Privacy Policy

DRAFT – review before publishing. This draft is a starting point and is not legal advice; have it reviewed by a qualified advocate in Kenya.

Last updated: [date]

1. Who we are

LYJA CORE Studio ("we", "us") sells clothing to customers in Kenya. For the purposes of the Data Protection Act, 2019 (the "Act"), we are the data controller for the personal data described here. Contact: hello@lyjacore.co.ke. [Add registered business name, address and ODPC registration number, if applicable.]

2. What this website does — and doesn't — collect

This website is a catalogue. It has no accounts, no checkout, no payment forms and no newsletter sign-up, and it does not use advertising or analytics cookies. It stores two small items only in your own browser: whether you closed the announcement bar, and a list of products you recently viewed. These never leave your device and you can clear them at any time in your browser settings.

3. Data you share with us on WhatsApp

When you tap an "Order on WhatsApp" button, you start a conversation with us on WhatsApp. In that conversation we may receive:

your name and phone number;
your order details (items, sizes, quantities);
your delivery address and any delivery instructions;
M-Pesa payment confirmation details (transaction code, amount, name and number as shown by M-Pesa).

WhatsApp is operated by WhatsApp LLC / Meta, and your use of it is also covered by WhatsApp's own privacy policy. M-Pesa payments are processed by Safaricom PLC under its own terms.

4. Why we use your data (lawful basis)

To fulfil your order — confirming, packing, delivering and supporting returns (performance of a contract, section 30 of the Act).
To keep records for tax and accounting (legal obligation).
To tell you about restocks you asked about (your consent, which you can withdraw at any time by telling us).

We will not send you marketing messages unless you have asked us to, and we never sell your personal data.

5. Who we share it with

Only with those who help us complete your order — for example our delivery or courier partner (name, phone number and address) — and with authorities where the law requires it. [List actual courier partners.]

6. How long we keep it

Order and payment records are kept for as long as required by Kenyan tax law [confirm period, e.g. 5 years]. Chat history not needed for these purposes is deleted after [e.g. 12 months].

7. Your rights

Under the Act you have the right to be informed, to access your data, to object to processing, to correct or delete inaccurate or unnecessary data, and to data portability. To use any of these rights, message us on WhatsApp or email hello@lyjacore.co.ke. If you are unhappy with how we handle your data, you may complain to the Office of the Data Protection Commissioner (ODPC).

8. Security

We limit access to order information to the people who need it, use a business WhatsApp account protected with two-step verification, and do not store payment card details. [Describe any other measures.]

9. Changes

We may update this policy. The latest version will always be on this page with the date it was last updated.