Privacy Policy
Last updated: [DATE OF PUBLICATION]
Olajiji Wears ("Olajiji Wears", "we", "us") is operated by [COMPANY LEGAL NAME], a company registered in Kenya (registration no. [NUMBER], KRA PIN [PIN]), of [REGISTERED ADDRESS], Nairobi. We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller (registration no. [ODPC NUMBER]).
This policy explains what personal data we collect when you visit olajiji.technopickltd.com, shop with us, contact us or apply for a job, why we use it, who we share it with and your rights under the Data Protection Act, 2019 of Kenya.
1. Data we collect
| What | Examples | Where it comes from |
|---|---|---|
| Identity and contact details | Name, email address, phone number | You, at checkout, account sign-up or when you contact us |
| Delivery details | Delivery address, landmark, delivery instructions | You, at checkout |
| Order and payment details | Items bought, order value, payment method, M-Pesa transaction code, card payment reference | You, our checkout and payment providers |
| Account details | Password (stored only as a secure one-way hash), saved addresses, wishlist, order history | You |
| Communications | Messages, WhatsApp chats, emails, call notes, reviews and survey answers | You |
| Corporate and bulk enquiries | Company name, contact person, quantities, branding requirements | You |
| Job applications | CV, portfolio, references | You |
| Device and usage data | IP address, browser type, pages viewed, products added to cart, referring website | Your device, cookies and similar technologies (see section 7) |
We never see or store your full card number, card security code or M-Pesa PIN. Card details are entered on the secure payment page of Paystack, our PCI-DSS certified payment provider, and M-Pesa payments are approved on your own phone.
We do not knowingly collect personal data from children under 18. If you are under 18, please shop with the consent and involvement of a parent or guardian.
2. How and why we use your data
| Purpose | Lawful basis (Data Protection Act, s.30) |
|---|---|
| Process, deliver and support your orders, returns and refunds | Performance of a contract with you |
| Create and manage your account and wishlist | Performance of a contract |
| Send order, payment, dispatch and delivery updates by email, SMS or WhatsApp | Performance of a contract |
| Answer questions, complaints and corporate enquiries | Performance of a contract, or our legitimate interests in responding to you |
| Prevent fraud, secure our website and accounts | Legitimate interests and legal obligation |
| Keep tax and accounting records | Legal obligation (e.g. the Tax Procedures Act and VAT Act) |
| Improve our website, products and services using analytics | Your consent (for analytics cookies) or our legitimate interests |
| Send marketing emails, SMS or WhatsApp messages about new collections and offers | Your consent. You can opt out at any time. |
| Show you our ads on social media | Your consent (for advertising cookies) |
| Assess job applications | Steps taken at your request before entering into a contract |
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
3. Marketing
We only send marketing messages if you have opted in. Every email has an unsubscribe link; reply STOP to any SMS; or message us on WhatsApp to opt out. Opting out of marketing doesn't stop order updates.
4. Who we share your data with
We share only what each party needs:
- Payment providers: Safaricom (M-Pesa) and Paystack (card payments), to take payments and issue refunds.
- Delivery partners: our riders and couriers [NAMES], who receive your name, phone number and delivery address.
- Messaging providers: our SMS provider (Africa's Talking), WhatsApp (Meta Platforms) and our email provider [NAME], to send you messages.
- Hosting and IT providers [NAME / REGION], which host the servers that run our website, checkout, customer accounts and order systems.
- Analytics and advertising partners: Google (Analytics), Meta (Facebook/Instagram) and TikTok, only if you accept analytics or advertising cookies.
- Professional advisers and authorities: our auditors, lawyers and insurers, the Kenya Revenue Authority, and law-enforcement or regulators when the law requires it.
- A buyer of our business, if Olajiji Wears is sold or restructured, under the same protections.
Our service providers act on our instructions under written agreements that require them to keep your data secure. We never sell your personal data.
5. Transfers outside Kenya
Some of the providers above store data outside Kenya (for example in the European Union, the United States or South Africa). We transfer data only where the Data Protection Act allows it: to countries with appropriate data-protection safeguards, under contractual safeguards with the provider, or where the transfer is necessary to perform your contract with us.
6. How long we keep your data
| Data | How long |
|---|---|
| Orders, invoices and payment records | At least 5 years after the transaction, as required by Kenyan tax law |
| Customer account | Until you close it, then up to 24 months of inactivity before we anonymise it, except records we must keep by law |
| Marketing preferences | Until you opt out, plus a suppression record so we don't contact you again |
| Customer service messages | 3 years after the conversation ends |
| Job applications | 12 months, unless you ask us to delete them sooner or keep them longer |
| Analytics data | Up to 26 months |
7. Cookies
We use cookies and similar technologies:
- Essential: required for the cart, checkout, sign-in and security. These are always on.
- Your device's storage: your bag and wishlist are saved in your browser so they're still there when you come back. You can clear them at any time in your browser settings.
- Analytics and advertising: we don't use these today. If we add them (for example Google Analytics, Meta or TikTok), we will ask for your consent first and let you change your choice at any time.
8. How we protect your data
We use encryption in transit (HTTPS), role-based access for staff with two-factor authentication, audit logging of changes to customer and order data, regular backups and supplier security reviews. If a personal data breach is likely to put your rights at risk, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, and tell you without undue delay.
9. Your rights
Under the Data Protection Act, 2019, you have the right to:
- be informed about how we use your personal data;
- access the personal data we hold about you;
- ask us to correct inaccurate or incomplete data;
- ask us to delete data that is false, misleading or no longer needed;
- object to processing, including direct marketing at any time;
- withdraw consent where we rely on it, without affecting earlier processing;
- receive your data in a portable format and ask us to send it to another organisation where technically possible;
- not be subject to decisions based solely on automated processing.
To use any of these rights, email olajiji@technopickltd.com or write to our Data Protection Officer at [ADDRESS]. We may ask you to verify your identity. We aim to respond within 7 days, and where the law allows longer, we will tell you why.
If you're unhappy with our response, you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
10. Changes to this policy
We may update this policy from time to time. The "Last updated" date shows when it last changed. We'll tell you about significant changes by email or on our website.
11. Contact us
Data Protection Officer, [COMPANY LEGAL NAME] [REGISTERED ADDRESS], Nairobi, Kenya Email: olajiji@technopickltd.com · Phone / WhatsApp: +254 702 795 466