1. About this policy
Richmart Supermarket Limited (“Richmart”, “we”, “us”) operates the online ordering platform at richmart.co.ke (the “Platform”) and a staff and administration portal at manage.richmart.co.ke. Our physical store is at the Eagle Plains Estate Commercial Centre.
This policy explains what personal data we collect when you use the Platform, why we collect it, who can see it, how long we keep it, and the rights you have under the Data Protection Act, 2019 of Kenya. Where the law requires your consent (for example, for push notifications) we ask for it separately.
2. Who is responsible for your data
Richmart Supermarket Limited is the data controller for personal data processed through the Platform.
- Business address: Eagle Plains Estate Commercial Centre, Nairobi
- Privacy contact: 0740195694
3. Information we collect
3.1 Information you give us
- Account details: your name, mobile phone number, estate name and house number. Your estate and house number form your delivery address.
- Order details: the items you order, quantities, delivery notes, whether you allow substitutions, and your responses to substitution or price-change requests.
- Communications: messages you send through the contact form, and calls or messages to our support line.
3.2 Information created while you use the Platform
- Order history and status: processing, prepared, out for delivery and delivered; payment status (paid or unpaid); and timestamps.
- Adjustment records: if staff change a quantity, price or substitute on your order, we record what changed, who changed it and when.
- Notification data: if you turn on alerts, your browser or device gives us a push subscription (a device address and encryption keys). We also store your notification preferences.
- Technical data: IP address, browser and device type, pages requested, date and time, and error logs. See section 10 for cookies and local storage.
3.3 What we do not collect
At the time of writing, the Platform does not collect card or bank details (there is no online payment on the Platform), national ID numbers, precise GPS location, your contacts, photos, or camera and microphone access. If this changes, we will update this policy first.
4. How we use your information, and why
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create your account and verify that you live at the address given | Name, phone, estate, house number | Contract; legitimate interest in preventing fraud and delivering to genuine residents |
| Process, prepare and deliver your orders | Account and order data | Contract |
| Contact you about your order: substitutions, price confirmation, payment, delivery | Phone, order data | Contract |
| Send order-status push notifications | Push subscription, preferences | Consent (you can withdraw it at any time) |
| Security, fraud and abuse prevention, audit trail of order changes | Technical data, adjustment records | Legitimate interest; legal obligation |
| Keep the Platform running and fix errors | Technical data | Legitimate interest |
| Accounting, tax and other legal obligations | Order and payment status | Legal obligation |
| Respond to your requests and complaints | Communications | Contract; legitimate interest |
We do not sell personal data and we do not use it for third-party advertising. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing; account approval and order handling involve review by our staff.
5. Account verification
New accounts are reviewed and activated by Richmart staff before you can place an order [confirm this matches current behaviour]. We may call you to confirm that you live at the address you provided.
6. Push notifications
Push notifications are optional. If you turn them on, we use them to send order updates such as order received, substitution needed, out for delivery and delivered [add any other announcements you intend to send].
- You can turn them off at any time in your browser or device notification settings, or by removing the app from your device.
- Notifications may appear on your lock screen, so other people with access to your phone could see them.
- On Apple devices, notifications work only when the Platform has been added to the Home Screen, and require a recent version of iOS.
- Notifications are delivered through push services run by your browser or device provider (for example Apple, Google, Microsoft or Mozilla). They receive your device’s push address and an encrypted message.
7. Who we share information with
- Richmart staff. Access is limited by role. Administrators can see all orders and customer details. Preparation and delivery staff see the order information they need to do their job, such as items, your name, address and phone number.
- Hosting provider. Our web hosting provider HostPinnacle stores the Platform and its database on our behalf and may process data only on our instructions.
- Push notification services, as described in section 6.
- Mail service. Messages sent through the contact form are delivered by the mail service provided with our hosting.
- Advisers and authorities. Where required by law, a court order, or to protect rights, safety or property.
- Business transfer. If Richmart is restructured or sold, personal data may be transferred to the new owner, who must honour this policy.
We do not share personal data with anyone else without a lawful basis.
8. Transfers outside Kenya
Our hosting servers are located in Nairobi, Kenya. Push notification services may process data outside Kenya. Where personal data leaves Kenya, we ensure the transfer is permitted under the Data Protection Act, 2019 and that appropriate safeguards are in place.
9. How long we keep information
| Data | Retention |
|---|---|
| Account details | While your account is active, and for [24 months] after your last order, then deleted or anonymised unless the law requires us to keep it |
| Order, payment-status and adjustment records | 7 years for accounting and legal purposes |
| Push subscriptions | Until you turn alerts off or the subscription expires |
| Server and error logs | 90 days |
| Contact-form messages | 12 months |
10. Cookies and similar technologies
| Technology | Purpose | Type | Duration |
|---|---|---|---|
| Session cookie | Keeps you signed in during your visit and remembers your cart | Essential | Until you close the browser or sign out |
| Security (CSRF) token | Protects forms from forgery | Essential | Session |
| “Keep me signed in” cookie | Remembers your login on your device, only if you choose it | Functional | Up to 30 days |
| Local and session storage | Interface preferences and the app start screen | Functional | Until cleared |
| Service worker cache | Faster loading and basic offline pages when installed as an app | Functional | Until cleared or updated |
We do not currently use advertising or cross-site tracking cookies. The Platform may load fonts or icons from third-party content delivery networks, which would see your IP address when they do.
You can clear cookies and site data in your browser settings; some features, such as staying signed in, will then stop working.
11. Security
We take reasonable steps to protect your information, including:
- encryption of traffic between your device and the Platform (HTTPS);
- role-based access control, with the administration portal on a separate address;
- protection against forged requests and validation of submitted data;
- restrictions on deleting records that have order history, and an audit trail of order changes;
- regular backups and periodic security reviews.
No online service is completely secure. Because you sign in with your phone number and house number, please do not share them. If you think someone has used your account, contact us immediately at 0740195694.
12. Data breaches
If a breach is likely to put your rights and freedoms at risk, we will notify the ODPC within 72 hours of becoming aware of it, and notify affected users without unreasonable delay, as required by the Data Protection Act, 2019.
13. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed about how your data is used;
- access the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- ask us to delete data we no longer need or have no lawful basis to keep;
- object to, or ask us to restrict, certain processing;
- receive your data in a structured, commonly used format (data portability);
- withdraw consent you have given, for example for push notifications, at any time; and
- not be subject to a decision based solely on automated processing that significantly affects you.
To exercise a right, contact us using the details in section 17. We may ask you to confirm details linked to your account so that we do not disclose your data to someone else. We will respond promptly and within the time the law allows. We do not charge a fee for reasonable requests.
Some rights are limited where we must keep records by law; for example, we may retain order and payment records after you close your account.
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
14. Children
The Platform is intended for adults aged 18 and over. A parent or guardian may place orders for their household. We do not knowingly collect personal data directly from children; if you believe a child has registered, contact us and we will remove the account.
15. Links to other sites
The Platform may link to other websites. We are not responsible for their privacy practices; please read their policies.
16. Changes to this policy
We may update this policy from time to time. We will change the date at the top and, for significant changes, tell you through the Platform or by notification. Continued use after a change means you have seen the updated policy; where the law requires fresh consent, we will ask for it.
17. Contact us
Richmart Supermarket Limited
Eagle Plains Estate Commercial Centre, Nairobi, Kenya
Phone: 0740195694