SecuDepo — Your Eyes on Safety

Privacy Policy

How we collect, use, store and protect your personal information

SecuDepo ("we", "us", "our") is committed to protecting your privacy and handling your personal data with care, transparency and respect. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and your rights in relation to it.

This policy applies to all personal data collected via our website at secudepo.co.ke, through our WhatsApp and telephone channels, and through our order management processes. This policy is compliant with Kenya's Data Protection Act, 2019.

Last updated: June 2025

1. Information We Collect

We collect personal information in the following ways:

Information You Provide Directly

  • Order information: When you place an order, we collect your name, phone number, email address, delivery address, and order details (products, quantities, total amount).
  • Account information: If you create an account, we collect your name, email address and, if applicable, a password (stored in hashed form).
  • Contact information: When you contact us via phone, WhatsApp or email, we may retain records of those communications including your contact details and the content of your messages.
  • Newsletter subscriptions: If you subscribe to our newsletter, we collect your email address and, optionally, your name.

Information Collected Automatically

  • Usage data: We collect information about how you interact with our website, including pages visited, time spent, links clicked, search terms used, and referring websites.
  • Device and browser information: We collect information about the device and browser you use to access our website, including IP address, browser type and version, operating system, and screen resolution.
  • Cookies: We use cookies and similar tracking technologies to enhance your experience. See Section 7 for details.

Information from Third Parties

  • Payment processors: If payment is made via M-Pesa, we may receive confirmation data from Safaricom's payment processing systems, limited to confirmation of payment and the amount.
  • Analytics providers: We use Google Analytics to understand how visitors use our website. Google Analytics collects anonymised data about website usage.

2. How We Use Your Information

We use your personal information for the following purposes:

  • Order fulfilment: To process, confirm, dispatch and deliver your orders, and to communicate with you about your order status.
  • Customer support: To respond to your enquiries, resolve complaints and provide technical assistance.
  • Account management: To create and manage your account, if you choose to create one.
  • Marketing communications: To send you newsletters, product updates and promotional offers — but only with your consent. You may opt out at any time.
  • Website improvement: To understand how our website is used, identify issues and improve user experience.
  • Legal compliance: To comply with applicable Kenyan laws and regulations, including tax and record-keeping obligations.
  • Fraud prevention: To detect, prevent and investigate fraudulent or unlawful activity.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Kenya's Data Protection Act, 2019:

  • Performance of a contract: Processing necessary to fulfil an order you have placed with us.
  • Legitimate interests: Processing for fraud prevention, website analytics and improving our services, balanced against your interests and rights.
  • Consent: Where you have given clear consent — for example, to receive marketing emails or for non-essential cookies.
  • Legal obligation: Where processing is necessary to comply with a legal requirement.

4. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy:

  • Order records: Retained for 7 years to comply with Kenyan tax and accounting regulations (Income Tax Act, VAT Act).
  • Customer accounts: Retained for as long as the account is active, plus 2 years after the last activity.
  • Marketing consent records: Retained for as long as you remain subscribed, plus 3 years after unsubscription.
  • Communication records (WhatsApp/email): Retained for up to 2 years.
  • Analytics data: Anonymised and retained in accordance with Google Analytics' data retention policies.

5. Sharing Your Information

We do not sell, rent or trade your personal information to third parties. We may share your data with the following categories of recipients strictly to fulfil our obligations to you:

  • Delivery partners: Your name, phone number and delivery address are shared with our courier partners to enable delivery of your order.
  • Payment processors: Payment confirmation data is processed by M-Pesa (Safaricom) in accordance with their privacy policy.
  • Cloud service providers: We use secure cloud platforms for website hosting, email and data storage (e.g., Vercel, Google Firebase). These providers process data on our behalf under data processing agreements.
  • Legal authorities: Where required by law, court order or lawful request from a government authority in Kenya.

6. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration or destruction:

  • Our website uses HTTPS encryption for all data in transit.
  • Access to customer data is restricted to authorised SecuDepo personnel with a legitimate business need.
  • We do not store payment card details or M-Pesa PINs.
  • Our systems and software are regularly updated to address known security vulnerabilities.

No system is 100% secure. In the unlikely event of a data breach affecting your personal information, we will notify you and the Office of the Data Protection Commissioner (ODPC) within the timeframes required by the Data Protection Act, 2019.

7. Cookies

Our website uses cookies — small text files stored on your device — to enhance functionality and understand how the website is used. We use:

  • Essential cookies: Required for the website to function (e.g., shopping cart state, session management). These cannot be disabled.
  • Analytics cookies: Used by Google Analytics to collect anonymised usage data. You may opt out via your browser settings or the Google Analytics opt-out browser add-on.
  • Marketing cookies: Used by Google Tag Manager to serve relevant advertising. These are only set with your consent.

8. Your Rights

Under Kenya's Data Protection Act, 2019, you have the following rights regarding your personal data:

  • Right of access: Request a copy of the personal data we hold about you.
  • Right to correction: Request that inaccurate or incomplete data is corrected.
  • Right to deletion: Request that your personal data is deleted, subject to our legal retention obligations.
  • Right to restrict processing: Request that we limit how we use your data in certain circumstances.
  • Right to data portability: Request your data in a structured, machine-readable format.
  • Right to object: Object to our use of your data for marketing or other purposes based on legitimate interests.
  • Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at info@secudepo.co.ke with "Privacy Request" in the subject line. We will respond within 30 days of receiving your request.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

9. Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make significant changes, we will post the updated policy on this page with a new "Last updated" date. We encourage you to review this page periodically.

11. Contact Us

For questions, concerns or requests regarding your privacy and personal data, contact our Data Controller: