Privacy Policy

A. INTRODUCTION

This Privacy Notice describes how Portal Pharmacy Limited (referred to in this notice as “we”, “us”, “our” and “Portal”) collect and process personal information about you, how we use and protect this information, and your rights in relation to this information. This Privacy Notice applies to personal information we collect or process about you in relation to Portal’s website, mobile application or other digital services (each a “Digital Service”) linking to this Privacy Notice or any hard copy (paper) form used to subscribe to our services, blog or other publication, enter a competition or provide your details at an event (each a “Subscription Form”).

 

If you have a query about this Privacy Notice or our data practices, we have provided details of the relevant Portal businesses and affiliate, the specific items they are responsible for and contact details in the “Contact Us” section below.

This Privacy Notice describes the privacy practices of Portal only and does not cover the practices of other companies, including those that advertise or sponsor content, products or services on the Digital Services as explained further in the section “How We Share Information” below.

The laws applicable to this Privacy notice and www.portalpharmacy.ke are the English Data Protection Laws enacted and enforced in the United Kingdom. They shall be applicable even as they are revised from time to time.

B. WHAT INFORMATION WE OBTAIN

When you use a Digital Service or complete a Subscription Form, we obtain various types of information related to you and your use of the Digital Service. This includes information that directly identifies you such as your name, email address, or contact information as well as information such as online identifiers and cookie data, which may indirectly identify you. The information we obtain generally consists of information (1) you give us about yourself, (2) you give us about others, (3) automatically collected about your interactions with the Digital Services and our content or ads on third-party websites, apps or other media, and (4) we get from other sources as described further below.

1 . Information we collect directly from you

When you use certain features of the Digital Services or complete a Subscription Form, we ask you to provide information about yourself. For example, to open an account with us you will have to give us your registered mobile number, to subscribe to one of our newsletters or updates, you will need to give us an email address. You may not be able to use certain features if you choose not to submit the requested information.

The information you give us includes details such as:

Contact information (e.g., name, mailing address, email address or phone number).

Demographic, interests and household information (e.g., age, gender or certified and procedurally procured medical prescription information).

Payment information for purchase of products through our website made through the Digital Services (e.g., payment card number, expiration date and billing information, mobile money registered Phone number).

Comments, photos, videos and other content or information you choose to publish on the Digital Services or otherwise share with us.

 

Information you provide when you choose to participate in surveys, competitions, promotions (including information about your participation in activities that generate loyalty or rewards points) and/or events, promotions, sales and campaigns.

Location information, including precise location information when you permit the Digital Services to access device location. To prevent the collection of precise location information, please refer to instructions provided by your mobile service provider or device manufacturer.

Your geo and geotagged location including but not limited to your IP address as well as metadata. Other information you allow us to access through your device’s permissions settings, such as your contacts or address book.

Transactional and activity information (e.g., requests, searches or orders).

2. Information you provide about others

You may give us information about other people, such as the name and email of a friend or contact with whom you want to share an article, a promotion, or obtain from a prescription with or the name, phone number and address of a recipient you wish to gift. Do not give us information about others unless you are authorised or have their permission to do so. We will use their information for the purposes described in this Privacy Notice.

3. Information automatically collected

The Digital Services automatically log certain information about visits to the Digital Services – the number and frequency of users, technical information about browsers and devices used to access the Digital Services, and information about crashes or other technical issues. In addition, in accordance with your expressed preferences, we and third parties automatically collect certain information through automated means about your activities over time across the Digital Services as well as across third-party sites, apps or other media. The tools that collect this information vary depending on the Digital Services and include technologies such as cookies, web beacons, tags, scripts, pixels, local shared objects (including HTML5 cookies) and software development kits (“SDKs”) (referred to collectively as “Cookies and Similar Technologies”).

The information automatically collected includes the following:

Information about your computer, device, browser and operating system (e.g., type, model, or version).

Internet protocol (IP) address, which can be used to derive your general geographic area (e.g., city and country).

Device identifiers (e.g., mobile advertising IDs).

Information about your interactions with the Digital Services, including browsing activities and clickstream data that reflect the content you have accessed, clicked on, or viewed.

Information about how you accessed the Digital Services, including details about websites or apps visited immediately before or after accessing the Digital Services.

Demographic, interests and household information.

