals Limited
    • Location: Ongata Rongai, Kajiado County, Kenya
    • Email: info@becoforganic.com
    • Phone: +254 735 283 397
    • Data Protection Commissioner registration: [To be completed — registration with Kenya's Office of the Data Protection Commissioner (ODPC), where applicable, should be confirmed with legal counsel before this Policy is treated as final.]

    3. Information We Collect

    We collect the following categories of personal data, depending on how you use our Services:

    3.1 Account & Profile Information

    • Full name, email address, phone number
    • Profile photo/avatar, if you choose to upload one
    • Password (stored only as a secure, one-way hash — we never see or store your plaintext password)
    • For farmers: farm location, farm size, crop types, bio
    • For distributors/partner applicants: business name, business location, coverage area, years in business, KRA PIN and business registration documents (where submitted as part of a distributor application), and any supporting documents you upload

    3.2 Order & Transaction Information

    • Shipping/delivery address and contact phone number for each order
    • Products ordered, quantities, prices, order status, and delivery notes
    • M-Pesa phone number, M-Pesa checkout/transaction references, and M-Pesa receipt numbers (see Section 7 for detail on payment data)
    • Coupon codes applied and loyalty points earned, redeemed, or adjusted
    • Custom/bulk order requests and any specifications you provide

    3.3 Content You Submit

    • Product reviews, star ratings, and any photos you attach to a review
    • Testimonials you submit for publication
    • Messages sent through our contact form, and any attachments (e.g. CVs submitted through a careers application)

    3.4 Technical & Usage Information

    • IP address, browser type, and device information, collected automatically by our hosting infrastructure for security and abuse-prevention purposes
    • Information stored in your browser via cookies and local storage — see Section 8

    We do not knowingly collect sensitive categories of personal data (such as health, biometric, or genetic data) through the Services, and we ask that you do not include such information in free-text fields (e.g. contact messages or review comments) unless it is strictly necessary and directly relevant.

    4. How We Use Your Information

    We use your personal data to:

    • Create and manage your account, and authenticate you when you sign in
    • Process, fulfil, and deliver your orders, including contacting you about delivery fees and logistics
    • Process payments via M-Pesa and reconcile transactions
    • Operate our loyalty points and referral program, including calculating points earned, applying redemptions, and crediting referral bonuses
    • Respond to enquiries submitted through our contact form, and process distributor, partner, or career applications
    • Display product reviews and testimonials you choose to submit publicly
    • Send transactional emails (order confirmations, payment receipts, delivery updates, password resets)
    • Maintain the security, integrity, and proper functioning of our platform, including preventing fraud and abuse
    • Comply with our legal obligations, including tax, consumer protection, and company law requirements

    6. Third Parties We Share Data With

    We do not sell your personal data. We share personal data only with service providers who process it on our behalf to operate the Services, under contractual obligations to protect it:

    • Safaricom PLC (M-Pesa / Daraja API) — to initiate and confirm mobile money payments
    • Cloud infrastructure and database providers (our platform is built on Supabase/Lovable Cloud infrastructure) — to host our database, authentication system, and file storage
    • Resend — to deliver transactional emails (order confirmations, receipts, notifications)
    • Google Analytics — only if you've consented to analytics cookies, to help us understand site traffic and usage patterns
    • Meta Platforms (Meta Pixel) — only if you've consented to marketing cookies, to measure how our Facebook and Instagram ads perform (page views, enquiries, applications and purchases — not the contents of your forms)
    • Google (Merchant Center tag) — only if you've consented to marketing cookies, to measure how our Google Shopping listings perform (page views and purchases)
    • Professional advisers (accountants, auditors, lawyers) — where necessary for our legitimate business operations
    • Regulators and law enforcement — where required by law, court order, or to protect our legal rights

    We may also disclose information if Becof undergoes a merger, acquisition, or sale of assets, in which case personal data may be transferred as part of that transaction, subject to the same protections described in this Policy.

