Privacy Policy

• Account data — name, username, email, phone number, country and the password hash (we never see your password).
• Brief data — the event details you post: type, date, location, guest count, budget range and your description.
• Vendor data — for businesses: trading details, services, coverage, packages, portfolio images, and the verification documents you upload (national ID or passport, KRA PIN certificate, business permit).
• Transaction data — bookings, quotes, credits and payment references. Card and M-Pesa details go directly to our payment provider; we never store them.
• Technical data — IP address, device and browser type, and pages viewed, used to keep the service secure and working.

• To run your account and provide the service (contract).
• To match your brief to relevant vendors and let them respond (contract).
• To verify that businesses are who they claim to be, and to prevent fraud (legitimate interest, and legal obligation).
• To take payment and keep tax records (legal obligation).
• To send service messages. Marketing email only goes out with your consent, and every message carries an unsubscribe link.

Your brief is never public. Vendors browsing leads see an anonymised preview — category, county, date, guest count and budget band. Your name, phone number, email and the full brief become visible to a vendor only when they unlock the lead, and to no more than a small fixed number of vendors.

Verification documents are visible only to Lefimer staff performing checks. They are never shown on a public listing.

What is public: a vendor’s listing, packages, portfolio and reviews; a published event; and the display name and username on a review you leave.

Service providers who process data on our instructions: our hosting and database provider, our object storage provider, our payment processor, our email and SMS providers. We share only what each needs. We do not sell personal data.

We may disclose data where the law requires it, or to establish or defend legal claims.

Our database is self-hosted and our files are held with an international storage provider, so some data is processed outside Kenya. Where that happens we rely on contractual safeguards with the provider to keep the protection equivalent.

• Account data: while your account is open, then 12 months.
• Briefs and quotes: 24 months after the event date.
• Verification documents: while the listing is active, then 12 months.
• Transaction records: 7 years, as tax law requires.

Under the Data Protection Act, 2019 you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service. You may also withdraw consent to marketing at any time.

Email [email protected] and we will respond within 30 days. If you are not satisfied you may complain to the Office of the Data Protection Commissioner.

We use cookies that are necessary for the service: a session cookie that keeps you signed in across lefimer.com and console.lefimer.com, and a preference cookie that remembers light or dark mode. We do not use advertising cookies.

Lefimer is not for anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

We will post any update here and change the date at the top. Material changes will be notified by email. See also our Terms of Service.