Privacy policy
How we handle the personal information you give us when you order, and the rights you hold over it under the Data Protection Act, 2019.
Who is responsible for your information
Rolina Grains Store is the data controller for the information described on this page. You can reach us at 0725 299 318, by email at Rolinasq@gmail.com, or at Maombini Plaza, Shop No. 8 (opposite Utugi Hotel), Nakuru, 20100.
What we collect, and why
We collect only what is needed to get an order to you and to account for the sale.
- Your name. So the rider knows who the delivery is for.
- Your mobile number. So we can reach you about the delivery, and so you can look your order up afterwards. Your order can only be retrieved by someone who has both the order number and this number.
- Your delivery address and any note you add. So the order can be found and delivered.
- Your email address, if you choose to give one. It is optional and we use it only for information about your order.
- What you ordered, what it cost, and what has been paid. This is the record of the sale itself.
We do not collect anything else. We do not build a profile of you, we do not track you across other websites, and we do not sell or rent your information to anybody.
Our lawful basis
Under section 30 of the Data Protection Act, 2019 we rely on the following grounds. Your name, phone number and delivery address are processed because they are necessary to perform the contract of sale you enter into when you place an order. Records of completed sales are kept because we are under a legal obligation to retain accounting records. Where we check an order that looks fraudulent, we rely on our legitimate interest in preventing loss.
Who else sees it
- Our technology provider. The store runs on Supabase, which hosts the database on our behalf. The data is stored in Frankfurt, Germany.
- The person delivering your order. They see your name, phone number and address, and nothing else.
- Safaricom, where you pay by M-PESA. Your payment is handled by Safaricom under their own terms and their own privacy policy. We never see or store your M-PESA PIN.
Because our database is hosted in Germany, your information leaves Kenya. We rely on the appropriate safeguards required by sections 48 and 49 of the Data Protection Act, 2019 for that transfer, including the contractual protections in our agreement with our hosting provider.
Cookies and tracking
This website sets no cookies at all, and loads no advertising or analytics script that would profile you. Your basket is kept in your own browser's local storage on your own device. It never reaches us until you place an order, and clearing your browser data removes it.
How long we keep it
Records of completed orders, including what was bought and what was paid, are kept for seven years to satisfy tax and accounting obligations. Where you have not completed an order, the details are kept only as long as needed to resolve the matter and are then removed. If you ask us to delete your contact details and we are not required to keep them, we will.
Your rights
Under section 26 of the Data Protection Act, 2019 you have the right to:
- be told how your information is being used, which is what this page does;
- ask for a copy of the information we hold about you;
- have information that is wrong corrected;
- ask us to delete information we no longer have a reason to keep;
- object to how we are using it, or ask us to restrict that use;
- receive your information in a portable form.
To exercise any of these, contact us using the details above. We will respond without undue delay. If you are not satisfied with our answer, you may complain to the Office of the Data Protection Commissioner, which regulates us.
If something goes wrong
No breach of this store's data has occurred. We state our position before one ever does. If personal data we hold were unlawfully accessed, disclosed or lost, we would notify the Office of the Data Protection Commissioner within seventy-two hours of becoming aware of it, as section 43 of the Data Protection Act, 2019 requires, and we would tell any affected customer directly and without undue delay where the breach was likely to cause them real harm. We would say what happened, what information was involved, and what we were doing about it.
Changes to this policy
If we change how we handle your information, we will change this page. The version you agreed to is the one that was published when you placed your order.