Who controls your personal data

Crestpal Enterprises Limited of 9 River Road, Nairobi is the data controller for the personal data processed through the public storefront and related customer services, except where another party clearly acts as controller for its own service.

For general privacy questions or requests, Crestpal currently provides customer-facing contact channels through cs@crestpal.com and the support information shown on the site.

Personal data we collect

We collect personal data that you provide directly, data generated through your use of the site, and limited data received from service providers or technical systems involved in authentication, delivery, payments, or analytics. The data collected depends on how you interact with Crestpal.

Depending on your activity, we may collect the following categories of personal data:

• Identity and contact data such as your name, email address, telephone number, company name, and account profile details.
• Order and fulfillment data such as cart contents, product selections, saved addresses, shipping or pickup information, country, city, order references, and fulfillment status.
• Payment and transaction data such as payment method, charge currency, payment status, gateway reference, discount or referral attribution, and limited authorization or settlement metadata from our payment provider. Crestpal does not intentionally store full payment card numbers in the storefront code described here.
• Communications data such as support requests, email preference settings, marketing opt-ins, quote conversations, and order-related messages.
• Technical and usage data such as IP-derived location signals, hashed IP information, browser and device information, pages viewed, session identifiers, referrer information, and interaction events if analytics is enabled.
• Cookie and similar technology data such as consent choices, visitor or session identifiers, local storage values, and other data described in our Cookie Policy.

How we collect personal data

We collect personal data directly from you when you create an account, browse the storefront, save preferences, request quotes, join affiliate features, place an order, choose a shipping method, contact support, or otherwise interact with Crestpal. We also collect technical data automatically from your browser or device when you use the site, subject to your cookie and analytics choices where applicable.

We may also receive limited personal data from third parties that help us deliver the service, including authentication providers, payment processors, delivery or logistics partners, analytics infrastructure, email delivery providers, hosting or security providers, and referral or affiliate validation systems.

Why we use personal data and our legal bases

Crestpal processes personal data only where we have a lawful basis to do so, including where processing is necessary to perform a contract with you, to take steps at your request before entering a contract, to comply with legal obligations, for legitimate business interests that are not overridden by your rights, or with your consent where consent is the appropriate basis.

We use personal data for the following purposes:

• To create and manage customer accounts, authenticate users, secure sessions, and prevent unauthorized access or abuse.
• To process carts, quotes, orders, payments, stock checks, delivery options, store pickup, support requests, and post-order communications.
• To detect fraud, manage disputes, enforce our terms, investigate misuse, maintain site integrity, and comply with legal, accounting, tax, and regulatory obligations.
• To send service communications such as verification messages, order confirmations, payment updates, shipping updates, and account notices.
• To send marketing or promotional communications where permitted by law and subject to your preferences, and to understand how users interact with the storefront when analytics is enabled.

When we share personal data

We do not sell personal data for money. We may disclose personal data to service providers and business partners who help us operate Crestpal, including payment processors, delivery partners, technology vendors, authentication services, cloud hosting providers, security tools, analytics providers, customer communication providers, and professional advisers.

We may also disclose personal data where reasonably necessary to comply with law, respond to lawful requests, protect rights or safety, enforce agreements, investigate fraud or misuse, complete a business reorganization or transaction, or otherwise where disclosure is permitted or required by applicable law.

Cross-border transfers

Because Crestpal uses online infrastructure and third-party providers, your personal data may be processed in Kenya and in other jurisdictions where our service providers, infrastructure providers, or counterparties operate. This can include transfers outside Kenya.

Where personal data is transferred across borders, Crestpal intends to rely on lawful transfer mechanisms and appropriate safeguards required under applicable law, including contractual safeguards, necessity for performance of the service, or other legally recognized transfer grounds.

How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including to operate accounts, fulfill orders, support returns or disputes where legally required, maintain records, prevent fraud, and meet legal, tax, accounting, and regulatory obligations.

Retention periods may differ by data type. For example, account records, order records, encrypted address data, payment-status records, email preference settings, analytics records, and security logs may be retained for different periods depending on business need, legal obligations, and dispute risk.

Security and storage

Crestpal uses administrative, technical, and organizational safeguards that are designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. These measures may include access controls, encryption or hashing for certain stored data, rate limiting, session protections, and vendor or infrastructure security controls.

No internet transmission, storage environment, or security system is completely secure. Crestpal therefore cannot guarantee absolute security, and you provide personal data at your own risk to the extent permitted by law. You are also responsible for keeping your account credentials and devices secure.

Marketing communications and preferences

If you create an account or interact with Crestpal, we may send service-related communications that are necessary to operate your account or order. We may also send marketing communications where permitted by law and subject to your settings. Account holders can manage available email preferences through the account settings tools provided on the site.

You can opt out of marketing messages using the unsubscribe method in the communication or by contacting Crestpal. Even if you opt out of marketing, we may still send non-marketing service messages relating to your account, verification, security, orders, payments, delivery, or legal obligations.

Your privacy rights

Subject to applicable law, including Kenya's data protection framework and any other mandatory laws that apply to you, you may have rights relating to your personal data. Crestpal will review and respond to valid requests in accordance with applicable law and may need to verify your identity before acting on a request.

Depending on your jurisdiction and the circumstances, your rights may include the right to:

• Be informed about how your personal data is used.
• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Object to or restrict certain processing, including certain marketing or consent-based processing.
• Request deletion where the law provides that right and where retention is no longer necessary or legally required.

Children's data

Crestpal is not intended to knowingly solicit personal data directly from children in violation of applicable law. If you believe a child has provided personal data without appropriate authority or consent, contact Crestpal so we can review and take appropriate action.

Where school, uniform, or guardian-related orders involve information relating to minors, Crestpal expects the relevant parent, guardian, school, or authorized adult to provide that information lawfully and only as necessary for the order or service.

Third-party sites and services

The Crestpal site may link to or rely on third-party services such as payment platforms, WhatsApp, courier partners, maps, or social platforms. This Privacy Policy does not govern the privacy practices of those independent third parties.

When you leave Crestpal or interact directly with a third-party service, that party's own privacy notice, cookie practice, and terms will apply. We encourage you to review them before submitting data.

Policy changes

Crestpal may update this Privacy Policy from time to time to reflect changes in the law, our operations, our vendors, or our technical practices. The updated version will be posted on the site with a revised effective or last-updated date.

Where required by law, we will provide additional notice or obtain fresh consent before materially different processing begins.

How to contact us about privacy

For privacy questions, complaints, or requests to exercise applicable data rights, contact Crestpal using the support and contact details on the site, including cs@crestpal.com. Before launch, legal counsel should confirm whether a dedicated privacy contact, regulator notice, or jurisdiction-specific contact statement must also be added here.

If you are dissatisfied with how Crestpal handles your personal data, you may also have the right to complain to the relevant data protection regulator or supervisory authority, including in Kenya where applicable.