Privacy Policy

Kelmon (“Kelmon”, “we”, “us”) runs this online store and is responsible for your personal data. We handle it in line with Kenya's Data Protection Act, 2019.

Information you give us

• Account details: your name, email address, password (stored securely by our sign-in provider — we never see it), and optionally your phone number, campus and profile photo.
• Order details: what you bought, your delivery drop point, any notes, and the phone number you pay with.
• Payment details: the M-Pesa phone number, amount, M-Pesa receipt number and payment result (for example “wrong PIN”). We never see or store your M-Pesa PIN.
• Messages and reviews: what you send through our contact form and the reviews you post.

Information collected automatically

• Sign-in cookies that keep you logged in (see Cookies below).
• Your cart, theme choice and similar preferences, saved in your own browser.
• Basic technical logs (such as IP address and browser type) kept by our hosting provider for security.

• To create and run your account.
• To process your orders, take payment through M-Pesa and deliver to your drop point.
• To send you messages about your orders — payment confirmations, failed-payment notices and delivery updates.
• To award and track Kelmon Points.
• To reply to your messages and give customer support.
• To prevent fraud and keep the site secure.
• To send occasional news and offers by email. You can ask us to stop at any time and we will — order-related messages will still be sent.

We use your data because we need it to fulfil our contract with you (your account and orders), because we have a legitimate interest in running a safe, working store, because you consented (for example to marketing emails), or because the law requires it (for example keeping transaction records for tax purposes).

We don't sell your personal data. We share it only with trusted service providers that help us run Kelmon, and only what each one needs to do its job:

• Payment provider — M-Pesa, to process your payments.
• Sign-in and security services — to create your account, sign you in and keep it secure.
• Secure cloud storage — where your account, orders and uploaded photos are stored.
• Email service — to send order updates and messages.
• Website hosting — to run the site and keep it available.
• Our delivery team — your name, phone number and drop point, only to deliver your order.

We may also share data if the law requires it, or to protect our customers or the business from fraud.

Some of the services above store data on servers outside Kenya. Where that happens, we rely on providers that use strong security and contractual protections, as the Data Protection Act requires.

• Account details: for as long as your account is open.
• Orders and payment records: for up to 7 years, because tax and accounting law requires us to keep transaction records.
• Contact messages: for up to 2 years, unless they relate to an open issue.
• When you close your account, we delete or anonymise your personal data, apart from records we must keep by law.

Under the Data Protection Act you have the right to:

• be told how your data is used (this policy);
• get a copy of the personal data we hold about you;
• have wrong or incomplete data corrected — you can edit most of it yourself on your profile;
• have your data deleted, where we don't need to keep it by law;
• object to, or ask us to limit, how we use it — including opting out of marketing at any time.

To use any of these rights, contact us (below). We'll reply within a reasonable time and may ask you to confirm your identity first. If you're unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (ODPC).

We use a small number of essential cookies and browser storage:

• Sign-in cookies — keep you logged in securely. Without them you can't sign in.
• Cart and preferences — your cart and light/dark theme are remembered in your own browser.

We don't use advertising cookies or sell data to advertisers.

Your data is sent over encrypted connections (HTTPS), passwords are handled by our sign-in provider and never stored by us, and access to customer data is restricted to authorised staff. No system is perfectly secure, so please use a strong password and keep it private. If a breach affects you, we'll notify you and the ODPC as the law requires.

Kelmon is meant for adults and university students. We don't knowingly collect data from children under 18 without a parent or guardian's consent. If you think a child has given us their data, contact us and we'll delete it.

We may update this policy. The date at the top shows the current version, and we'll tell you about significant changes on the site or by email.

For privacy questions or requests, reach us through our contact page or on WhatsApp at +254 787 216 442. Please say it's a privacy request so it reaches the right person.