Privacy policy

At OrderMania, we respect your privacy and are committed to protecting the personal information entrusted to us.

This Privacy Policy explains how OrderMania collects, uses, stores, protects, shares and otherwise processes personal data when you visit our website, create an account, place an order, communicate with us, use our services or interact with our digital platforms.

This policy is designed with reference to the laws and regulatory framework applicable in Kenya, including:

The Constitution of Kenya, 2010, particularly the right to privacy under Article 31.
The Data Protection Act, 2019.
The Data Protection (General) Regulations, 2021.
The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.
The Data Protection (Complaints Handling and Enforcement) Regulations, 2021.
Other applicable Kenyan laws and regulatory requirements concerning personal data and electronic commerce.

The Office of the Data Protection Commissioner (ODPC) is Kenya's statutory data protection regulator.

This Privacy Policy should be read together with the OrderMania Terms & Conditions and other applicable OrderMania policies.

1. WHO WE ARE

For purposes of this Privacy Policy, "OrderMania", "we", "us" or "our" refers to the OrderMania business and its authorised representatives.

Our website is:

ordermania.co.ke

OrderMania may act as a data controller where we determine the purposes and means of processing personal data.

Where another organisation processes personal data on our behalf, that organisation may act as a data processor, subject to the applicable contractual and legal requirements.

The Data Protection Act distinguishes between data controllers, who determine how and why personal data is processed, and data processors, who process personal data on behalf of a controller.

2. WHAT IS PERSONAL DATA?

Personal data is information relating to an identified or identifiable individual.

Depending on how you interact with OrderMania, this may include information such as:

Full name.
Telephone number.
Email address.
Delivery address.
Postal address where provided.
Order history.
Purchase information.
Payment transaction information.
Customer account information.
Customer support communications.
WhatsApp conversations with OrderMania.
Reviews and feedback.
IP address.
Device information.
Browser information.
Website activity.
Cookies and similar technologies.
Approximate location information where relevant to providing a service.
Photographs or videos submitted in connection with an order, return or complaint.
Information required to investigate fraud, disputes or security incidents.

Kenyan law defines personal data broadly to include information that can identify a person directly or indirectly.

3. SENSITIVE PERSONAL DATA

Certain categories of personal information receive additional protection under Kenyan law.

OrderMania does not ordinarily require customers to provide sensitive personal data in order to purchase ordinary retail products.

Where sensitive personal data is voluntarily provided to us, or where we are legally required to process it, we will handle it in accordance with applicable law and appropriate safeguards.

Customers should not provide sensitive personal information to OrderMania unless it is reasonably necessary for the particular service or issue being handled.

4. INFORMATION WE COLLECT

We may collect personal information in several ways.

4.1 Information You Provide Directly

You may provide information when you:

Create an account.
Place an order.
Request delivery.
Contact customer support.
Submit a return or refund request.
Submit a warranty claim.
Make an enquiry.
Subscribe to marketing communications.
Submit a review.
Participate in a promotion.
Contact us through WhatsApp, email, telephone or other authorised channels.
4.2 Information Collected Automatically

When you use our website, certain technical information may be collected automatically.

This may include:

IP address.
Browser type.
Operating system.
Device type.
Website pages visited.
Referring website.
Time and date of visits.
General usage information.
Cookies and similar identifiers.

This information helps us maintain security, improve website performance and understand how customers use our website.

4.3 Information Received From Third Parties

Where lawful and necessary, we may receive relevant information from third parties such as:

Payment service providers.
Delivery and courier partners.
Technology service providers.
Fraud prevention providers.
Customer communication platforms.
Analytics providers.
Suppliers involved in fulfilling an order.

We only seek information that is reasonably necessary for the relevant purpose.

Kenyan law generally requires personal data to be collected directly from the data subject, subject to specified exceptions.

5. WHY WE COLLECT YOUR INFORMATION

We collect and process personal data for specific, lawful and legitimate purposes.

These purposes may include:

5.1 Processing Orders

We use your information to:

Process your order.
Confirm your purchase.
Prepare products for dispatch.
Arrange delivery.
Contact you about your order.
Provide order updates.
Process returns and refunds.
5.2 Customer Support

We use information to:

Respond to enquiries.
Investigate complaints.
Resolve delivery problems.
Handle returns and refunds.
Handle warranty claims.
Maintain customer service records.
5.3 Payments

We may process information necessary to:

Confirm payments.
Reconcile transactions.
Detect payment errors.
Process refunds.
Prevent payment fraud.

