Privacy Policy

1. Who We Are

eShop is an online retail platform operated in Kenya. We are committed to protecting your personal data in accordance with the Kenya Data Protection Act, 2019 and any regulations made thereunder.

2. Information We Collect

When you use our platform, we may collect the following information:

• Account information — name, email address, password (encrypted)
• Order information — shipping address, phone number, items purchased
• Payment information — M-Pesa phone number and transaction reference (we do not store your M-Pesa PIN)
• Usage data — pages visited, products viewed, cart activity

3. How We Use Your Information

• To process and fulfil your orders
• To send order confirmations and updates
• To process M-Pesa payments via Safaricom Daraja API
• To send password reset emails when requested
• To improve our platform and customer experience
• To comply with legal obligations

4. M-Pesa Payments

Payments are processed through Safaricom's M-Pesa Daraja API. When you make a payment, your phone number is shared with Safaricom to initiate the STK push. We receive a transaction confirmation reference from Safaricom but we never see or store your M-Pesa PIN. Safaricom's own privacy policy governs their handling of your payment data.

5. Data Sharing

We do not sell your personal data. We may share your data with:

• Safaricom — to process M-Pesa payments
• Cloudinary — for image storage (product images only, not personal data)
• Law enforcement — where required by Kenyan law

6. Data Storage & Security

Your data is stored on secure servers. Passwords are encrypted using industry-standard bcrypt hashing. Payment data is processed via Safaricom's secure API. We use HTTPS encryption for all data transmitted between your device and our servers.

7. Your Rights

Under the Kenya Data Protection Act 2019, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Object to processing of your data
• Lodge a complaint with the Office of the Data Protection Commissioner

To exercise any of these rights, contact us at the details below.

8. Cookies

We use session cookies to keep you logged in and to maintain your shopping cart. We do not use tracking or advertising cookies. You can disable cookies in your browser settings but this may affect your ability to use the platform.

9. Data Retention

We retain your account data for as long as your account is active. Order records are retained for 7 years for accounting and legal compliance purposes. You may request deletion of your account at any time — order records required for legal compliance will be anonymised rather than deleted.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or by a notice on our platform. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related questions or requests: