This policy explains how ZORAH collects and uses personal data when you shop with us, whether you buy, create an account or simply browse. We are the data controller for that information under the Data Protection Act, 2019.
It does not cover data collected by other companies whose services are linked from ours, including our payment provider once you leave our checkout for theirs.
Children
ZORAH is for adults. You must be at least 18 to hold an account or place an order. We do not knowingly collect personal data from children.
What we collect
Account and order data
- Your name and email address.
- Your phone number, which the courier needs to reach you.
- Your delivery address and town or county.
- What you ordered, what you paid and the status of that order.
- Payment references from our payment provider. We never receive your full card number or your M-Pesa PIN.
Things you choose to give us
- The concerns you pick when creating an account, which shape what we show you.
- Reviews you write, including the rating, the text and any product features you tick.
- Waitlist requests for products that are out of stock.
- Your email address, if you ask for the beauty letter.
Usage data
When you use the site we record technical information about the visit: device and browser type, pages viewed and the actions you take. We use it to keep the shop working, to detect fraud, and to understand which parts of the shop are actually used.
Why we use it, and on what basis
| What we do | Why | Lawful basis |
|---|---|---|
| Take and fulfil your order | You cannot buy without it | Performance of a contract |
| Pass your address to the courier | So the parcel reaches you | Performance of a contract |
| Process payments and refunds | To collect money and give it back | Performance of a contract |
| Keep order and tax records | We are required to | Legal obligation |
| Detect abuse of discount codes | So offers reach the customers they were meant for | Legitimate interest |
| Publish your review | You asked us to publish it | Consent, withdrawable |
| Email you when a product is back | You asked to be told | Consent, withdrawable |
| Send the beauty letter | Only where you opted in | Consent, withdrawable at any time |
Reviews are public — and what we publish
A review you publish is shown to everyone. We publish your first name and one initial, the rating, your words, and optionally the age range and product features you chose. We never publish your surname, your email address, your phone number or what else you have bought.
Who we share it with
We do not sell your personal data. We share only what a partner needs to do its job:
- Our payment provider, to take payment and issue refunds.
- Our courier partner, who receives the delivery address and phone number for that order only.
- Our email provider, to send order confirmations, restock alerts and the beauty letter if you asked for it.
- Our hosting and infrastructure providers, who store the data on our behalf under contract.
- Law enforcement or a regulator, where we are legally required to disclose.
How long we keep it
| Data | Kept for |
|---|---|
| Account data, while your account is open | Until you close the account |
| Order, payment and tax records | Seven years, as required of financial records |
| Published reviews | Until you ask us to remove them |
| Waitlist entries | Until the product restocks, or you ask us to remove you |
| Beauty letter subscription | Until you unsubscribe |
| Usage and technical logs | Twelve months |
Closing your account does not delete your order history, because we are required to keep financial records. Those records are separated from your marketing profile and are not used to contact you.
Your rights
Under the Data Protection Act, 2019 you have the right to:
- Be told how your data is used — this document.
- Access a copy of the personal data we hold about you.
- Have inaccurate data corrected.
- Have data deleted, where we are not required to keep it.
- Object to processing based on our legitimate interests.
- Withdraw consent to marketing at any time, without affecting anything else.
- Lodge a complaint with the Office of the Data Protection Commissioner.
To exercise any of these, contact us through the help centre. We verify who you are before acting on a request, and we respond within the period the Act allows.
Where your data is held
Our infrastructure is hosted outside Kenya by established providers under contractual safeguards. Where data leaves the country, it does so on terms that require the same standard of protection the Act requires of us.
Security
- Traffic to ZORAH is encrypted in transit.
- Card details never touch our systems; our payment provider handles them.
- Access to personal data is limited to staff who need it for their work.
- We keep the shop's data backed up, and restoring from those backups is tested rather than assumed.
Contact us
For any question about this policy or the data we hold, contact us through the help centre and reference Privacy. If we cannot resolve your concern, you may raise it with the Office of the Data Protection Commissioner of Kenya.
If not, message us with your order number and we will pick it up the same working day.