Where a third-party payment provider processes your payment, that provider may separately process your information according to its own privacy terms.

OrderMania does not require customers to disclose confidential authentication credentials such as M-Pesa PINs or card PINs.

5.4 Delivery

We use relevant customer information to arrange delivery.

This may include:

Customer name.
Telephone number.
Delivery location.
Landmark or directions.
Order details.

We may share the minimum information reasonably necessary with an authorised delivery provider to complete your delivery.

5.5 Fraud Prevention and Security

We may process information to:

Detect suspicious transactions.
Prevent fraud.
Investigate abuse.
Protect customer accounts.
Protect OrderMania systems.
Investigate security incidents.
Protect our customers and business.
5.6 Improving Our Services

We may use information and aggregated or anonymised data to:

Improve our website.
Improve product selection.
Improve customer experience.
Analyse purchasing patterns.
Identify technical problems.
Improve delivery operations.
Develop new services.

Where data is used for analytics, we will take reasonable steps to avoid unnecessarily identifying individual customers.

5.7 Marketing

Where permitted by law, we may use your contact information to send:

New product announcements.
Discounts.
Promotions.
Special offers.
OrderMania updates.
Other marketing communications.

Where consent is required, we will seek it.

You may opt out of marketing communications at any time through the available unsubscribe or communication-preference mechanism.

Opting out of marketing does not prevent us from sending essential transactional communications relating to your orders, account, payments, delivery, returns or security.

6. OUR LAWFUL BASIS FOR PROCESSING

OrderMania will only process personal data where there is a lawful basis for doing so.

Depending on the circumstances, our lawful basis may include:

Performance of a contract — for example, processing an order you have placed.
Legal obligation — where processing is required by law.
Consent — where we ask for and rely on your permission.
Legitimate interests — where processing is reasonably necessary for legitimate business interests and your rights and interests are appropriately considered.
Other lawful bases recognised under Kenyan law.

The ODPC's compliance framework expressly identifies consent, contractual necessity, legal obligation and legitimate interests among the lawful bases that organisations may rely upon depending on the circumstances.

7. CONSENT

Where OrderMania relies on consent to process personal data, consent will be obtained in an appropriate manner.

Consent should be:

Voluntary.
Specific.
Informed.
Unambiguous.
Capable of being withdrawn.

Withdrawing consent does not necessarily make previous processing unlawful where that processing was lawfully carried out before withdrawal.

Where another lawful basis applies, OrderMania may continue processing the relevant information where permitted by law.

8. MARKETING COMMUNICATIONS

You may receive marketing communications if you have consented to them or where another lawful basis permits such communication.

Marketing may be delivered through:

SMS.
Email.
WhatsApp.
Website notifications.
Other authorised communication channels.

You can request that we stop sending marketing communications.

However, you may still receive essential service communications such as:

Order confirmations.
Payment notifications.
Delivery updates.
Return information.
Warranty information.
Security alerts.
Important account notices.
9. COOKIES AND SIMILAR TECHNOLOGIES

OrderMania may use cookies and similar technologies to:

Keep the website functioning.
Remember preferences.
Improve website performance.
Understand website usage.
Support security.
Measure marketing performance where applicable.

Cookies may be operated by OrderMania or by authorised third-party service providers.

Where required, OrderMania will provide appropriate information or obtain consent for non-essential cookies and similar technologies.

You may manage cookies through your browser settings, although disabling certain cookies may affect website functionality.

10. HOW WE SHARE PERSONAL DATA

OrderMania does not sell your personal information as a general business practice.

We may share personal data where reasonably necessary with authorised parties such as:

Delivery Providers

To deliver your order.

Payment Providers

To process and reconcile payments and refunds.

Technology Providers

For hosting, website infrastructure, communication, analytics, security and other technical services.

Suppliers

Where necessary to fulfil an order, process a return or provide warranty support.

Professional Advisers

Where necessary, with lawyers, accountants, auditors or other professional advisers who are subject to appropriate confidentiality obligations.

Government and Law-Enforcement Authorities

Where disclosure is required or permitted by law.

Fraud and Security Providers

Where necessary to protect OrderMania, customers or payment systems.

We aim to share only the information reasonably necessary for the relevant purpose.

11. THIRD-PARTY DATA PROCESSORS

OrderMania may use third-party service providers to process personal data on our behalf.

Examples may include:

Website hosting providers.
Cloud storage providers.
Payment processors.
SMS providers.
Email providers.
WhatsApp or communication technology providers.
Customer support systems.
Delivery management systems.
Analytics providers.
Cybersecurity providers.

