Xania Digital Bookstore ("Xania", "we", "us") is run by GOELWAY LTD in Kenya. We are the data controller for the personal data described here, which means we decide why and how it is used. This policy applies to the website xania.goelway.com and the Xania mobile app.
Who we are and how to reach us
GOELWAY LTD, trading as Xania Digital Bookstore, Nairobi, Kenya.
Data protection contact: xania@goelway.com · +254 794 808 635
What we collect
- Account details: your name, email address, phone number, password (stored only in scrambled form) and whether you are a reader or an author. If you sign in with Google, we receive your name and email from Google.
- Profile details you choose to add: photo, short bio and phone number.
- Orders and payments: the books you buy, delivery location and address, and payment references. Card details are handled by Paystack and PayPal, and M-Pesa PINs by Safaricom; we never see or store them.
- Reading activity: your library, reading progress, bookmarks, highlights and notes, so they follow you to every device.
- Authors: your books and manuscripts, sales, earnings, and the details needed to pay you.
- Things you write: reviews, ratings, articles and messages to us.
- Technical data: the device and browser you use, your IP address, and when you were last active, to keep the service secure and working.
- Affiliates and referrals: who invited you and commissions earned.
Why we use it, and our legal basis
- To provide the service you asked for (performance of a contract): your account, selling and delivering books, your library, paying authors and affiliates.
- To meet legal duties: keeping sales and tax records, preventing fraud, and answering lawful requests from authorities.
- For our legitimate interests: keeping Xania secure, preventing piracy and abuse, fixing problems, and understanding how the service is used so we can improve it (using statistics, not by identifying you).
- With your consent: promotional emails and the weekly new books email. You can withdraw consent at any time in Privacy & data or with the "Unsubscribe" link in any promotional email.
Book recommendations ("You may also like") are based on what you and other readers bought and read. They don't have legal or similarly significant effects on you.
Who we share it with
We never sell your personal data. We share it only as needed with:
- Payment providers: Safaricom (M-Pesa), Paystack and PayPal, to take payments.
- Delivery partners and printers: the name, phone and address needed to print and deliver physical books.
- Authors: authors see how many copies of their books sold, not who bought them.
- Service providers who process data for us under contract: our web hosting company, our email service, and Google (Google sign-in and Play Store app distribution).
- Authorities, when the law requires it.
Some of these providers store data outside Kenya. We only use providers who protect personal data to standards comparable to the Data Protection Act, 2019.
How long we keep it
- Your account and reading data: while your account is open. When you delete your account, they are deleted or anonymised straight away.
- Sales and payment records: kept for the period required by Kenyan tax law (currently 5 years), without your name once you delete your account.
- Security logs: about 30 days. Records of recent visitors (for the "online now" statistics): 2 days.
How we protect it
We use encrypted connections (HTTPS), store passwords only in scrambled form, limit staff access to what each role needs, lock accounts after repeated failed sign-ins, check every uploaded file, and keep downloaded books encrypted on your phone. If a personal data breach could put you at risk, we will tell the Office of the Data Protection Commissioner within 72 hours and let affected people know without delay.
Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed about how your data is used (this policy);
- access your data: download a copy any time from Privacy & data, or in the app under Me → Privacy & data;
- correct wrong or incomplete data, by editing your profile or asking us;
- delete your data: delete your account in Privacy & data;
- object to processing, including direct marketing, and withdraw consent at any time;
- data portability: your download is a standard file you can take elsewhere.
To use any right, use the tools above or email xania@goelway.com. We reply within 7 days. If you are unhappy with our answer, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).
Children
Accounts are for people aged 18 and over. Children's books on Xania are bought and managed by a parent or guardian, who may let a child read them on their account. If you believe a child has given us personal data, contact us and we will delete it.
Cookies
We use cookies that are needed to keep you signed in and secure your cart and payments, and to remember a referral link for 30 days so the right person gets credit. We also use Google Analytics to count visits. You can block cookies in your browser, but signing in and buying won't work without the essential ones.
Changes to this policy
If we make important changes, we will tell you by email or in the app before they take effect. The date at the top shows when this policy last changed.