Privacy policy
This explains what KOOKOO BASKET LTD, trading as KooKoo Basket (“we”), collects when you order from our online shop, why we collect it, and the choices you have. We handle personal data in line with the Kenya Data Protection Act, 2019.
What we collect
- Your order: your name, phone number, delivery location (typed, or your phone’s location if you tap “Use my current location”), any note you add for the rider, the items and the delivery day you chose.
- Your payment: you pay with M-PESA. We receive the M-PESA receipt number, the amount and the phone number that paid. We never see or store your M-PESA PIN or card details.
- Your WhatsApp number and messages: your number is used to confirm your order and message you about it. If you write to us on WhatsApp, we keep the messages.
- Security data: to stop abuse, we keep a scrambled (hashed) version of your network address, never the address itself.
Why we use it
- To take your order, collect payment, and deliver to you.
- To send order confirmations and delivery updates on WhatsApp.
- To confirm your phone number with a one-time code, so offers you qualify for apply automatically.
- To tell you about offers on WhatsApp. Every offer message tells you how to stop: reply STOP, and we stop sending offers.
- To keep our records, handle refunds and complaints, and meet tax and accounting rules.
- To protect the shop from fraud and misuse.
Cookies and storage on your device
- Your basket and details (name, phone, location) are saved in your browser so you don’t retype them. They stay on your device.
- A confirmation cookie remembers, for up to 180 days, that this browser has confirmed your phone number (by a WhatsApp code or by paying with M-PESA). It holds your number in a signed form that can’t be changed. Tap “Not you?” at checkout to remove it.
- A short checkout cookie lasts one hour while a payment is in progress.
- We do not use advertising or tracking cookies.
Who we share it with
We don’t sell your data. We share it only with the services that run the shop:
- Kopo Kopo and Safaricom M-PESA, to take your payment.
- Meta (WhatsApp), to send you messages.
- Supabase, which hosts our database, and Vercel, which hosts this website.
- Google, which suggests delivery places as you type.
- Our riders, who see your name, phone number and delivery location to reach you.
Some of these services process data outside Kenya. They act on our behalf and protect it as their terms require.
How long we keep it
Order and payment records are kept for as long as the law and our accounting require. WhatsApp messages and customer details are kept while you remain a customer, and deleted on request unless we must keep them.
Your choices
You can ask us to:
- show you the data we hold about you;
- correct it;
- delete it, where we are not required to keep it;
- stop sending you offers (reply STOP to any offer).
To do any of these, reply to any WhatsApp message from us. If you are not satisfied, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).
Changes
If this policy changes, we will update this page and its date.