Where applicable, OrderMania will use appropriate contractual and organisational measures to ensure that processors handle personal data consistently with applicable data protection requirements.

The DPA places obligations on controllers and processors and provides a regulatory framework overseen by the ODPC.

12. INTERNATIONAL DATA TRANSFERS

Some technology providers used by OrderMania may process or store data outside Kenya.

Where personal data is transferred outside Kenya, OrderMania will apply the safeguards and requirements required by applicable Kenyan data protection law.

This may include appropriate safeguards, contractual protections, an applicable lawful basis or other requirements recognised under Kenyan law.

The Kenyan data protection framework restricts transfers outside Kenya unless the applicable legal requirements concerning safeguards or consent are satisfied.

13. HOW WE PROTECT YOUR DATA

OrderMania will take reasonable technical and organisational measures to protect personal data against:

Unauthorised access.
Unauthorised disclosure.
Loss.
Destruction.
Accidental alteration.
Unlawful processing.
Other security risks.

Security measures may include:

Access controls.
Password protection.
Role-based access.
Secure system configurations.
Staff confidentiality requirements.
Monitoring and logging where appropriate.
Secure payment processing through authorised providers.
Data backup and recovery measures.
Security reviews.

No online system can be guaranteed to be completely secure.

Customers should also take reasonable steps to protect their own accounts and devices.

14. ACCESS TO PERSONAL DATA

You have rights under Kenyan data protection law concerning your personal data.

These include the right to request access to personal data held about you, subject to applicable legal requirements and exemptions.

The DPA expressly provides data subjects with a right to access personal data held by a data controller or processor.

To request access, contact us using the details provided in Section 23 of this policy.

We may need to verify your identity before providing information.

15. RIGHT TO CORRECTION

You may request correction of inaccurate, incomplete, false or misleading personal data held by OrderMania.

Where appropriate, we will take reasonable steps to correct the information.

The DPA expressly recognises a data subject's right to correction of false or misleading personal data.

16. RIGHT TO DELETION OR ERASURE

You may request deletion or erasure of personal data where applicable under Kenyan law.

However, deletion may not always be possible immediately.

OrderMania may retain certain information where necessary for:

Legal compliance.
Accounting and tax requirements.
Fraud prevention.
Dispute resolution.
Establishing or defending legal claims.
Completing a transaction.
Exercising or protecting legal rights.
Other lawful purposes.

The DPA provides a right concerning deletion of false or misleading data, while the broader regulatory framework recognises data-subject rights including erasure in appropriate circumstances.

17. RIGHT TO OBJECT

You may object to certain processing of your personal data where Kenyan law gives you that right.

This may include objection to particular forms of processing or direct marketing.

Where you object, OrderMania will assess the request and determine whether we are required to stop or restrict the processing.

18. RIGHT TO RESTRICT PROCESSING

Where applicable, you may request restriction of processing of your personal data.

This may apply in circumstances such as:

You contest the accuracy of personal data.
You believe processing is unlawful.
You need the data retained for a legal claim.
You have objected to processing and the objection is under consideration.

The ODPC identifies restriction of processing among the recognised data-subject rights.

19. RIGHT TO DATA PORTABILITY

Where applicable under Kenyan law, you may request your personal data in a structured, commonly used and machine-readable format or request that it be transmitted to another data controller where the legal conditions are met.

The availability of this right may depend on the nature and lawful basis of the processing.

The ODPC recognises data portability among data-subject rights.

20. AUTOMATED DECISION-MAKING

OrderMania may use automated tools for purposes such as:

Fraud detection.
Website analytics.
Personalised recommendations.
Marketing analysis.
Security monitoring.

Where OrderMania makes decisions based solely on automated processing that produce legal or similarly significant effects, we will handle such processing in accordance with applicable Kenyan law and any applicable data-subject rights.

21. CHILDREN'S DATA

OrderMania is primarily intended for general retail customers and is not specifically directed at children.

We do not intentionally collect children's personal data unless there is a lawful and appropriate reason to do so.

Where children's personal data is processed, OrderMania will apply the additional safeguards required under Kenyan law.

The ODPC provides specific guidance concerning the processing of children's data.

22. DATA RETENTION

OrderMania will retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

The nature of the information.
The purpose for which it was collected.
Whether you have an active account.
Transaction and accounting requirements.
Warranty obligations.
Customer complaints.
Fraud investigations.
Legal or regulatory requirements.
Potential or ongoing legal claims.

