Privacy notice
This notice explains what personal data Kenya Farms collects, why, and your rights under Kenya's Data Protection Act, 2019. We keep it short and plain.
What we collect
- When you order: your name, phone number, delivery location and any note you add. For delivery to your door, the location can include your area, street, house and a nearby landmark, and a map pin if you choose to drop one.
- When you pay: the M-Pesa transaction code you give us, and the payment details M-Pesa sends us.
- When you join a waitlist: your phone number, and your name if you give it.
- On USSD: the phone number you dial from.
- In your browser: your cart, your details and up to 3 delivery places saved in My details, how you first found us (for example a TikTok link) and which of our guides you've read. These are stored on your own device and sent to us only with an order.
- When you allow notifications: an address your browser's push service (Google, Apple or Mozilla) gives us for your phone, linked to your phone number and the kind of news you chose (order updates, back in stock).
- When you review a product: your stars and words. They appear on the shop with your first name and initial once we've read them. We keep your phone number with your review, never shown, so we know it came from a buyer and can find it if you ask us to remove it.
Why we use it
- To confirm, deliver and support your order, and to check your payment. On our delivery days we use the delivery places of that day's orders to plan the rider's route.
- To send the notifications you allowed: your order is confirmed, on its way (with your stop and time), delivered, or a product is back.
- To tell you when a product is back, if you joined its waitlist.
- To send reorder reminders and occasional offers on WhatsApp, only if you ticked the box at checkout. Reply STOP at any time.
- To understand which posts and guides help people. We look at totals, not individuals.
Who else sees it
- Delivery partners (our own rider, a boda rider, courier or Pickup Mtaani) get your name, phone number and delivery location for your order only. Our rider sees the day's list through a private link that stops working the day after the delivery. If the rider asks Google Maps for directions, Google receives the destination (your pin or address), not your name or number.
- Notifications travel through our Cloudflare relay and your browser's push service, encrypted so that only your browser can read them.
- Google stores our order records (Google Sheets), and our order alerts pass through WhatsApp and email services.
- Safaricom processes your M-Pesa payment.
- Meta: if we use the Meta Pixel to measure our Facebook and Instagram ads and show them to people who have visited our site, Meta receives the pages you visit on our site, including which guides you read, and actions such as placing an order, including its value. Facebook and Instagram let you turn off ads based on your activity on other websites in their ad settings.
We don't sell your data.
How long we keep it
We keep order and payment records for up to 5 years, because Kenyan tax law requires business records to be kept that long. After that, your name, phone number and address (including any map pin) are removed from them automatically; the area stays. Waitlist entries are removed after 12 months, and notification addresses after 12 months or as soon as you turn notifications off in My details. Reviews stay on the shop until you ask us to take them down. You can ask us to delete waitlist entries and stop marketing at any time.
Your rights
You can ask to see the data we hold about you, to correct it, to delete it where we don't need to keep it, and to stop marketing messages. If you ask us to delete it, we remove your name, phone number, address, map pins and notes, take down your reviews and stop your notifications, and keep only what tax law requires: order numbers, items, amounts, dates, payment references, and any business name and KRA PIN. Your saved places live on your phone: remove them in My details. Contact us below. If you're unhappy with our answer, you can complain to the Office of the Data Protection Commissioner.