Privacy Policy

SHERRY'S MERCHANTS is the data controller for the personal data described in this policy: we decide why and how your data is processed. You are the data subject.

We do not charge for privacy requests. You do not need an account to make one, and you never have to buy anything to exercise your rights.

We collect only what we need to run the store and meet the law.

We do not intentionally collect sensitive personal data (such as health, biometric, religious or financial account details). If we ever receive sensitive data by mistake, we delete it unless the law requires us to keep it.

Under section 30 of the Data Protection Act, every use of your data must rest on a lawful basis, and further processing must match the purpose we told you about. We rely on the bases below and can demonstrate them on request (regulation 5).

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing that happened before (s.32). Consent must be freely given: we never make marketing or analytics consent a condition of buying from us, and the marketing box at checkout starts unticked.

We only market to people who gave express consent (s.37 of the Act), for example by ticking the marketing box at checkout. You can also switch marketing on or off from your account or by messaging us.

• Every marketing email or SMS we send carries a clear, free and simple way to opt out — a prominent unsubscribe link or a one-word reply — as required by regulations 16 and 17.
• Opting out takes minimal time and effort and is free of charge. We honour it without asking you to give a reason, and we stop using your data for marketing once you do (regulation 16(2)).
• A request to stop marketing from third parties is handled within 7 days (regulation 18).
• We never disguise who a message is from, and we never use automated calling systems without a human involved.
• We do not sell, rent or trade your personal data to anyone. Purchase audiences we build for advertising are uploaded to the ad platform as hashed identifiers for matching only, under Meta's Custom Audience Terms.

Like most online stores, we use cookies and similar technologies. Information about your web browsing counts as personal data under regulation 6(1)(d) of the General Regulations, so we disclose it here.

You can also delete cookies or block them in your browser settings, though parts of the store may then work less smoothly. Where we rely on consent for analytics or advertising cookies, you may withdraw it at any time by contacting privacy@sherrysmerchants.com, and we will stop that processing going forward.

We share data only with the parties below, only for the purposes in this policy, and only under written terms that require them to protect it. We do not sell your personal data.

Processors are bound to act only on our instructions, to keep data confidential, to notify us without delay (and where reasonably practicable within 48 hours) if they suffer a breach, and to delete or return data when the contract ends. We may share data with law enforcement or courts where the law requires it, and we will tell you unless the law forbids it.

Some of the providers listed above store or process data outside Kenya, including in the United States. Sections 48 and 49 of the Act and regulations 40–42 of the General Regulations allow this only where appropriate safeguards are in place, the transfer is necessary for a contract with you, or you have consented.

• We rely on written contracts with each provider that impose protection substantially equivalent to the Act, together with a documented transfer assessment we keep and can produce to the Data Commissioner on request (regulation 41).
• We also rely on the necessity of these transfers for performing our contract with you (for example, hosting your order confirmation email).
• We do not claim that any such country has been assessed as adequate by the Data Commissioner unless it has.
• You may ask us for details of the safeguards we rely on by emailing privacy@sherrysmerchants.com.

We keep personal data only as long as it is reasonably necessary for the purpose it was collected for, or as long as the law requires (section 39 of the Act). When the period ends, we delete, anonymise or pseudonymise it. This schedule is our retention schedule under regulation 19.

Section 25 of the Act requires appropriate technical and organisational measures. We use, as appropriate to the risk:

• Encryption of data in transit (HTTPS) across the whole site.
• Row-level security in our database, so each account sees only its own records, and admin endpoints protected by role checks and server-side keys.
• Strong authentication for our own administrative access, with least-privilege access.
• Payment details limited to a transaction code — we never hold M-PESA PINs or card data.
• Backups, monitoring and logging of administrative actions.
• Staff and contractors are bound to confidentiality, and we assess the privacy risk of new processing (such as analytics or advertising tools) before introducing it.

Section 26 of the Act gives you the right to be informed, to access your data, to object to processing, and to have false or misleading data corrected or deleted. Other sections add restriction, portability and protection from automated decisions. Contact privacy@sherrysmerchants.com or message 0740 209 121 with "Data protection request" in the subject or message.

We may ask for proof of identity before releasing data, to protect you from someone else impersonating you. If we cannot meet a request — for example because the law requires us to keep certain records — we tell you in writing with reasons and inform you of your right to complain to the Data Commissioner.

A child is anyone under 18 in Kenya. Section 33 of the Act requires a parent or guardian's consent and age-verification mechanisms before a child's data is processed. Our store is intended for adults buying for themselves or their households; checkout and account creation are for people aged 18 and over.

• We do not knowingly create accounts for children.
• We do not profile children for direct marketing — that is prohibited by regulation 13(2)(b) of the General Regulations.
• If you believe a child has given us personal data, contact privacy@sherrysmerchants.com and we will delete it, unless the law requires us to keep it.

If a personal data breach creates a real risk of harm, section 43 of the Act requires us to notify the Office of the Data Protection Commissioner without delay and within 72 hours of becoming aware of it — and, if we are late, to explain why. We must also tell affected customers in writing within a reasonably practical period, unless we cannot identify them or encryption and other safeguards make the risk negligible.

Any notification we send will describe what happened, what data was involved, what we have done about it, what you can do to protect yourself, who is likely responsible, and how to reach our contact point. Our service providers must tell us about a breach without delay, and where reasonably practicable within 48 hours, so we can meet the 72-hour clock.

Please contact us first at privacy@sherrysmerchants.com so we can try to put things right — we aim to acknowledge you within 7 days. You may also complain directly to the regulator at any time; you do not have to come to us first, and you may complain in writing, electronically or orally, and free of charge (regulation 4 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021).

ODPC complaints are free. The ODPC acknowledges a complaint within 7 days; if it is admitted, we have 21 days to respond. The ODPC's determination is binding and enforceable as a court order.

Section 18 of the Data Protection Act requires data controllers and processors to register with the Data Commissioner, subject to the threshold in regulation 13 of the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (an entity with annual turnover below KES 5,000,000 and fewer than 10 employees is exempt from registration, but must still comply with the Act).

You can ask us for our current registration status, or the number of our Certificate of Registration if we are registered, at privacy@sherrysmerchants.com. The register of registered controllers is a public document and can be checked with the ODPC.

We update this policy when our practices, our tools or the law change. The date at the top shows when it was last updated. If a change significantly affects how we use your data, we will draw your attention to it on the site or by email before it takes effect, so you can exercise your rights.

Questions about this policy or your data: privacy@sherrysmerchants.com or WhatsApp 0740 209 121. Order, delivery and returns questions are handled on the Support page.