Privacy Policy

This Privacy Policy explains how [Business name] ("we", "us") collects, uses and protects your personal data when you use our website, app or WhatsApp to shop with us. We follow the Kenya Data Protection Act, 2019 and its regulations.

1. Who is responsible for your data

[Business name], [Business address], Eastleigh, Nairobi, Kenya — the data controller. Contact for privacy questions: WhatsApp +254 792 998 841 · [shop email]

2. What we collect

When you order

• Your name and phone number
• Delivery method, delivery address or landmark
• What you ordered, prices, discount codes and order notes
• For gift orders: the recipient's name, phone number and gift message
• For M-Pesa payments: the phone number used to pay, the amount and the M-Pesa receipt number. We never see or store your M-Pesa PIN.

If you create an account

• Your email address and name
• Your password — stored only in scrambled (hashed) form by our login provider; we cannot read it
• If you log in with Google: your name and email from Google
• Saved delivery details and your wishlist

Other things you give us

• Messages you send us on WhatsApp or email
• Reviews you post
• Your phone number if you ask to be told when an item is back in stock

Collected automatically

• Pages you view, items added to cart and checkout steps, linked to a random code stored in your browser (not your name), and the type of device (phone, tablet, computer). We use this to improve the shop.
• Small files in your browser needed for the shop to work: your cart, wishlist, language choice and, if you log in, your login session.
• We do not use advertising or tracking cookies, and we do not sell your data.

3. Why we use your data

We will only send you marketing messages if you have agreed to receive them, and you can stop them at any time.

4. Who we share your data with

We share only what each party needs:

• Delivery riders and couriers — your name, phone number and delivery address, to deliver your order.
• Safaricom (M-Pesa) — your phone number and the amount, to process payment.
• Our service providers, who store or process data on our behalf under contract:
• Supabase — database, login and file storage (servers in Frankfurt, Germany)
• Vercel — website hosting (servers in Frankfurt, Germany)
• Google — only if you choose "Continue with Google"
• Our email provider — to send account and order emails
• Meta (WhatsApp) — when you message us on WhatsApp, their own privacy policy also applies
• Authorities — only when the law requires it.

We never sell or rent your personal data.

5. Data stored outside Kenya

Our database and website servers are in the European Union (Germany), which has strong data protection laws. We use these providers under contracts that require them to keep your data secure and confidential, as allowed under Part VI of the Data Protection Act, 2019.

6. How long we keep your data

• Orders and payment records: at least 5 years, as required by Kenyan tax law.
• Account details, saved details and wishlist: until you delete your account.
• Back-in-stock requests: until we send the message, or 6 months, whichever is first.
• Reviews: until you ask us to remove them.
• Anonymous browsing statistics: only as long as they are useful to improve the shop.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used (this policy);
• see a copy of the data we hold about you;
• correct data that is wrong;
• ask us to delete your data (we may keep order records we must keep by law);
• object to or stop us using your data for a purpose, including withdrawing consent;
• receive your data in a common format.

To use any of these rights, contact us on WhatsApp or email. We may ask you to confirm who you are. We will reply as quickly as possible and within the time the law requires.

If you are not happy with how we handled your data, you can complain to the Office of the Data Protection Commissioner (ODPC) — www.odpc.go.ke.

8. How we protect your data

• The website uses encrypted connections (HTTPS).
• Only our staff who need it can see order details, and staff have different access levels.
• Payment keys are kept on our servers only, never in the app or browser.
• Passwords are stored in hashed form and cannot be read by us.

No system is 100% secure. If a data breach is likely to harm you, we will tell you and the ODPC as the law requires.

9. Children

Our shop is not intended for children under 18 without a parent or guardian. We do not knowingly collect data from children without that permission.

10. Changes to this policy

We may update this policy. The latest version is always on this page, with the date it was updated. Each order records the version you accepted.

11. Contact us

WhatsApp +254 792 998 841 · [shop email] · [Business address], Eastleigh, Nairobi