1. Information We Collect

1.1 Account and Transaction Data

Visitors who register an account, or who transact with us as a guest, will be prompted to provide information such as their name, email address, phone number, shipping address, and payment details, together with any other information required to process a transaction, authenticate the visitor, or communicate the status of an order. We collect such information only insofar as is necessary or appropriate to fulfil the purpose of the visitor's interaction with our website.

1.2 Delivery and Location Data

When you select a delivery tier, provide a delivery address, or schedule a delivery time at checkout, we collect the location and scheduling information necessary to fulfil and route your order.

1.3 KKC Loyalty, Badge, and Wallet Data

Where you participate in the KKC community and loyalty program, we collect and maintain data relating to that participation, including your referral count, loyalty points balance and transfer history, badge progress and unlock history, bottle-return (recycling) count, order frequency, and wallet balance. This data is used to evaluate your eligibility for badges, rewards, and coupons, and to maintain your wallet balance.

1.4 Guest Order Matching

Where you check out as a guest, the details you provide are compared against our existing customer records. Where a match is found, your order is linked to your existing account upon successful order confirmation. Where no match is found, your order is processed as a guest order.

Visitors have the option to decline providing personal data, but doing so may limit their ability to participate in certain activities on our website, including placing an order.

2. How We Use Your Information

We use the information described above to: process and fulfil orders; authenticate visitors and account holders; communicate order status and delivery updates; evaluate and administer KKC badges, rewards, wallet balances, and coupons; respond to returns, refunds, and customer support requests; and improve the functionality and security of our website.

3. Marketing Communications

As a KKC member, you are entitled to receive communications from us by SMS, WhatsApp, or email, including promotional messages relating to offers, discounts, or promotions, and order-update messages relating to the status of your order. This does not apply to visitors who transact as guests and do not hold an account; such visitors receive only the transactional messages necessary to process their specific order.

Promotional and transactional messages are sent using separate, dedicated sender IDs registered with the Communications Authority of Kenya, in accordance with applicable telecommunications regulations, and are never combined on a single channel.

By creating an account and becoming a KKC member, having read our Terms of Service, you consent to receiving both categories of communication described above as part of your membership, unless and until you opt out.

You may opt out of promotional messages at any time by replying STOP, or dialling *456*9*5#, on any promotional SMS you receive, or by disabling the "Opt in to promotional messages" setting on the Profile Settings tab of your KKC dashboard. Order-update messages may be managed independently via the corresponding "Opt in to SMS / Email order-updates" setting on the same page.

4. Legal Basis for Processing

We process personal data on one or more of the following legal bases recognized under the DPA: your consent; the necessity of processing to perform a contract with you (such as fulfilling an order); compliance with a legal obligation to which we are subject; and our legitimate interests in operating and improving our business, provided such interests do not override your fundamental rights and freedoms.

5. Information Disclosure and Third Parties

We do not sell personal data. We disclose personal data only as described below, and only to the extent necessary for the relevant party to perform its function.

• Employees and distributors, who may access personal data solely to process an order or request initiated by the visitor, and who are bound not to share that data with any other party.
• Third-party courier service companies chosen by the visitor, to the extent necessary to ship an order to an address we cannot otherwise reach.
• Payment processors, namely Safaricom (for M-Pesa STK Push transactions) and Pesapal (for card and other payment method transactions processed through its interface), who receive the payment information necessary to process your payment.
• WhatsApp, where you choose to submit a returns or refunds claim, together with any supporting images or video, via our dedicated WhatsApp number.
• Google Maps Platform, which processes the location and address information you provide at checkout in order to calculate delivery routing and estimates.

By using our website, you consent to the transfer of such data to the parties described above, to the extent necessary for them to perform the relevant function.

6. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes described in this Policy, including to comply with our legal, accounting, or reporting obligations.

7. Cross-Border Data Transfers

Where any of our service providers store or process personal data outside Kenya, such transfers are carried out in accordance with the requirements of the DPA, including the use of appropriate contractual or other safeguards. Our current cross-border processing includes:

• Database hosting: MongoDB Atlas, with our cluster located in South Africa.
• Website hosting and application functions: Vercel, with functions executing from a Cape Town, South Africa region.
• Transactional and promotional email: Resend, a US-based provider.
• SMS delivery: HostPinnacle, a Kenyan company whose SMS gateway infrastructure is understood to be based in Kenya, though its wider hosting infrastructure spans multiple countries including the United States.
• Location and mapping: Google Maps Platform (Google LLC, a US-based provider), used to process delivery coordinates and routing information provided at checkout.

8. Data Security

We take precautions to protect your personal data. Personal data submitted via our website, including your name, email address, phone number, shipping address, and payment details, is encrypted and protected both in transit and at rest.

9. Data Breach Notification

In the event of a breach affecting personal data likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and affected data subjects within the timeframes required under the DPA.

10. Cookies

A cookie is a string of information that our website stores on your device, and that your browser provides to our website each time you return. Cookies allow us to recognize you, avoid asking you to log in more than once, and retain information you have entered into forms, thereby saving you time on our website.

Cookies strictly necessary for the operation of our website are used on that basis. Where we use cookies for other purposes, such as analytics, we will seek your consent before doing so, and you may withdraw that consent at any time.

Cookies on our website expire; those holding your order information are cleared once your order is placed. If you do not wish to have cookies placed on your device, you may set your browser to refuse cookies before using our website, though certain features of our website may not function properly as a result.

11. Your Rights Under the Data Protection Act, 2019

Subject to applicable exceptions, you have the right to: be informed of the use to which your personal data is to be put; access your personal data in our custody; request correction of inaccurate or outdated personal data; request the deletion or destruction of personal data that is no longer necessary, or that has been unlawfully processed; object to the processing of your personal data; request the transfer of your personal data to another party (data portability); and restrict or object to processing carried out for direct marketing, without justification.

You may exercise any of these rights by contacting us using the details in Section 12 below. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner.

12. Data Protection Officer and Contact

Questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data may be directed to our Data Protection Office by email: admin@kombuchakenya.co.ke.

13. Links to Other Sites

Our website contains links to other sites. We are not responsible for the content or privacy practices of such other sites. We encourage you to be aware when you leave our site and to read the privacy statements of any other site that collects personal data.

14. Updates to This Policy

This Privacy Policy may change from time to time, and all updates will be posted on this page. We encourage you to check this page periodically for changes. Your continued use of our website after any change to this Privacy Policy will constitute your acceptance of that change.