    7. M-Pesa & Payment Data

    When you pay via M-Pesa, we collect your phone number, an M-Pesa checkout request reference, and — once payment succeeds — the M-Pesa receipt number and confirmed amount. We never see, collect, or store your M-Pesa PIN. PIN entry happens entirely within Safaricom's own STK push prompt on your phone, outside of our platform. Payment authorisation and fund transfer are handled directly by Safaricom's Daraja payment infrastructure under Safaricom's own terms and privacy practices.

    8. Cookies & Local Storage

    We use browser local storage for essential functionality — keeping you signed in, capturing a referral code, and remembering dismissed prompts — which runs regardless of consent, since the site can't work without it. With your explicit consent, given via the cookie banner on your first visit, we also use Google Analytics to understand site traffic, and the Meta Pixel and Google's Merchant Center tag to measure our ads and Shopping listings; none of these is loaded unless you agree to it, and you can change that choice at any time. See our Cookie Policy for full detail, including how to review or withdraw your consent.

    9. Data Retention

    We retain personal data only for as long as necessary for the purposes described in this Policy:

    • Account data — for as long as your account remains active, plus a reasonable period afterward in case you wish to reactivate it
    • Order and transaction records — for the period required by applicable Kenyan tax, company, and consumer protection legislation
    • Reviews and testimonials — until you request removal or close your account
    • Contact form messages and job applications — for as long as reasonably necessary to respond to and process your enquiry or application

    Where you request deletion of your account (see Section 12), we will delete or anonymise personal data that we are not otherwise required to retain by law.

    10. Data Security

    We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including:

    • Encryption of data in transit (HTTPS/TLS) across the entire platform
    • Row-level access controls on our database, so customer data is only accessible to the account it belongs to, or to authorised staff performing their duties
    • Role-based access controls for staff, with individually granted permissions rather than blanket administrator access
    • An internal audit log of administrative actions taken on customer and order records
    • Passwords stored only as salted, one-way cryptographic hashes

    No system is completely secure, and we cannot guarantee absolute security of information transmitted to us. If you believe your account has been compromised, contact us immediately using the details in Section 16.

    11. International Data Transfers

    Our cloud infrastructure and email delivery providers may process and store data on servers located outside Kenya. Where personal data is transferred outside Kenya, we take steps intended to ensure it receives a comparable level of protection, in line with the requirements of the Data Protection Act, 2019 governing cross-border data transfers. If you would like more detail on the specific safeguards in place, contact us using the details in Section 16.

    12. Your Rights Under Kenyan Law

    Under the Data Protection Act, 2019, you have the right to:

    • Access the personal data we hold about you
    • Rectify personal data that is inaccurate or incomplete
    • Erasure of personal data we no longer have a lawful basis to hold
    • Object to processing carried out on the basis of legitimate interests
    • Restrict processing in certain circumstances
    • Data portability — receive certain data you provided to us in a structured, commonly used format
    • Withdraw consent at any time, where processing is based on consent
    • Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya if you believe we have not handled your data lawfully

    To exercise any of these rights, contact us using the details in Section 16. We will respond within the timeframes required by law. We may need to verify your identity before acting on a request.

    13. Children's Privacy

    Our Services are intended for use by individuals who are at least 18 years old, or who otherwise have the legal capacity to enter into a binding contract under Kenyan law. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

    14. Marketing Communications

    We may send you order-related and account-related emails (order confirmations, payment receipts, delivery updates, security notices) as a normal part of operating the Services — these are not optional, as they are necessary to fulfil your orders and secure your account. If we introduce promotional or marketing communications in the future, we will only send these with your consent, and every such communication will include a clear way to opt out.

    15. Changes to This Policy

    We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be highlighted on our website. Your continued use of the Services after a revised Policy takes effect constitutes acceptance of the changes.

    16. Contact Us & Complaints

    If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

    If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

    Chat with us