 

Information about your interactions with email messages and other communications, such as whether you opened or forwarded the email or clicked on links contained in the email.

Some Cookies and Similar Technologies assign or collect unique cookie IDs or other identifiers associated with your browser or device. Cookies and Similar Technologies may collect information while you are using our Digital Services or while they are running in the background of your device. More information about the Cookies and Similar Technologies used on the Digital Services, including how to manage your preferences, is available in our “Cookies Policy”.

4. Information we obtain from other sources

We receive information about you from other sources and in certain circumstances combine it with other information about you. For example, we may obtain data from:

Operators of third-party sites or apps, content distribution channels and platforms (e.g., Roku, Amazon Fire TV), voice-activated assistants (e.g., Amazon Alexa, Google Home) or other devices and technologies when you interact with our content, products, services or ads available on those channels and platforms. The information we receive includes information about the content you view or access as well as your demographic information and information about your interests.

Third-party data suppliers such as data aggregators, data resellers, public databases and business partners. They provide us with demographic information, information about your purchases, and information that helps us learn about you and other users of the Digital Services.

Social Media Platforms and similar services (“Social Media Platforms”). When you engage with our content or ads on Social Media Platforms, or interact with features on the Digital Services that contain content or features provided by Social Media Platforms (e.g., login or sign in features or tools that allow you to share our content with others on Social Media Platforms), we might obtain information from Social Media Platforms, including your username, user ID, and demographic information, subject to the settings and privacy practices of the relevant Social Media Platform. We obtain this information directly from the Social Media Platform or through plug-ins, integrations or applications. Please keep in mind that the operators of the Social Media Platforms also gather information about your use of the Digital Services and their features and tools. We are not responsible for their practices.

C. HOW WE USE INFORMATION WE OBTAIN

Should you make a purchase or place an order through or in connection with a Digital Service or a Subscription Form, we use your payment information (e.g., your card number and expiration date, mobile money registered number) for the purposes of processing your transaction (including recurring payments, if applicable), to provide you with the requested products or services and to protect our rights or the rights of others as described below.

With respect to information other than your payment information, we use that information: To provide you with the Digital Services or Other Requested Services. This includes:

 

Processing your requests regarding the Digital Services and our subscriptions, products or services, or your participation in a survey, competition, promotion, event, exclusive sale, social media campaign, social media trend, social media giveaway or similar initiative.

Providing customer assistance or technical support.

Customising content, providing recommendations and enhancing the quality and your overall experience with the Digital Services, including by retaining your user preferences or presenting content in the most effective manner for the browser or device you use to access the Digital Services.

Maintaining, operating, improving and developing the Digital Services and related content, products or services including developing new features and campaigns or product related sales based on users’ interactions with the Digital Services.

Learning about users of the Digital Services and analysing how you and others interact with and respond to the Digital Services, including by measuring and optimising usage, reliability and performance, conducting market research, analysing trends, and supporting our operations (e.g., for accounting, auditing, financial, legal or other purposes).

To communicate with you. This includes:

Sending you informational messages, both electronic and text about the Digital Services (e.g., to confirm your subscription or notify you of changes to a Digital Service).

Delivering marketing or promotional communications, including offers or promotions about our or third parties’ products, services or other initiatives.

Responding to your questions or addressing your requests.

Communicating with you about surveys, sales, competitions, promotions, campaigns or events.

For advertising and marketing purposes, including interest-based advertising. Depending on your preferences, including for the use of Cookies and Similar Technologies, this may include: Developing, managing and conducting advertising and marketing campaigns, promotions and offers, including about our content, products and services or third-parties’ products, services and other initiatives.

Interest-based advertising (also known as targeted or personalised advertising or ads) is advertising based on your interests as inferred from your activities over time on the Digital Services and online services operated by third parties, as well as information from other sources. Interest- based ads consist of text ads, images, animations or videos and are displayed to you based on various factors, including the context of the site or app in which they appear (e.g., social media site or travel or skincare section), information you provided to the operator of the site or app (e.g., when you created an account), your activities on the site or app (e.g., pages viewed, searches performed or ads clicked), and information such as your demographic, interests and household information.

We, our service providers and third parties use automated means including Cookies and Similar Technologies on the Digital Services and on third-party sites, apps or other media to (a) collect information for interest-based advertising purposes or (b) serve you interest-based ads. When you agree to the use of Cookies and Similar Technologies on the Digital Services, unique identifiers may be associated with your browser or device to support interest-based advertising.

