Privacy Policy

1. Who we are

E-manthus is an online marketplace operated by E-Manthus (Pty) Ltd in the Kingdom of Lesotho. We sell products from our own store and from independent sellers, and deliver to all 10 districts of Lesotho.

We are responsible for the personal information described in this policy and handle it in line with the Data Protection Act, 2011 of Lesotho. This policy applies to everyone who uses E-manthus: shoppers, sellers and visitors.

2. Information we collect

Information you give us

Information collected automatically

• Device and connection details: IP address, browser or app version, device type, operating system and language.
• How you use E-manthus: pages and products you view, searches, items added to your cart, and the buttons and links you click (see Cookies and analytics).
• Recently viewed products, so we can show them to you again. These follow you to your account when you sign in.
• Shared links: if you open a product link someone shared, we note which link brought you, so we can see how sharing leads to orders.
• Notification tokens, if you allow push notifications in the app or your browser.

Information from others

• Payment confirmations from M-PESA and our card payment provider (whether a payment succeeded, its reference and amount).
• Delivery updates from our riders and couriers, including proof of delivery.
• Delivery and read receipts from WhatsApp for messages we send you.

We don't ask for your exact GPS location on the website. Where the app asks for location, it's only to help with delivery, and you can turn it off in your phone settings.

3. How we use it

• To run your account and fill your orders: taking payment, passing your order to the seller, arranging delivery, and handling returns and refunds.
• To keep you updated: order confirmations, payment receipts, dispatch and delivery updates.
• To prevent fraud and misuse: checking payments, spotting fake accounts or referral abuse, and protecting buyers and sellers.
• To support you: answering questions and resolving complaints, including following up when you give us a low rating.
• To improve E-manthus: understanding which pages work, where checkout goes wrong, and which products people look for.
• To personalise your shopping: recently viewed items and products related to what you've browsed or bought.
• To tell you about offers, if you haven't opted out (see Messages we send you).
• To meet legal obligations: tax and accounting records, and lawful requests from authorities.

We rely on what's needed to perform our contract with you (your order), our legitimate interest in running a safe and useful marketplace, your consent where we ask for it (such as showing your delivery photo), and our legal obligations.

4. Messages we send you

WhatsApp messages are sent through Meta's WhatsApp Business service, so WhatsApp's own privacy policy also applies to what you send on WhatsApp.

5. Reviews, photos and what's public

• Product reviews appear on the product page with your star rating, your words, any photos you add, the date, and your first name only. A “verified purchase” badge shows if you bought the item from us. We remove hidden location data from review photos before they're published.
• Delivered This Week wall: parcel photos you send us are checked by our team before they appear. They're shown with your district or village, never your name. A photo showing a person or an identifiable home is only published with your permission. We may also share approved wall photos on our social media pages.

To have your review or photo removed, contact us.

6. Buying from and selling to other people

If you buy from an independent seller, we give that seller what they need to fulfil your order: your name, phone number, delivery address and the items you ordered. Sellers must use it only for your order.

If you sell, your store name, products, ratings and reviews are public. We keep your business and contact details, sales, and the M-PESA number we pay your earnings to. We check that payout number before releasing payments, to protect you from fraud. We share your store name and the items with buyers, and the details needed for delivery with our couriers.

7. Payments

• M-PESA: we send your number and the amount to M-PESA to request payment, and receive back whether it succeeded and its reference. Refunds and seller payouts go back through M-PESA.
• Card: you enter your card details with our card payment provider. We receive whether the payment worked and its reference, never your full card number or security code.

We keep a record of every payment attempt, successful or not, to resolve disputes and prevent fraud.

8. Wallet, rewards, referrals and group buys

• Wallet and points: we record your balance and every credit and debit, such as refunds, rewards and milestone bonuses.
• Referrals: when someone signs up or orders through your referral link, we link their account to yours to issue rewards. We check referrals to stop abuse, such as people referring themselves.
• Group buys: we record who joined, what they committed and paid, and any refund if the group doesn't fill.

9. Cookies and analytics

Cookies are small files your browser stores for a website. We use:

• Essential cookies that keep you signed in, hold your cart and protect forms from forgery. The site doesn't work without them.
• A sharing cookie that remembers, for a limited time, which shared product link brought you to us.
• Analytics from PostHog, which records the pages you view and the buttons and links you click, so we can see where the site works and where it doesn't. Signed-in shoppers are recorded under an account number, not their name or email. We do not record your screen, and analytics does not capture what you type into forms, such as your address or M-PESA number.
• Your device's storage, to remember small choices, such as having dismissed the notifications prompt.

We don't use advertising cookies, and we don't let advertising networks track you on our site. You can block or delete cookies in your browser settings; if you block essential cookies, signing in and checking out won't work.

10. Who we share it with

We do not sell your personal information. We share it only with:

Our service providers may use your information only to provide their service to us. If E-manthus is ever merged, sold or restructured, your information may move to the new owner, who must keep protecting it as this policy describes.

11. Information stored outside Lesotho

Some of our providers store or process information outside Lesotho. For example, PostHog in the European Union, and Meta, Google and SendGrid in the United States and elsewhere. We use established providers that protect information with security standards at least as strong as ours, and we send them only what they need to provide their service.

12. How long we keep it

• Account details: while your account is open. When you delete it, your profile is removed.
• Orders, payments and refunds: for as long as tax, accounting and consumer law require, even after you close your account, so we can handle disputes, returns and audits.
• Reviews and approved wall photos: until you ask us to remove them, or until we take them down.
• Messages and support conversations: for as long as we need them to resolve your request and any follow-up.
• Backups: encrypted copies are kept for a limited period, for disaster recovery only.

When we no longer need information, we delete it or remove anything that identifies you.

13. How we protect it

Connections to E-manthus are encrypted (HTTPS). Passwords are stored only in scrambled form, so we can't read them. Our backups are encrypted, access to customer information is limited to staff who need it, and incoming WhatsApp messages are checked to confirm they really came from WhatsApp. We monitor our systems and act on security problems quickly. If a breach puts your information at risk, we'll tell you and the relevant authorities as the law requires.

No system is completely secure. Please use a strong password that you don't use anywhere else, and never share it. E-manthus will never ask for your password or M-PESA PIN, by phone, SMS, WhatsApp or email.

14. Your rights and choices

You can:

• See and correct your details in your profile, or ask us for a copy of the personal information we hold about you;
• Delete your account in the E-manthus app, or by asking us. Some order and payment records are kept as explained in section 12;
• Stop marketing by email, SMS or WhatsApp at any time (see section 4);
• Withdraw your permission, for example to show your delivery photo, and ask us to remove a review;
• Object to how we use your information, or ask us to limit it; and
• Complain to us, and if you're not satisfied, to the data protection authority in Lesotho.

To make a request, contact us from the email or phone number on your account. We may ask you to confirm your identity first, and we'll respond within 30 days.

15. Children

E-manthus is for adults aged 18 or over. Younger people may use it only with a parent or guardian, who is responsible for the account. We don't knowingly collect information from children without that supervision; if you think a child has given us their details, contact us and we'll delete them.

16. Changes to this policy

We'll update this policy when the way we handle information changes. The date at the top shows when it was last changed. If a change is significant, we'll also tell you by email, in the app or on the site before it takes effect.

17. Contact us

For privacy questions or requests, or to report a concern:

• Email: info@e-manthus.com (subject “Privacy request”)
• Phone: +266 6903 1313
• Or use our contact form.

See also our Terms & Conditions.