Privacy & data protection

Kidosho respects your privacy. This page explains what personal data we collect, why, how we keep it safe, and the rights you have under the Data Protection Act, 2019 of Kenya (the “DPA”). Kidosho is the data controller for the information you give us on this site.

What we collect and why

• Order details — your name, email address, phone number, chosen Pickup Mtaani collection point, delivery notes and any gift note. We use these to take payment, prepare and deliver your order, and contact you about it.
• Aftercare and returns — your order history and the requests you make (returns, exchanges, polish, resize, reviews), so we can look after your pieces.
• Messages — anything you send through the contact form, so we can reply.
• Newsletter — your email address, only if you opt in. We never tick the box for you.

We do not collect more than we need, and we do not sell your personal data.

Who we share it with

We share only what each service needs to do its job:

• Paystack — processes your M-Pesa or card payment on its own secure page. We never see or store your card number or M-Pesa PIN.
• Pickup Mtaani — receives your name, phone number and chosen collection point to deliver your order.
• Resend — sends our transactional emails (order confirmations, delivery updates, care reminders) to your email address.
• Our hosting provider — stores our systems and data on secured servers.

Some of these providers may process data outside Kenya. Where they do, we rely on providers that protect personal data to a standard consistent with the DPA. We may also disclose information where the law requires it.

How we keep your data secure

• All traffic between your device and our site is encrypted with HTTPS.
• Payments are handled by Paystack; confirmations from Paystack are cryptographically verified before we accept them.
• Customer records are visible only to authorised Kidosho staff with individual, password-protected accounts.
• Your personal piece page and order lookups use private, hard-to-guess links or require your order number and email.
• Lookups and forms are rate-limited to protect against abuse, and secrets are kept out of our code.

No system is perfectly secure. If a breach affecting your data occurs, we will act promptly and notify you and the Office of the Data Protection Commissioner as the DPA requires.

How long we keep it

We keep order and payment records for as long as needed to fulfil your order, handle returns and aftercare, and meet our tax, accounting and legal obligations. Messages are kept as long as needed to resolve your query. Newsletter details are kept until you unsubscribe.

Cookies and tracking

We use only what the site needs to work: your shopping bag is saved on your own device so it is still there when you return. We do not use advertising cookies or third-party tracking on this site.

Your rights under the Data Protection Act, 2019

• To be informed about how your personal data is used.
• To access the personal data we hold about you.
• To object to the processing of your personal data, including for marketing.
• To have false or misleading data corrected.
• To have false or misleading data deleted, where the law allows.
• To receive your data in a portable format, where applicable.
• To withdraw your consent at any time, without affecting what was done before.

To use any of these rights, write to hello@kidosho.africa or use the Contact page and choose “Privacy & my data”. Please tell us the email address and order number involved so we can verify it is you. We aim to respond within 30 days.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

Changes to this page

We may update this page as our services change. The current version is always available at kidosho.africa/support/privacy.