Privacy Policy

[Registered company name, e.g. Genesis Investment Limited], trading as Genesis Investment, of [Physical address, e.g. Plot no., Road], Industrial Area, Nairobi, is the data controller for personal data collected through this website. We are registered with the Office of the Data Protection Commissioner (ODPC) under no. [ODPC registration no. — register at odpc.go.ke]. Our data protection contact is [Data Protection Officer name or role], reachable at [privacy@genesisinvestment.co.ke].

• Account details — name, email address, phone number and password (stored only in encrypted, hashed form — we can't read it).
• Order details — the parts you buy, delivery address and nearest landmark, delivery option, payment method and payment status, and messages about your order.
• Cart and wishlist — the parts you save, kept with your account while you're signed in so you can pick up where you left off on any device.
• Enquiries — what you send us through the contact form, email, phone or WhatsApp.
• Security data — your IP address and browser type when you sign in, used to protect your account and detect misuse.

• To process and deliver your orders, take payment, handle returns and warranty claims — necessary to perform our contract with you.
• To keep you updated about your order by email and SMS (confirmation, dispatch, delivery, cancellations, refunds) — part of performing the contract.
• To run your account — sign-in, verification codes, password resets and account security — contract and our legitimate interest in preventing fraud.
• To meet legal obligations — tax and accounting records required by the Kenya Revenue Authority.
• Marketing — we only send promotional messages if you've opted in, and you can opt out at any time.

We never sell your personal data. We share only what's needed with service providers who process it on our behalf under contract:

• Delivery partners (G4S and Wells Fargo and our riders) — your name, phone number and delivery address;
• Payment providers (M-Pesa, card processor) — to take and refund payments;
• Email and SMS providers — to send order and account messages;
• Hosting and IT providers — to run this website securely;
• Authorities — where the law requires it, such as the Kenya Revenue Authority or a court order.

Some providers may store data outside Kenya. Where they do, we use providers that give appropriate safeguards for your data as required by the Data Protection Act, 2019.

• Order and payment records: 7 years, as required for tax and accounting.
• Account details, cart and wishlist: while your account is open, and deleted or anonymised within 90 days of you asking us to close it (except order records we must keep).
• Sign-in security logs: up to 12 months.
• Enquiries: up to 2 years after we've resolved them.

Under the Data Protection Act, 2019 you have the right to:

• be informed about how your data is used (this policy);
• access the personal data we hold about you;
• correct inaccurate or incomplete data — you can update most details yourself under Profile & settings;
• have your data deleted, where we no longer need to keep it;
• object to or restrict our use of your data, including for marketing;
• receive your data in a portable format.

To use any of these rights, email [privacy@genesisinvestment.co.ke]. We'll respond within the time the law requires. If you're unhappy with how we've handled your data, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.

We don't use advertising or tracking cookies. Your browser stores a small amount of data that the site needs to work — your sign-in session and your cart — which you can clear at any time in your browser settings. If we add analytics in future, we'll update this policy and ask for your consent where required.

We use encrypted connections, hashed passwords, verification codes, role-based access for our staff, and sign out every device when you reset your password. No system is perfectly secure, but if a breach affecting your data occurs we'll notify you and the ODPC as the law requires.

We may update this policy as our services change. The date at the top shows when it was last updated; for significant changes we'll also let you know by email.