The ODPC's compliance framework specifically expects organisations to identify how long personal data is kept and to have data-retention and disposal protocols.

When personal data is no longer required, we will take reasonable steps to securely delete, anonymise or otherwise dispose of it.

23. DATA BREACHES

OrderMania will maintain reasonable procedures for identifying, assessing and responding to personal-data breaches.

Where a breach occurs that triggers notification obligations under Kenyan law, OrderMania will take the required steps within the applicable legal timelines.

Depending on the circumstances, this may include notifying the ODPC and affected data subjects where legally required.

Customers should notify OrderMania immediately if they suspect that their OrderMania account or personal information has been compromised.

24. CUSTOMER COMPLAINTS

If you believe OrderMania has mishandled your personal data, you should first contact us so that we can investigate and attempt to resolve the issue.

Your complaint should include:

Your name.
Contact details.
Description of the concern.
Relevant order or account information where applicable.
Any supporting evidence.

We will assess and respond to complaints in accordance with our internal procedures and applicable law.

25. COMPLAINTS TO THE ODPC

If you are dissatisfied with how your personal data has been handled, you may also contact the Office of the Data Protection Commissioner (ODPC) or pursue any other remedy available under Kenyan law.

The ODPC has statutory responsibility for regulating data protection in Kenya and provides mechanisms for receiving and investigating complaints concerning personal-data processing.

Office of the Data Protection Commissioner

Website: Office of the Data Protection Commissioner

Email: info@odpc.go.ke

Telephone: 020 780 1800

Postal Address: P.O. Box 30920-00100, Nairobi, Kenya

26. HOW TO EXERCISE YOUR DATA RIGHTS

To exercise your rights, contact OrderMania using the official contact details below.

Your request may concern:

Access.
Correction.
Deletion or erasure.
Objection.
Restriction.
Data portability.
Marketing preferences.
Other rights available under applicable law.

We may request reasonable information to verify your identity and protect your personal information from unauthorised disclosure.

We will handle valid requests within the timelines required by applicable law.

27. DATA PROTECTION CONTACT

For privacy and data-protection matters:

OrderMania

Website: ordermania.co.ke
Privacy Email: [Insert privacy@ordermania.co.ke or official privacy email]
Customer Support: [Insert phone number]
WhatsApp: [Insert official WhatsApp number]
Business Address: [Insert registered/business address]

Where OrderMania appoints a Data Protection Officer or another designated privacy contact, their details will be published here.

28. DATA PROTECTION REGISTRATION

Where required by applicable Kenyan law, OrderMania will register with the Office of the Data Protection Commissioner as the relevant data controller and/or processor.

The ODPC provides an electronic registration framework for organisations that fall within the registration requirements.

OrderMania will maintain the registrations, notifications and compliance measures applicable to its activities.

29. ACCOUNTABILITY AND INTERNAL DATA PROTECTION

OrderMania will seek to maintain internal measures appropriate to the nature and scale of its data processing.

These may include:

Data protection policies.
Information-security procedures.
Staff confidentiality obligations.
Access-control procedures.
Data retention procedures.
Data breach response procedures.
Third-party processor controls.
Customer rights request procedures.
Data-disposal procedures.

As OrderMania grows, these measures may be expanded to reflect new technologies, services and processing activities.

The ODPC's compliance framework specifically identifies data-protection policies, information-security documentation, data-retention protocols, complaints handling and controls for transfers to third parties as important compliance areas.

30. CHANGES TO THIS PRIVACY POLICY

OrderMania may update this Privacy Policy from time to time.

Changes may be made because of:

Changes in our services.
New technology.
Changes in how we process data.
Changes in our business structure.
Changes in third-party providers.
Changes in applicable Kenyan law.
Guidance or requirements issued by the ODPC.

The latest version will be published on our website with its effective date.

Where a material change significantly affects your rights or how we process your data, we will take reasonable steps to notify you where required.

31. RELATED POLICIES

This Privacy Policy should be read together with:

OrderMania Terms & Conditions
OrderMania Shipping & Delivery Policy
OrderMania Returns, Refunds & Exchanges Policy
OrderMania Payment & Pricing Policy
OrderMania Warranty & Product Guarantee Policy
32. GOVERNING LAW

This Privacy Policy is governed by the laws of the Republic of Kenya.

Where any provision of this Privacy Policy conflicts with a mandatory requirement of Kenyan data protection law, the applicable law will prevail.

33. CONTACT ORDERMANIA

If you have questions about this Privacy Policy or how OrderMania processes your personal data, contact us: