Back to home

Legal

Privacy Policy

How ShopKichele collects, uses, stores, protects and shares personal data.

Effective 1 October 2026

Effective Date: 1st October 2026
shopkichele shopkicheleLast Updated: 1st October 2026

1. INTRODUCTION

ShopKichele respects your privacy and is committed to protecting personal data processed through its business management and point-of-sale platform.

This Privacy Policy explains how ShopKichele collects, uses, stores, protects, shares and otherwise processes personal data.

It applies to:

  • ShopKichele account holders.
  • Business owners.
  • Staff users.
  • Customers whose information is entered into ShopKichele.
  • Suppliers and other business contacts whose information is entered into ShopKichele.
  • Visitors to ShopKichele websites and services where applicable.

This Privacy Policy should be read together with the ShopKichele Terms & Conditions and, where applicable, the ShopKichele Data Processing Agreement.

2. IMPORTANT DISTINCTION: OUR DATA AND YOUR BUSINESS DATA

ShopKichele may process personal data in two different capacities.

2.1 ShopKichele as Data Controller

ShopKichele may determine the purposes and means of processing certain personal data relating to:

  • Account registration.
  • Subscription management.
  • Billing.
  • Customer support.
  • Security.
  • Fraud prevention.
  • Service administration.
  • Communications.
  • Legal and regulatory compliance.
  • Product improvement and analytics where applicable.

For these activities, ShopKichele may act as a Data Controller.

2.2 ShopKichele as Data Processor

When a Business enters customer, employee, supplier or other personal information into ShopKichele for the Business’s own purposes, the Business will generally determine why and how that information is used.

In those circumstances:

Business = Data Controller

ShopKichele = Data Processor

ShopKichele processes that information primarily to provide the Services according to the Business’s instructions and the applicable Data Processing Agreement.

This distinction is consistent with Kenya’s data protection framework, which distinguishes a controller that determines the purposes and means of processing from a processor that processes data on behalf of the controller.

3. PERSONAL DATA WE MAY COLLECT

Depending on how you use ShopKichele, we may collect:

Account information

  • Full name.
  • Email address.
  • Telephone/mobile number.
  • Password credentials in appropriately protected form.
  • Business name.
  • Business registration information where provided.
  • Account role.
  • Business address.
  • Branch information.

Business information

  • Products.
  • Product prices.
  • Inventory records.
  • Sales records.
  • Customer records.
  • Supplier records.
  • Staff records.
  • Branch information.
  • Business reports.
  • Business configuration.

Payment and subscription information

We may process:

  • Subscription plan.
  • Payment status.
  • Transaction reference.
  • Amount paid.
  • Payment date.
  • Renewal date.
  • Upgrade/downgrade history.
  • Payment-provider response information.

Where M-Pesa or another payment provider is used, payment information may also be processed by the relevant payment provider under its own terms and privacy practices.

ShopKichele does not need to store your M-Pesa PIN to process a normal payment.

Technical information

We may collect information such as:

  • IP address.
  • Browser type.
  • Device type.
  • Operating system.
  • Login dates and times.
  • Application activity.
  • Error logs.
  • Security logs.
  • Approximate location derived from technical information where necessary and lawful.

4. HOW WE USE PERSONAL DATA

ShopKichele may process personal data to:

  1. Create and manage accounts.
  2. Provide the ShopKichele Service.
  3. Authenticate users.
  4. Manage staff permissions.
  5. Manage businesses and branches.
  6. Process subscriptions.
  7. Process or reconcile payments.
  8. Send billing notifications.
  9. Provide customer support.
  10. Detect and prevent fraud.
  11. Protect the security of the Service.
  12. Investigate abuse or unauthorised access.
  13. Maintain and improve the Service.
  14. Diagnose technical problems.
  15. Monitor system performance.
  16. Comply with legal obligations.
  17. Resolve disputes.
  18. Enforce our Terms and Conditions.
  19. Communicate important service information.
  20. Send marketing communications where permitted and where appropriate consent or another lawful basis exists.

Where applicable, ShopKichele processes personal data on an appropriate lawful basis, including:

  • Performance of a contract.
  • Compliance with a legal obligation.
  • Legitimate interests, where permitted.
  • Consent, where required.
  • Protection of rights and security.
  • Other lawful grounds recognised under applicable law.

Where processing relies on consent, you may withdraw consent subject to applicable legal and contractual limitations.

Withdrawal of consent does not invalidate processing lawfully performed before withdrawal.

6. BUSINESS DATA

A Business using ShopKichele is responsible for determining how it uses its Business Data.

The Business is responsible for ensuring that:

  • It has an appropriate lawful basis for processing personal data.
  • It provides required notices to its customers and employees.
  • It collects only information reasonably required for its business purposes.
  • It respects applicable data-subject rights.
  • It does not upload unlawful or unauthorised information.

ShopKichele will process Business Data as necessary to provide the Service and in accordance with the applicable DPA.

7. STAFF DATA

Where a Business creates Staff User accounts, ShopKichele may process information such as:

  • Name.
  • Email.
  • Telephone number.
  • Role.
  • Business permissions.
  • Login activity.
  • Account status.
  • Audit information.

The Business is generally responsible for determining the purposes for which Staff User information is processed.

8. CUSTOMER DATA ENTERED BY BUSINESSES

A Business may enter information about its customers into ShopKichele.

Such information may include:

  • Name.
  • Telephone number.
  • Email address.
  • Purchase history.
  • Account or loyalty information.
  • Transaction records.
  • Other information entered by the Business.

The Business remains responsible for its collection and use of that information.

ShopKichele does not independently decide why a Business collects customer information merely because the information is stored on the ShopKichele platform.

9. PAYMENT INFORMATION

ShopKichele may integrate with payment providers such as M-Pesa or other authorised providers.

Payment transactions may involve information such as:

  • Mobile number.
  • Transaction amount.
  • Transaction reference.
  • Payment status.
  • Date and time.
  • Account or subscription identifier.

Payment authentication information such as an M-Pesa PIN should be entered directly into the authorised payment-provider interface and should not be requested by ShopKichele.

ShopKichele will not knowingly request or store a customer’s M-Pesa PIN.

10. THIRD-PARTY SERVICE PROVIDERS

ShopKichele may use third-party providers for:

  • Cloud hosting.
  • Database infrastructure.
  • Authentication.
  • Payment processing.
  • Email delivery.
  • SMS or messaging.
  • Analytics.
  • Monitoring.
  • Security.
  • Customer support.
  • Backup and recovery.
  • Other infrastructure required to operate the Service.

Where ShopKichele uses a third party to process personal data on behalf of a Business, ShopKichele will take appropriate contractual and organisational measures as required by applicable law.

Where required, subprocessors will be authorised and subject to appropriate contractual obligations.

Kenya’s General Data Protection Regulations specifically address processor use of third parties and require appropriate authorisation and contractual arrangements.

11. INTERNATIONAL DATA TRANSFERS

Some ShopKichele infrastructure or service providers may process or store information outside Kenya.

Where personal data is transferred outside Kenya, ShopKichele will apply the safeguards required by applicable Kenyan data protection law.

Depending on the circumstances, this may involve:

  • Appropriate contractual safeguards.
  • Adequacy protections.
  • Consent where legally appropriate.
  • Other lawful transfer mechanisms.

The Kenyan data protection framework places conditions on transfers of personal data outside Kenya.

12. DATA SECURITY

ShopKichele uses reasonable technical and organisational safeguards designed to protect personal data.

Measures may include:

  • Authentication controls.
  • Role-based access.
  • Access restrictions.
  • Encryption where appropriate.
  • Secure communications.
  • Logging and monitoring.
  • Backup procedures.
  • Security testing.
  • Incident response procedures.
  • Administrative controls.

The Data Protection Act requires appropriate technical and organisational measures, including measures relating to encryption, restoration of availability and continuing review of safeguards.

However, no online service can guarantee absolute security.

13. DATA BREACHES

If ShopKichele becomes aware of a personal data breach, we will assess the incident and take reasonable steps to contain, investigate and mitigate it.

Where ShopKichele acts as a Data Processor, it will notify the relevant Business without delay and, where reasonably practicable, within 48 hours of becoming aware of a qualifying personal data breach.

The Business remains responsible for making any notification required of it as Data Controller, including notification to the Data Commissioner within the statutory period where required.

Under Kenya’s Data Protection Act, a controller has a 72-hour notification obligation to the Data Commissioner where the statutory conditions are met, while a processor must notify the controller without delay and, where reasonably practicable, within 48 hours.

