BidFiti

Privacy Policy

Last updated: 28 June 2026

This Privacy Policy explains how Araknet Labs Limited, a company incorporated in Kenya trading as "BidFiti" ("BidFiti", "we", "us", or "our"), collects, uses, shares, and protects your personal data when you use the BidFiti online auction platform at www.bidfiti.com (the "Platform").

We are the data controller for personal data processed through the Platform. We are committed to handling your data lawfully, fairly, and transparently, in accordance with the Kenya Data Protection Act, 2019 and its Regulations.

By using the Platform, you agree to the collection and use of information as described in this Policy.

1. Scope

This Policy applies to:

  • visitors who browse the Platform;
  • registered Bidders who participate in auctions; and
  • Listers who list assets for sale.

2. Information We Collect

2.1 Information you provide

  • Account information: name, email address, phone number, and password (stored only in hashed form).
  • Bidder activity: bids placed, auctions unlocked, wallet top-ups and withdrawals, and transaction history.
  • Lister verification (KYC): business registration documents (e.g. Certificate of Incorporation, KRA PIN), director identification, proof of business address, and proof of authority to sell assets.
  • Communications: messages you send us through contact forms, support requests, or email.

2.2 Information collected automatically

  • Technical and usage data: IP address, device and browser type, pages viewed, timestamps, and interactions with the Platform.
  • Cookies and similar technologies: used for authentication, session management, and analytics (see Section 10).

2.3 Payment information

  • We receive payment confirmation data (such as transaction references and status) from our payment partners. We do not store full card numbers — card payments are handled directly by our payment processor.

3. How We Use Your Information

We use your personal data to:

  • create and manage your account and verify your email;
  • operate auctions, process bids, and manage the bid unlock and wallet systems;
  • verify Listers and the assets they list;
  • process payments, refunds, success fees, and forfeiture penalties;
  • communicate transactional updates (bids, outcomes, payment reminders, deadlines);
  • prevent fraud, abuse, bots, and bid manipulation, and maintain Platform integrity;
  • comply with legal, tax, and regulatory obligations; and
  • analyse and improve the Platform.

4. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we rely on one or more of the following bases:

  • Consent — for optional communications and where you choose to provide certain information.
  • Performance of a contract — to provide the auction services you request.
  • Legitimate interests — to operate the Platform securely, prevent abuse, and improve our services.
  • Legal obligation — where processing is required by law or a competent authority.

5. How We Share Your Information

We do not sell your personal data. We share data only as necessary to operate the Platform, with the following categories of recipients:

Partner Purpose Data Shared
Safaricom (M-Pesa) Mobile money payments Phone number, transaction amounts and references
Paystack Card payment processing Payment and transaction data
Firebase / Google Cloud Hosting, authentication, and database Account, auction, wallet, and transaction data
Vercel Website hosting & privacy-friendly analytics Technical/usage data (e.g. page views, device, region)

We may also disclose data where required by law — for example to courts, the Kenya Revenue Authority, regulators, or law enforcement — or in connection with a business sale or merger, in which case we will notify you.

6. International Data Transfers

Some of our service providers (such as Google Cloud and Vercel) operate infrastructure outside Kenya. Where personal data is transferred across borders, we rely on reputable providers with recognised security standards and appropriate contractual safeguards.

7. Data Security

We implement technical and organisational measures to protect your data, including:

  • encrypted connections (HTTPS/TLS) for all data in transit;
  • server-side authentication and session validation;
  • database security rules and role-based access controls;
  • hashed password storage; and
  • logging and monitoring of significant actions.

No system is completely secure, but we take reasonable steps to protect your data against loss, misuse, and unauthorised access.

8. Data Retention

We keep personal data only for as long as necessary for the purposes described above and to meet legal obligations:

Data Type Retention Period
Financial & transaction records 7 years (tax and audit compliance)
Bid and auction history 7 years (audit trail, dispute resolution)
Account information Duration of account + 2 years after closure
Lister KYC documents Duration of relationship + as required by law
Marketing preferences Until you opt out

After the retention period, data is securely deleted or anonymised.

9. Your Rights

Subject to applicable law, you have the right to:

  • access the personal data we hold about you;
  • correct inaccurate or incomplete data;
  • request deletion of your data (where applicable);
  • object to or restrict certain processing;
  • withdraw consent where processing is based on consent;
  • request portability of your data; and
  • lodge a complaint with the supervisory authority.

Self-service tools. From your account Settings page you can:

  • Download your data — export a copy of the personal data we hold about you as a JSON file (right of access and portability); and
  • Delete your account — remove your personal data and access. For legal and tax compliance, transaction and bid records are retained in anonymised form for the periods in Section 8 rather than erased immediately.

For any other request, or to exercise these rights another way, contact us at privacy@bidfiti.com. We may verify your identity before responding.

You also have the right to complain to the Office of the Data Protection Commissioner (Kenya):

10. Cookies & Analytics

We use:

  • Essential cookies — required for login, security, and core Platform functions; and
  • Analytics — we use Vercel Analytics, a privacy-friendly analytics tool that helps us understand traffic and performance without intrusive personal tracking.

You can manage cookies through your browser settings. Blocking essential cookies may prevent you from logging in or bidding.

11. Children's Privacy

The Platform is not intended for anyone under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us so we can delete it.

12. Third-Party Links

The Platform may contain links to third-party websites (for example, payment partners or social media). We are not responsible for the privacy practices of those sites. Please review their privacy policies separately.

13. Changes to This Policy

We may update this Policy from time to time. The revised version will be posted on the Platform with an updated "Last updated" date. Material changes will be notified on the Platform.

14. Contact Us

For any privacy questions or requests:

Araknet Labs Limited (trading as BidFiti) — Data Controller

By using BidFiti, you acknowledge that you have read and understood this Privacy Policy.