We use online and offline information we obtain about you, including your personal information, for interest-based advertising purposes. We aggregate the information we obtain to create audiences that are most likely to respond to ads based on demographic, interests or household information.

Interest-based ads may be displayed to you by third parties, such as ad networks or exchanges. There are steps you can take to limit the collection of your information by Cookies and Similar Technologies and the use of your information for interest-based advertising purposes. These steps vary for the web and mobile environments and are browser and device specific. To learn more about these choices, see “Your Choices, Including Marketing and Interest-Based Ads Opt-Outs” below and our Cookies Policy.

Cross-device linking. If you access the Digital Services from multiple browsers or devices, we, our service providers and third parties may try to establish connections among and link the different browsers and devices you use to access the Digital Services and our content or ads published elsewhere in certain circumstances. This helps us provide you with a seamless experience across the browsers and devices you use and serve you with more relevant content and ads (e.g., so that we don’t show you the same article twice). See our Cookies Policy for information on the steps you can take to limit cross-device linking.

Analysing and measuring the performance, effectiveness and reach of our advertising (including interest-based ads) and marketing efforts on the Digital Services and elsewhere.

To protect our rights or the rights of others. This includes:

Detecting, preventing and responding to fraud or potentially illegal activities, misuse of the Digital Services, cybersecurity, intellectual property infringement or other violations of law, this Privacy Notice, our Terms of Use or other Portal policies.

Performing audits, assessments and testing or troubleshooting activities.

Backing up our systems (including for disaster and information recovery purposes) and enhancing the overall security of the Digital Services.

Complying with and enforcing applicable industry and legal requirements (including legal process such as court orders, warrants or summons) and fulfilling contractual obligations.

D. LEGAL BASES FOR USING INFORMATION

We process personal information for different purposes on the following legal bases: To perform our contractual obligations to you.

We and our service providers process your information to perform our contractual obligations to you when we use your information to provide you with the Digital Services and related content, products or services and to communicate with you. For example, when you purchase a product or request a service from us, we process your payment, contact and location information as necessary to confirm the delivery of the product and we process your contact information and other details

 

such as prescription and/or consultation request to aid with relaying of the services as requested. We also send you informational communications on this basis, including to confirm a purchase, confirm delivery of a purchase or to notify you of a change to a Digital Service. Failure to provide requested information could prevent or delay the fulfilment of our contractual obligations. To pursue our legitimate interests.

We process your information to meet our legitimate interests when we use your information to provide you with the Digital Services and related content, products or services, to communicate with you and for our advertising and marketing purposes. For example, our legitimate interests include making improvements to, customizing and understanding how you interact with the Digital Services and related content, products or services, and sending you communications about products and services we think may be of interest to you. To accomplish our legitimate interests, we may share your information with our affiliates and subsidiaries, service providers and business partners (including for our advertising and marketing purposes) and in the context of a corporate transaction. We maintain safeguards to protect the information we process to pursue our legitimate interests.

To comply with our legal obligations.

We process and share your information as necessary to comply with our legal obligations when we use your information to protect our rights or the rights of others and when we share your information with other parties where required by law or as necessary to protect our rights. For example, we are required to collect certain information from you when processing your payment for tax or financial reporting reasons and in the event you wish to have an ETR compliant receipt. With your consent.

We obtain your consent to process your information when we are required to do so by law. In relation to Cookies and Similar Technologies, we obtain your consent as described in our Cookies Policy. If consent is the legal basis on which we process your personal information, you can withdraw your consent at any time by contacting us using the information provided in the Contact Us section below.

E. HOW WE SHARE INFORMATION

We share the information we obtain with:

Affiliates and Subsidiaries.

We work closely with affiliates and subsidiaries within Portal and affiliated companies with whom we share your information as necessary or appropriate to operate the Digital Services.

Service Providers.

In connection with the operation and provision of the Digital Services, Registration Forms and the fulfilment of orders for our products or services, we engage various third parties to provide services or handle transactions on our behalf, such as payment processing, email distribution, list processing, postal mailing, cloud computing, analytics, digital content or print subscription performance measurement, digital and physical content creators and influencers, ad serving, and

 

managing competitions, promotions or events. These service providers use the information we provide to them as necessary or appropriate for the performance of their services.

