Privacy policy

1. Who is responsible

Newbies Family Fashion is responsible for personal information collected through this store for its own shopping and customer-service purposes. We operate from Elburgon, Mastima, Opposite Michinda Primary Road, Kenya.

For privacy questions or requests, email info@newbies.co.ke or call 0791 273 661. Use “Privacy request” as the email subject if possible. These contact details are not a request to send identity documents unless we explain why limited verification is needed.

2. Information we collect

Account information includes your name, email address, optional phone number, a password hash and account status. Shopping information includes your bag, wishlist, selected items, order references, prices, bundle savings, delivery choice, recipient details and order progress.

Payment information includes the M-Pesa phone number, amount, request identifiers, receipt or transaction reference and payment status. We do not ask for or store your M-Pesa PIN. Customer-service communications may include return reasons and photos you choose to send.

The hosting platform and application may process technical information such as IP address, browser details, request times, security logs and essential session identifiers to operate and protect the website. Employee accounts and product approvals create internal operational records.

3. Why we use information

We use order and account details to provide the services you request: create accounts, reserve stock, verify payments, arrange delivery, handle returns and answer questions. Processing needed to enter into or perform an agreement is distinct from optional marketing.

We use relevant records to meet applicable accounting and legal obligations, resolve disputes and respond to lawful requests. We also have legitimate interests in protecting customers, investigating fraud and maintaining a secure, reliable store, balanced against your rights.

Where consent is the appropriate basis, including optional promotional communications, we will ask separately. Creating an account, ordering or requesting a password reset does not automatically subscribe you to marketing. You may withdraw marketing consent without affecting a purchase already made.

4. Who receives information

Authorised staff receive the access necessary for their role. Owners can manage customer orders and payments; product-entry employees do not receive general access to customer orders or payment reports through the website.

Service providers may process information to host the store, send transactional email or provide technical support. Safaricom processes M-Pesa transactions under its own applicable terms and privacy notices. A matatu driver or transport operator receives the recipient name, phone number, destination and parcel details needed for delivery.

We do not sell your personal information. We may disclose limited information where legally required, to establish or defend a claim, or with your instruction. We aim to share only what is needed for the purpose.

5. Email, SMS and WhatsApp

Password-reset emails and order-related replies are service communications. Requests made through email, calls or WhatsApp are handled through those channels and their providers. Please do not send passwords, PINs or security codes.

Joining a promotional WhatsApp group or opting into SMS offers is separate from website checkout. Other group members may be able to see your phone number or profile information, depending on the group and platform settings. Contact us to stop promotional messages or leave the group using WhatsApp controls. Service messages needed for an active order may still be sent.

6. Cookies and external services

The store uses essential session and security cookies for sign-in, the bag and form protection. These are needed for those functions. Browser controls can delete or block cookies, but doing so may prevent checkout or account access from working.

This version does not install advertising trackers or optional analytics cookies. If we introduce them, we will update the notice and provide any consent controls required before activation.

Opening a Google Maps or WhatsApp link sends you to an external service, which processes information under its own policies. If live Google reviews are enabled, review author information is supplied by Google Maps and loading author images may make a request from your browser to Google’s image servers.

When you open a product, its ID is added to a recently viewed list in your current browser session. We use up to 12 IDs to show available items you viewed recently; this list is not a cross-device account history. You can clear it from the homepage. It is removed when your session ends or you sign out.

7. Storage location and security

We use Hostinger and other configured service providers. Their infrastructure or support operations may process data outside Kenya. For cross-border processing, appropriate safeguards and any other conditions required by Kenyan law must be put in place; contact us for information about the arrangements relevant to your data.

We use measures including HTTPS, hashed passwords, access controls and private storage of payment callback information. No internet service can promise absolute security. Keep your login details and private guest-order links secure and tell us promptly if you suspect misuse.

8. How long we keep information

We keep active account and wishlist information while needed to provide the account. We retain order, payment, return and dispute records for the periods needed to meet applicable legal obligations and resolve claims, and then delete or anonymise them when no longer needed.

Security and operational logs are kept for a limited period appropriate to their purpose. Password-reset links expire after 60 minutes; expired reset records are scheduled for removal when the site scheduler is running. Backup copies may remain until their normal replacement cycle completes.

A deletion request may not remove records we must lawfully retain. We will explain relevant retention reasons and restrict unnecessary use where appropriate.

Customers can delete their account under My details by confirming their password. We remove access, clear the wishlist and replace the account name, email, phone and password with non-identifying account values. We retain the historical account ID and transaction records, including order contact and delivery details where needed for fulfilment, refunds and lawful record-keeping. This action does not cancel purchases or automatically erase every transaction record; contact us for a wider privacy request.

9. Your privacy rights

Subject to applicable law, you may ask to be informed about the use of your data, access it, correct inaccurate or misleading information, object to certain processing, seek erasure or restriction and request portability where available. You may withdraw consent for processing based on consent.

Send a request to info@newbies.co.ke with enough information to identify the account or order. We may ask for proportionate verification to protect your information, but will not ask for your password or M-Pesa PIN. We will respond within the applicable legal time limit and explain any lawful restriction.

If you are dissatisfied, you may complain to the Office of the Data Protection Commissioner in Kenya through www.odpc.go.ke, without first having to give up other remedies.

10. Children and changes to this notice

The shopping account is intended for adults. We sell children’s clothes, but do not require children’s names, identity details or birth dates to sell them. A parent or guardian should place any order on behalf of a child. Contact us if a child has supplied personal information without appropriate authority.

We may update this notice as the store or its services change. The version shown on the page identifies the current notice. Material changes will be communicated as required; we will not silently repurpose data for an incompatible new use.