Privacy policy

1. Who we are

Jambo Fashion House ("we", "us" or "our") is a clothing retailer and wholesale supplier based in Nairobi, Kenya. We sell through this website and from our store, and we deliver across Kenya through courier partners. For the purposes of the Data Protection Act, 2019, we are the data controller for the personal data described in this policy.

Legal entity: [Confirm: registered business name and registration number]. Registered address: Golden Century 2, Othaya Road, Nairobi, Nairobi. ODPC registration: [Confirm: registration status and number, if applicable].

2. The personal data we collect

Information you give us

• Account details such as your name, email address, phone number and password when you create an account.
• Order details including the items you buy, delivery address, delivery instructions, the phone number our courier should call and your chosen payment method.
• Payment information. M-Pesa payments are processed by Safaricom and we receive the transaction reference, the paying phone number and the amount. Card payments are handled on hosted checkout pages operated by Shopify or Payhip; we never see or store your full card number. For pay on delivery, we record that cash or M-Pesa was received. For approved wholesale accounts paying by bank transfer, we record the payment reference and amount.
• Wishlist and preferences such as saved items and size preferences.
• Newsletter sign-up, limited to your email address and the date you subscribed.
• Referral and affiliate programme data, including your referral or affiliate code, the orders attributed to it, reward balances and, for affiliates, the payout details you provide.
• Enquiries and support, including messages you send through our contact form, WhatsApp, email or phone, and wholesale enquiries containing your business name, role and product requirements.

Information collected automatically

• Technical data such as IP address, device and browser type, pages viewed and the referring link that brought you to the site.
• Cookies and similar technologies, described in our cookie policy. Analytics cookies are only set with your consent.

Information from third parties

• Payment confirmations from Safaricom (M-Pesa), Shopify and Payhip.
• Delivery status updates from our courier partners.

3. How and why we use your data

The Data Protection Act, 2019 requires us to have a lawful basis for processing personal data. We rely on the following bases.

• Performing a contract with you: processing your orders, taking payment, arranging delivery or store pickup, handling returns, exchanges and refunds, and running your account and wishlist.
• Our legitimate interests: keeping the website secure, preventing fraud (including verifying payments before dispatch), improving our range and service, and operating the referral and affiliate programmes fairly.
• Your consent: sending our newsletter and marketing messages, and setting analytics cookies. You can withdraw consent at any time.
• Legal obligations: keeping tax and accounting records, responding to lawful requests from authorities and complying with consumer protection law.

4. Who we share your data with

We do not sell your personal data. We share it only with the following categories of recipient, and only as far as needed.

• Courier and delivery partners, who receive your name, delivery address and phone number so they can deliver your order.
• Payment providers: Safaricom (M-Pesa), Shopify and Payhip, who process payments under their own privacy policies.
• Service providers that host our website and database, send our emails and SMS, and provide analytics. [Confirm: list of processors and their locations].
• Professional advisers such as accountants, auditors and lawyers.
• Authorities where we are required to do so by law or a valid legal process.

5. Transfers outside Kenya

Some of our service providers may store or process data on servers located outside Kenya. Where this happens, we will only transfer personal data in line with the conditions set out in the Data Protection Act, 2019 and its regulations, for example where the recipient provides appropriate safeguards or where the transfer is necessary to perform our contract with you. [Confirm: whether any data leaves Kenya and the safeguard relied on].

6. How long we keep your data

• Order and payment records: kept for as long as required by Kenyan tax and accounting law. [Confirm: retention period].
• Account data: kept while your account is active and for [Confirm: period] after it is closed, unless we need it longer for legal reasons.
• Newsletter data: kept until you unsubscribe.
• Enquiries and support messages: [Confirm: period].
• Referral and affiliate records: kept while you take part in the programme and for [Confirm: period] afterwards for audit purposes.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed about how we use your personal data;
• access the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete your data, or to restrict how we use it, in certain circumstances;
• object to processing based on our legitimate interests, and object at any time to direct marketing;
• receive a copy of data you have provided in a portable format;
• withdraw consent where we rely on it, without affecting processing that has already taken place.

To exercise any of these rights, contact us using the details in section 12. We may ask you to confirm your identity first. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

8. Marketing and the newsletter

We only send marketing emails or messages if you have opted in. Every newsletter contains an unsubscribe link, and you can also ask us to stop at any time. Unsubscribing does not affect transactional messages about your orders, such as order confirmations and delivery updates.

9. Referral and affiliate programmes

If you share a referral link or join our affiliate programme, we track visits and orders made through your code so we can award the right rewards or commission. This may involve a cookie that remembers the code for a limited period. We do not share the identity of the people who used your code beyond what is needed to show your reward or commission status. Affiliates' payout details are used only to make payments and to meet our record-keeping obligations.

10. Children

Our website is intended for adults. We do not knowingly collect personal data from children under 18 without the consent of a parent or guardian. If you believe a child has provided us with personal data, please contact us so we can remove it.

11. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls and server-side verification of payments. No system is completely secure, so we cannot guarantee absolute security, but we will notify you and the ODPC of any personal data breach where the law requires it.

12. Contact us

Questions about this policy or your personal data can be sent to our data protection contact: [Confirm: name or role of data protection contact].

• Email: contact details to be confirmed
• Phone: contact details to be confirmed
• Address: Golden Century 2, Othaya Road, Nairobi, Nairobi

You can also reach us through our contact page.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Significant changes will be highlighted on the website or sent to account holders by email.