Advertisers, Advertising- and Marketing-Related Service Providers and Partners.

We may provide your information to advertisers, advertising agencies, ad networks, ad exchanges, marketing businesses, technology vendors and other entities that create, deliver and assess advertising or marketing campaigns, including interest-based ads.

Social Media Platforms. 

If you interact with Social Media Platforms or are redirected to the Digital Services as a result of visiting any of our social media pages, share content using social media share buttons, or access features of the Digital Services that contain content or features provided by Social Media Platforms, the relevant Social Media Platforms collect information. We encourage you to review the privacy policies of the Social Media Platforms that you engage with to understand their privacy practices, which we do not control.

Business Partners.

In certain circumstances we provide your information to business partners including, without limitation, joint marketing partners, content sponsors or event organizers, for various purposes. For example, we partner with a third party to offer products on a co-branded, co-sponsored or cross-promotional basis that involves the sharing of information. These initiatives take place on the Digital Services or on other media. The participation of a business partner in a particular initiative is communicated to you by the inclusion of the products, services or branding of the relevant business partner.

Other Parties When Required by Law or As Necessary to Protect Our Rights.

We share your information as we believe is necessary or appropriate to protect, enforce, or defend our legal rights, the privacy or safety of our employees, users of the Digital Services or other individuals and entities, or to comply with or enforce applicable industry standards, law or legal process, including responding to court orders, warrants, subpoenas and other requests from public and government authorities.

Corporate Transactions.

We may transfer any of the information we have about you to proceed with the consideration, negotiation, or completion of a sale or transfer of all or a portion of our business or assets to a third party, such as in the event of a merger, acquisition or other disposition, or in connection with a bankruptcy reorganisation, dissolution, or liquidation.

With Your Consent or Otherwise at Your Direction.

In addition, we share your information with third parties when you consent to or request such sharing.

Because we operate as part of a global business, the recipients referred to above will sometimes be located outside the jurisdiction in which you are located (or in which we provide the Digital Services or Registration Forms). See the section on “International Data Transfer” below for more information.

 

F. YOUR RIGHTS OVER YOUR PERSONAL INFORMATION

In certain circumstances, you have a right to access or object to the use of personal information held about you (including in relation to direct marketing). You can also ask us to rectify, update, erase, restrict or to share your information in a usable format with another company. Such requests are subject to applicable law.

We encourage you to contact us to update or correct your information if it changes or if the personal information we hold about you is inaccurate.

If you would like to discuss or exercise such rights, please contact us using the details provided in the Contact Us section below. We shall contact you should we need additional information from you in order to honour your requests.

a. YOUR CHOICES, INCLUDING MARKETING AND INTEREST-BASED ADS OPT-OUTS

Direct Marketing Opt-Outs Email marketing.

You can opt out of receiving marketing or promotional emails from us or third parties (where you have chosen to receive third party communications or other types of communications from us, as required by law) by clicking on the “unsubscribe” link contained in such emails. Please keep in mind that if you opt out of receiving marketing or promotional emails, we will still send you transactional emails or other communications relating to your use of the Digital Services (e.g., to confirm your purchase of a service, to inform you of changes to a Digital Service or in response to your password recovery request).

Text message marketing.

If you choose to participate in a text message marketing campaign or promotion offered in connection with a Digital Service, or ask for consultation through text message and therefore receive text messages going forward, you can opt out of receiving marketing texts from us by following the instructions contained in those messages (e.g., texting the word STOP) or provided to you when you elected to receive text message marketing.

Direct mail.

If you choose to receive postal mail offers in connection with a Digital Service (whenever such choice is required under applicable law), you can request that we stop sending you postal mail offers by notifying us in writing at the relevant address provided in the “Contact Us” section below. Please indicate in your correspondence the name of the Digital Service or specific issue (eg., follow up campaigns in relation to a product you purchased or service sought), to which your request applies.

Marketing by Third Parties.

We provide your contact information to third parties for their own marketing purposes where you have provided us with your consent to do so. If you wish to withdraw your consent for future sharing you can notify us in writing using the relevant address provided in the “Contact Us” section below. Please indicate in your correspondence the name of the Digital Service or publication to which your request applies.

 

Co-Branded, Co-Sponsored or Cross-Promotional Offerings with Business Partners.

Should you choose to participate in a co-branded, co-sponsored or cross-promotional offering, the brand, sponsor or other third-party business partner involved in that offering may use your information for its own purposes, including advertising and marketing purposes, in line with the business partner’s own privacy policy. You must contact the relevant business partner directly to exercise your opt out choices with respect to the business partner’s use of your information.

Interest-Based Ads Opt-Outs

Depending on your preferences regarding the use of Cookies and Similar Technologies, ads you see on the Digital Services may be interest-based ads. This means that these ads are customised based on the information we and others obtain about you and involve the use of Cookies and Similar Technologies. We describe in our Cookies Policy steps you can take to limit tracking of your activities and the delivery of interest-based ads in browsers and mobile apps you use to access the Digital Services. Please keep in mind that if you opt out of interest-based ads, you will still see ads, but these ads will not be based on your inferred interests. In addition, if you take the steps described in the Cookies Policy, some automated means will still be used to collect information about your interactions with the Digital Services for the other purposes described in this Privacy Notice (e.g., to remember user preferences or enable specific functionality).

The technologies used to deliver ads on websites and mobile apps differ. Please also remember that opt-outs are browser and device-specific.

Additional Choices

Device Settings.

For relevant Digital Services, you will be able to review and adjust your preferences by updating the settings on your device (e.g., permitting us to collect precise location information).

Push Notifications.

If push notifications for a particular Digital Service are enabled on your device, you can review and update your push notification preferences by adjusting the settings on your device. For example, you can select the relevant app from “Notifications” (for iOS devices) or “App notifications” (for Android devices) and turn off alerts accordingly.

G. HOW WE PROTECT AND STORE YOUR INFORMATION

We use a variety of security technologies and procedures to help protect information from unauthorised access, use or disclosure.

We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to:

Maintain business records for analysis, understanding market trends and/or audit purposes and to improve our Digital Services.

Comply with record retention requirements under applicable laws or other relevant legal or regulatory requirements.

Defend, establish, exercise or bring any existing or potential legal claims. Carry out fraud detection and prevention.

 

Deal with any complaints regarding the Digital Services, our products and services.

We will delete your personal information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete from our systems, we will put in place appropriate measures to prevent any further processing or use of the data.

H. INTERNATIONAL DATA TRANSFER

In certain circumstances, your personal information will be transferred to, stored, and processed in countries outside Kenya that do not have similar data protection laws to the United Kingdom.

In such circumstances we put appropriate safeguards in place to protect your data, including contractual commitments. For more information on these safeguards, please contact us at the details below.

I. CHILDREN’S PRIVACY RIGHTS

The Digital Services are not intended for use by children, especially those under the age of 18, and we do not knowingly collect personal information from children under the age of 18.

In the event a minor, that is a person under the age of 18, submits a prescription from a hospital or a doctor and the same is verified as such, it shall be assumed that an adult has presented the said prescription and information on behalf of the minor. Minors cannot interact with the Digital Services and cannot create and have an account with us.

J. LINKS TO THIRD-PARTY WEBSITES, MOBILE APPS OR OTHER SERVICES

Certain Digital Services contain links to websites, mobile apps or other services operated by companies not affiliated with Portal. In addition, the Digital Services may be made available to you through third-party platforms (such as app stores or Social Media Platforms) or other channels. We are not responsible for the privacy practices of any non-Portal operated websites, mobile apps or other services and channels, and we encourage you to review the privacy policies or notices published by relevant third parties.

K. CHANGES TO THIS PRIVACY NOTICE

We update this Privacy Notice from time to time to reflect changes in our privacy practices or applicable laws. Where changes to this Privacy Notice have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you advanced notice so that you have the opportunity to exercise your rights (e.g. to object to the processing). We will publish the updated version on the relevant Digital Services and indicate at the top of the Privacy Notice when it was most recently updated. Your use of the Digital Services will be governed by the then-current version of the Privacy Notice.

 

L. CONTACT US

The Portal Pharmacy entity responsible for the Digital Services or Registration Forms you are using or accessing is the controller responsible for the personal information we collect and process in relation to that Digital Service or Registration Form.

Our Data Protection Officer can be contacted at [email protected]

We are committed to working with you to obtain a fair resolution in the event you have a complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to a data protection authority.