Effective date: 30 October 2026
Rakhmani (we, us, our) is an online store based in Nairobi, Kenya. We respect your privacy and handle your personal data in line with the Data Protection Act, 2019 of Kenya and the regulations made under it. This policy explains what we collect, why we collect it, who we share it with and what rights you have.
Who is responsible for your data
Rakhmani is the data controller for the personal data collected through this website. You can reach us on WhatsApp +254 703 685 939, by phone on +254 703 685 939 or through our Contact page.
What we collect
- Your name, phone number, email address and delivery address.
- Your order details and your account login details if you create an account.
- Your M-Pesa phone number or payment details when you pay. Card and M-Pesa payments are processed by our payment provider; we do not see or store your card number or M-Pesa PIN.
- Messages you send us through the contact form, chat or WhatsApp.
- Basic technical and usage information, such as your device, browser and the pages you visit, collected through cookies and analytics tools.
Why we use your data and our lawful basis
- To process and deliver your orders, and to handle returns and refunds. This is needed to perform our contract with you.
- To answer your questions and give support. This is in our legitimate interest and yours.
- To keep tax, accounting and other records we are required by law to keep.
- To understand how the website is used and improve it. We do this with your consent where required, for example through cookies.
- To send you offers or news. We do this only if you have agreed, and you can opt out at any time.
Who we share it with
- Delivery riders and couriers, who receive your name, phone number and address so they can deliver your order.
- Our suppliers, who are told only which item to prepare. We share your personal details with them only when needed to fulfil your order.
- Payment providers, who process your payment for us.
- Service providers who help us run the website, such as hosting, email and analytics providers.
- Authorities, where we are required to do so by law.
We do not sell your personal data.
Transfers outside Kenya
Some of our service providers, such as website hosting and analytics, may store or process data outside Kenya. Where this happens, we take steps to make sure your data is protected as the Data Protection Act, 2019 requires.
How long we keep it
We keep order and payment records for at least five years for accounting and legal reasons. Other information is kept only as long as we need it for the purposes above, and is then deleted or anonymised.
Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your personal data is used;
- ask for a copy of the personal data we hold about you;
- object to the processing of your data, including for marketing;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data where the law allows;
- ask to receive your data in a commonly used format (data portability); and
- withdraw consent you have given us, at any time.
To use any of these rights, contact us using the details above. We may need to confirm your identity first, and we will respond within the time the law requires.
Security
We use reasonable technical and organisational measures to protect your data, including secure connections (HTTPS) and limited access to order information. If a data breach is likely to put your rights at risk, we will notify the Office of the Data Protection Commissioner and affected people as the law requires.
Cookies
We use cookies to keep you signed in, remember your cart and measure website use. You can block cookies in your browser settings, but parts of the store may not work properly.
Children
Our store is not directed at children. If you are under 18, please ask a parent or guardian to place the order and to give us any personal data. We do not knowingly collect a child’s personal data without a parent or guardian’s consent.
Complaints
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke).
Changes to this policy
We may update this policy from time to time. The effective date at the top shows when it was last changed.