14. DATA RETENTION

ShopKichele will retain personal data only for as long as reasonably necessary for the purposes for which it is processed, unless a longer period is required or permitted by law.

Retention periods may depend on:

  • Account status.
  • Subscription status.
  • Legal requirements.
  • Tax or accounting requirements.
  • Security requirements.
  • Dispute-resolution requirements.
  • Backup cycles.
  • Contractual obligations.

Business Data may be retained for the period specified in the Terms and DPA.

15. DATA EXPORT AND DELETION

After termination or expiry of a paid Subscription, customers will generally have the data-export period specified in the ShopKichele Terms and DPA.

Unless otherwise required by law, ShopKichele may delete or anonymise Business Data after the applicable export period.

Some information may be retained where required by law or reasonably necessary for:

  • Fraud prevention.
  • Security.
  • Legal claims.
  • Tax or accounting records.
  • Regulatory compliance.
  • Dispute resolution.

16. DATA SUBJECT RIGHTS

Subject to applicable law, individuals may have rights including:

  • The right to be informed.
  • The right to access personal data.
  • The right to object to processing.
  • The right to correction of inaccurate or misleading information.
  • The right to deletion of false or misleading information.
  • Other rights available under applicable law.

These rights are recognised in the Kenyan data protection framework.

Where ShopKichele processes information on behalf of a Business, requests concerning that Business’s data should generally be directed to the Business first.

ShopKichele will provide reasonable assistance to the Business where required.

17. MARKETING COMMUNICATIONS

ShopKichele may send transactional communications necessary to operate the Service, including:

  • Account verification.
  • Password or security notifications.
  • Payment confirmations.
  • Renewal reminders.
  • Subscription notices.
  • Service alerts.
  • Security notices.

Marketing communications will be handled in accordance with applicable law.

Where required, recipients may opt out of marketing communications.

Opting out of marketing does not prevent ShopKichele from sending essential service or transactional communications.

18. COOKIES AND ANALYTICS

ShopKichele may use cookies, local storage, analytics tools or similar technologies to:

  • Keep users signed in.
  • Maintain security.
  • Remember preferences.
  • Analyse service performance.
  • Detect technical problems.
  • Understand usage patterns.

Where non-essential cookies or similar technologies require consent, ShopKichele will provide an appropriate consent mechanism.

19. CHILDREN’S DATA

ShopKichele is intended primarily for businesses and business users.

We do not knowingly design the Service to collect children’s personal data as a primary user category.

Businesses must not enter children’s personal data unless they have an appropriate lawful basis and comply with applicable legal requirements.

20. DATA OWNERSHIP

ShopKichele does not claim ownership of Business Data merely because it is stored on our platform.

Customers retain ownership of their Business Data.

ShopKichele retains ownership of its software, infrastructure, technology, branding and intellectual property.

21. PRIVACY OF BUSINESS INFORMATION

Business information may include commercially sensitive information such as:

  • Sales.
  • Prices.
  • Inventory.
  • Suppliers.
  • Customers.
  • Revenue information.
  • Staff information.

ShopKichele will use reasonable measures to protect such information against unauthorised access.

22. ACCOUNT SECURITY

You are responsible for:

  • Keeping your password confidential.
  • Using strong credentials.
  • Restricting device access.
  • Managing Staff Users appropriately.
  • Removing former staff.
  • Reporting suspected account compromise.

ShopKichele will not knowingly ask you to disclose your password through an unsolicited communication.

23. CHANGES TO THIS PRIVACY POLICY

ShopKichele may update this Privacy Policy from time to time.

Material changes will be communicated through appropriate channels where reasonably practicable.

The updated version will include a new effective date.

24. COMPLAINTS AND CONTACT

For privacy questions, requests or complaints, contact:

Provider / Legal Entity: MANU CREATIONS
Trading Name: ShopKichele
Email: manucreations36@gmail.com
Address: PO BOX 88787-80100, MOMBASA

Privacy / Data Protection Contact: 0791511386

You may also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

The ODPC provides mechanisms for data-subject complaints and data-breach reporting.

25. ACKNOWLEDGEMENT

By using ShopKichele, you acknowledge that you have had an opportunity to read this Privacy Policy.

Where consent is required by law for a particular processing activity, ShopKichele will request consent through an appropriate mechanism.

Last Updated: 1st October 2026