Privacy Policy

1. Who we are

Wambu Hardware Limited (KRA PIN P051704967S) is a hardware retail and wholesale business at P.O. Box 74-20600, Maralal, Samburu County, Kenya. We operate a physical store together with digital platforms at wambu.org (also reachable at marketing.wambu.org) and the customer and staff application at app.wambu.org.

For the purposes of the Kenya Data Protection Act, 2019 (the Act), Wambu Hardware Limited is the Data Controller responsible for your personal data.

Questions about this policy go to our Data Controller:
Email: wambuhardwarelimited@gmail.com
Telephone: 0140 782 822, 0140 807 733, 0713 279 229
WhatsApp: +254 713 279 229
Address: P.O. Box 74-20600, Maralal, Samburu County, Kenya

2. What data we collect

We collect only the personal data necessary to provide our services. This includes:

• Identity data: full name, and business name where you buy on behalf of a company.
• Contact data: phone number, WhatsApp number, email address, and general location such as town or county.
• Transaction data: purchase history, quotation and invoice details, payment records, and credit account information.
• Communication data: messages sent to us through our contact form, WhatsApp, email or telephone.
• Usage data: pages visited, browser type, IP address and time of access, collected automatically when you visit our website.

We do not collect sensitive personal data as defined in section 2 of the Act — such as health data, biometric data, or data revealing race, ethnicity or political affiliation — and we do not collect financial account credentials or PINs. We will never ask you for your M-Pesa PIN, by any channel, for any reason.

3. How we collect your data

We collect data directly from you when you:

• Submit a quote request or contact form on our website.
• Contact us by WhatsApp, telephone, email, or in person at our store.
• Open a credit account or make a purchase.
• Subscribe to any communication from us.

We also collect data automatically through cookies and web analytics when you browse our website. You may opt out of non-essential cookies through your browser settings.

4. How we use your data

We process your personal data on the lawful bases set out in section 30 of the Act:

• Performance of a contract: to process orders, issue quotations and invoices, manage customer and supplier accounts, and arrange deliveries.
• Legitimate interests: to respond to enquiries, maintain business records, prevent fraud, and improve our service.
• Compliance with legal obligations: to keep proper accounting and tax records as required by Kenyan law, including the Companies Act, 2015, the Tax Procedures Act, 2015, the Income Tax Act (Cap 470) and the Value Added Tax Act, 2013.
• Consent: to send promotional or marketing messages, where you have given explicit consent that you may withdraw at any time.

We do not sell personal data, and we do not use it for automated decision-making that produces legal effects concerning you.

5. Who we share your data with

We may share your data with:

• Service providers: cloud hosting, payment processors and logistics partners who process data on our behalf under written confidentiality terms.
• Professional advisers: lawyers, accountants and auditors, where required.
• Regulators and authorities: the Kenya Revenue Authority, the Office of the Data Protection Commissioner, courts, or law enforcement, where required by law.

Where a service provider stores data outside Kenya, we transfer it only in accordance with section 48 of the Act, on the basis of appropriate safeguards or your explicit consent.

6. How long we keep it

We keep personal data for as long as needed for the purpose it was collected for, plus any additional period required by law. In general:

• Customer transaction records are kept for at least 7 years, as required by the Tax Procedures Act, 2015.
• Enquiry and contact form data is kept for 2 years from the date of last contact.
• Website usage data is kept for 12 months.

When data is no longer required it is securely deleted or anonymised.

7. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Be informed of the use to which your personal data is put.
• Access the personal data we hold about you.
• Correction of inaccurate, misleading or incomplete data.
• Deletion of data we no longer have a lawful reason to hold.
• Object to processing carried out on the basis of legitimate interests, and to direct marketing at any time.
• Data portability, to receive your data in a structured, commonly used format.
• Withdraw consent at any time where consent is the lawful basis we rely on.
• Complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke if you believe your rights have been infringed.

To exercise any of these rights, email wambuhardwarelimited@gmail.com, call 0140 782 822, or message WhatsApp on +254 713 279 229. We respond within 21 days. Exercising a right costs nothing, and we will not treat you differently for doing so.

8. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss or destruction. Internal systems are password-protected, access is limited to authorised staff, and administrative actions are logged.

No transmission over the internet or electronic storage is completely secure. Where a personal data breach presents a real risk to your rights and freedoms, we will notify the Data Commissioner and affected data subjects in accordance with section 43 of the Act. Contact us immediately if you believe your data has been compromised.

9. Cookies

Our website uses essential cookies to maintain basic site functionality, and may use analytics cookies to understand how visitors use the site. You can control cookies through your browser settings. Disabling cookies may affect some features.

10. WhatsApp communications

Our contact and quote forms open a pre-written message in WhatsApp on your own device; nothing you type is stored on this website, and you can edit or abandon the message before it sends. Once sent, WhatsApp’s own privacy policy, at whatsapp.com/legal/privacy-policy, governs how WhatsApp processes that message. We use WhatsApp solely to deal with your enquiry or order.

11. Changes to this policy

We may update this policy from time to time. The effective date shown above reflects the current version. Where a change materially affects how we use your data, we will bring it to your attention rather than rely on the updated page alone.

12. Governing law

This policy is governed by and construed in accordance with the laws of Kenya, including the Kenya Data Protection Act, 2019 and regulations made under it. Any dispute is subject to the jurisdiction of the courts of Kenya, without prejudice to your right to complain to the Office of the Data Protection Commissioner.