Privacy Policy

Nyumbani Greens is operated by {{LEGAL_ENTITY_NAME}}, a business registered in Kenya. We sell fresh produce, African Indigenous Vegetables and related groceries through this website and deliver within Nairobi.

For the purposes of the Data Protection Act, 2019 (the “Act”), we are the data controller of the personal data described in this policy. Our Data Protection registration number with the Office of the Data Protection Commissioner is {{ODPC_REGISTRATION_NUMBER}}.

We collect only what we need to sell and deliver produce:

• Order and delivery details — your name, phone number, email address and delivery address, so we can fulfil your order and contact you about it.
• Payment information — the fact that a payment was made, its status and the reference. We never see or store your full M-Pesa PIN, card number or CVV; those are handled by our payment providers.
• Newsletter subscriptions — your email address, if you choose to subscribe.
• Technical data — pages visited and basic device and browser information, collected in aggregate to help us improve the site.

We process your personal data to:

• Process, pack and deliver your order, and handle returns or refunds.
• Take payment and confirm that payment has succeeded.
• Contact you about your order, or if there is a problem with it.
• Send you our newsletter, if you have asked for it. Every email has an unsubscribe link.
• Understand how the site is used so we can improve it.
• Meet our legal and tax record-keeping obligations.

We rely on the following lawful bases under the Act: performance of a contract (your order), consent (newsletter), and legitimate interests (improving the site, fraud prevention).

We do not sell your personal data. We share it only with the service providers who help us run the business, and only to the extent needed to do their job:

• Payment providers — Paystack and Safaricom M-Pesa, to process and verify your payment.
• Delivery partners — to deliver your order to your address.
• Hosting and email providers — to operate the site and send you order emails.

These providers act on our instructions and are not permitted to use your data for their own purposes. We may also disclose information where we are legally required to, for example to a court or law enforcement authority.

We use cookies and similar technologies to keep your basket and session working, and to understand which pages are used. These are essential cookies; they do not advertise to you and do not track you across other websites. We do not run third-party advertising or tracking cookies.

We keep your order and delivery details for as long as needed to fulfil your order and then for the period required by Kenyan tax and accounting law. Newsletter subscriptions are kept until you unsubscribe. You can ask us to delete your data at any time, subject to those record-keeping obligations.

We use HTTPS to encrypt traffic between you and this site, restrict access to your data to staff who need it to run the business, and keep payment credentials out of our own systems entirely.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and notify you as required by the Act.

Under the Act, you have the right to:

• Ask what personal data we hold about you, and get a copy of it.
• Have inaccurate data corrected.
• Have your data deleted, where we have no overriding legal reason to keep it.
• Object to or restrict certain processing.
• Withdraw your consent, where consent is the basis we relied on.
• Receive a portable copy of certain data in a machine-readable format.

To exercise any of these, email us using the details below. We aim to respond within the period set by the Act. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner.

This store is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time, for example if we change what we collect or how we use it. The “Last updated” date at the top always reflects the current version. Material changes will be announced on this page.