Tropika Farm Inputs Company Limited (“Tropika”, “we”, “us”, “our”) is committed to protecting your personal data in accordance with Kenya’s Data Protection Act, 2019 and its subsidiary regulations. This policy explains what personal data we collect, why, how we use it, who we share it with, and the rights you have over it.
Effective date: 4 August 2026
Last updated: 4 August 2026
1. Who we are
Tropika is a vegetable and crop seed distribution business based in Nairobi, Kenya, trading as Tropika Seeds at tropika.co.ke. For the purposes of the Data Protection Act, 2019, Tropika Farm Inputs Company Limited is the data controller of the personal data described in this policy — we determine the purposes and means of processing it.
Contact details:
- Address: Room 29, 2nd Floor, Lois Plaza for Business, Latema Rd, Nairobi, 00100, Kenya
- Phone / WhatsApp: +254 740 232780
- Email: [email protected]
We have not appointed a formal Data Protection Officer, as our size does not require one under the Act. For any data protection question, complaint, or request, contact us using the details above.
2. What personal data we collect
Depending on how you interact with us, we may collect:
- Identity and contact details: name, phone number, email address, physical/delivery address, delivery country
- Order details: what you’ve ordered, order history, company name and KRA PIN (for VAT-registered business or bulk customers)
- Communications: WhatsApp messages, bulk order enquiry messages, and any media you send us; notes from phone or in-person conversations
- Reviews: if you submit a product review via an invite link, your name and the review text/rating you provide
- Website and marketing data: pages visited, the campaign/link that brought you to our site (e.g. Facebook, Google, TikTok ad clicks), and identifiers from those platforms used to measure ad performance (see section 8 below)
- Account/access data (staff only, not customers): login information for our internal systems (Tropika Staff product-image and review-invite tools)
We do not intentionally collect sensitive personal data (health information, biometric data, political or religious affiliation, etc.) and ask that you do not include such information in any message or form you send us.
3. How we collect it
- Directly from you: our website’s checkout and Bulk Orders enquiry forms, WhatsApp messages, phone calls, and product review submissions
- Automatically: cookies and similar technologies on our website (see section 8)
- From our own records: your order history and past communications with us
4. Why we collect it, and our legal basis
| Purpose | What data | Legal basis (Data Protection Act, s.30) |
|---|---|---|
| Processing and fulfilling your order | Name, phone, email, order details, delivery address/country | Contractual necessity — we need this to provide the goods you’ve requested |
| Invoicing and tax records | Name, company details, KRA PIN | Legal obligation — required for Kenyan tax law compliance |
| Customer support (WhatsApp, phone, email) | Name, phone, messages | Contractual necessity / consent |
| Displaying product reviews | Reviewer name, review text, rating | Consent — you opt in when you submit a review via an invite link |
| Marketing communications | Name, phone, email | Consent — you can opt out at any time |
| Measuring the effectiveness of our advertising | Hashed phone/email, ad-click identifiers (see section 8) | Consent — captured via our website’s cookie consent banner; you can withdraw it at any time |
| Fraud and spam prevention | IP address, submission metadata | Legitimate interest |
5. Who we share your data with
We share personal data with the following categories of recipients, only as needed to run our business:
- Our internal systems: our customer relationship management system (built on Google Firebase/Firestore), used to record and manage your order, contact details, and communications with us
- WhatsApp (Meta Platforms, Inc.): if you message us on WhatsApp, your messages are handled through Meta’s WhatsApp platform
- Advertising platforms (Meta, Google, TikTok): when you interact with our ads or visit our website after clicking an ad, we send a cryptographically hashed (irreversibly scrambled) version of your phone number/email, plus ad-click identifiers, to these platforms to measure ad performance. They cannot use these hashes to identify you without also independently having your original phone number/email themselves.
- Legal/regulatory authorities, if required by law
We do not process payment on our website. Payment for confirmed orders is arranged directly with our team (e.g. M-Pesa, bank transfer) — we only share the payment confirmation details you give us (e.g. an M-Pesa reference) as needed to reconcile your order.
We do not sell your personal data to anyone.
Cross-border data transfers
Several of the recipients above are based, or store data, outside Kenya:
- Our CRM’s data (Google Firebase/Firestore) is hosted on Google Cloud infrastructure in the United States.
- Meta (WhatsApp, advertising) processes data on servers outside Kenya.
- Google (advertising, analytics) processes data on servers outside Kenya.
- TikTok processes advertising-measurement data outside Kenya.
Where we transfer your personal data outside Kenya, we rely on the fact that these providers maintain internationally recognised data protection safeguards, consistent with section 48 of the Data Protection Act.
6. How long we keep your data
- Order and invoice records: 10 years
- WhatsApp messages and enquiry records: 2 years from last contact
- Leads that never convert to an order: 12 months from last activity
- Published product reviews: retained for as long as the review remains displayed on the site, plus a reasonable period after removal
- Marketing/ad-attribution data: click identifiers are automatically discarded from our systems after 30 days if not tied to a completed order; order-linked attribution data is retained with the order record
- Website cookies: as described in section 8 below
When we no longer need your data for the purposes it was collected for, and are not legally required to keep it, we delete or anonymise it.
7. Your rights
Under the Data Protection Act, 2019, you have the right to:
- Be informed about how your data is processed (this policy)
- Access the personal data we hold about you
- Correct inaccurate or outdated data we hold about you
- Object to processing of your data, including for direct marketing
- Request erasure of your data, subject to our legal obligations (e.g. we cannot erase invoice records required for tax purposes)
- Data portability — request your data in a portable format
- Withdraw consent at any time, where processing is based on consent (e.g. marketing messages, advertising-measurement cookies), without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, contact us at [email protected] or +254 740 232780. We will respond within a reasonable time and in accordance with the Act.
8. Cookies and website tracking
Our website uses cookies and similar technologies for:
- Essential site function (e.g. remembering items in your cart)
- Analytics (Google Analytics, via Google Tag Manager) — to understand how visitors use our site
- Advertising measurement (Meta Pixel, TikTok Pixel, Google Ads) — to understand which of our ads led to a visit or order
- Attribution capture — when you arrive via a link containing campaign information (e.g. a Facebook or Google ad click), we store that information in your browser so that if you later place an order, we know which campaign led to it
You can control or withdraw cookie consent at any time via the cookie banner on our site, or through your browser settings. Declining non-essential cookies does not affect your ability to use our site or place an order — it only affects our own ability to measure which marketing efforts are working.
9. Security
We take reasonable technical and organisational measures to protect your personal data, including access controls on our internal systems, encrypted transmission of data (HTTPS), and restricting access to your data to staff who need it to serve you.
No system is completely secure, and we cannot guarantee absolute security, but we take these risks seriously and review our safeguards regularly.
10. Children’s data
Our services are intended for adult consumers and agricultural businesses. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Complaints
If you have a concern about how we’ve handled your personal data, please contact us first at [email protected] so we can try to resolve it directly.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):
- Website: www.odpc.go.ke
- Email: [email protected]
12. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it was last revised. Significant changes will be communicated via our website.