Privacy Policy

The data controller is Kiki's Medical Equipment and Hospital Supplies Limited (reg. PVT-Y2ULB55R), London Beauty Building, 4th Floor, Suite A6, Taveta Road, Nairobi CBD, Kenya · info@kikismedsupplies.com · +254 704 329 920. [ODPC data-controller registration number: — register with the Office of the Data Protection Commissioner before launch.]

We collect only what we need to serve you:

• Order details — your name, phone number, email, optional KRA PIN (for a tax invoice), your chosen delivery or pickup method and its details (delivery address and directions, or courier destination and collection point, or the name and phone of a nominated collector), and the items you buy.
• Payment references — M-Pesa receipt numbers and Pesapal transaction references. We never see or store your card number, CVV or M-Pesa PIN; those are handled by Safaricom and Pesapal on their own systems.
• Enquiries — whatever you send us via the contact form, email, phone or WhatsApp.
• Newsletter — your email address, if you subscribe.
• Technical basics — our hosting infrastructure records IP addresses and request logs for security and reliability.

• To process and deliver your order and provide receipts — performance of a contract.
• To respond to enquiries and quotes — legitimate interest / steps prior to a contract.
• To keep tax and accounting records — legal obligation.
• To send the newsletter — consent, withdrawable any time via the unsubscribe link or by emailing us.
• To send offers, product news and supply tips where you ticked the marketing box at checkout — consent, withdrawable any time. We retain the contact details you gave for this until you unsubscribe.
• To protect the site against fraud and abuse — legitimate interest.

We never sell your personal information. We share it only with:

• Payment providers — Safaricom (M-Pesa) and Pesapal, to process your payment.
• Delivery partners — the courier handling your order receives your name, phone and delivery address.
• Service providers — our website hosting and email providers, under appropriate safeguards.
• Authorities — where the law requires it.

Order and payment records are kept for [7] years to meet Kenyan tax and accounting requirements, then deleted. Enquiries are kept for up to [12] months. Newsletter details are kept until you unsubscribe. You can ask us to delete data sooner wherever we have no legal duty to retain it.

Under the Kenya Data Protection Act (and, where applicable, the GDPR) you have the right to be informed; to access a copy of your data; to have inaccurate data corrected; to have your data deleted where we no longer need it; to restrict or object to certain processing; to data portability; and to withdraw consent at any time.

To exercise any of these, email info@kikismedsupplies.com. If you are not satisfied with our response you may complain to the Office of the Data Protection Commissioner (Kenya) — or your local supervisory authority if you are outside Kenya.

This website and our products are intended for adults and professional buyers. We do not knowingly collect personal data from children under 18. If you believe a child has given us their data, contact us and we will delete it.

The site is served over HTTPS, payments are handled by PCI-DSS compliant providers, and access to order data is restricted to authorised staff. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information and will notify you and the regulator of any breach as the law requires.

Our services are operated from Kenya and your data is processed in Kenya [and in the country of our hosting provider — confirm at deployment]. If you order from abroad, you consent to your data being transferred to and processed in these locations with the safeguards described here.

See our Cookie Policy for what we store on your device. We'll post any changes to this policy on this page and update the date above.