Legal
Privacy Notice
What personal information we collect, why, who sees it, and the choices you have. This notice follows Kenya’s Data Protection Act, 2019.
1Who we are
Buttercup Collections is an online fashion store serving customers in Kenya. We are the “data controller” for the personal data described here, which means we decide how and why it is used.
Questions or requests about your data: cupb488@gmail.com or WhatsApp 0747 974 100.
2What we collect
Your name and email address. Your password is stored scrambled (hashed) by our sign-in provider, so we never see it. If you sign in with Google, Google shares your name and email with us.
Full name, phone number, email, city, delivery address, delivery method, the items you ordered, the total and the order status.
Your referral code, who referred you, your number of active referrals and your Vatul Coins balance and claims.
A device address (called a push subscription) that lets your browser or phone receive our notifications, plus your browser type. We also keep a copy of messages we send you in the app’s Notifications page.
The time you last used the app while signed in. We use it to avoid sending reminders at the wrong moment.
What you send us on WhatsApp or by email, including order messages.
Your cart, favourites, recent orders and privacy choice are saved on your own device. See the Cookies Notice.
Our hosting providers may log basic technical details (such as IP address and browser type) for security and reliability.
3Why we use it, and our legal basis
We need this to do what you asked.
For example to confirm delivery details by phone or WhatsApp.
To award rewards fairly and protect the programme.
Only after you press Turn on and allow notifications. You can withdraw at any time.
Only if you allow it in your cookie choices.
Protecting our customers and our systems.
Where the law requires us to keep or share certain records.
4Notifications & reminders
When you tap Turn on, your browser asks for permission. If you allow it, we store your push subscription so we can reach your device even when the app is closed.
We may then send occasional reminders and updates: for example every few days if you haven’t visited for a while, and daily if you’ve been away for 30 days or more. A visit to the app stops the daily reminders.
To stop them, press Turn off on the Notifications page in the app, or block notifications for this site in your browser or phone settings.
6Moving data outside Kenya
Our database is in the EU (Ireland), and some of our providers (such as Netlify, Google and Meta) process data in other countries. Where data leaves Kenya, we rely on our providers’ contractual and security safeguards, as the Data Protection Act requires.
7How long we keep it
- Orders in our database: deleted automatically shortly after an order is completed or cancelled (typically within a day), and orders that stay pending are cleared after 4 days.
- WhatsApp order messages: stay in our WhatsApp chat history until we delete them or you ask us to.
- Account and rewards data: until you ask us to delete your account.
- Push subscription: until you turn notifications off, your browser removes it, or delivery to it fails.
- On your device: you’re in control. The “My orders” copy clears itself after 90 days.
- Anything the law requires us to keep: for as long as the law requires.
8Your rights
Under the Data Protection Act, 2019 you can:
- ask what personal data we hold about you and get a copy;
- ask us to correct anything that’s wrong or out of date;
- ask us to delete your data;
- object to, or ask us to restrict, certain uses of your data;
- ask for your data in a portable format where it applies;
- withdraw your consent at any time, for example by turning off notifications or changing your cookie choices.
To make a request, use the privacy option on our Contact page or email cupb488@gmail.com. We may need to confirm it’s really you first. We’ll respond without undue delay and within the time the law allows.
If you’re unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke. We’d appreciate the chance to put things right first.
9How we protect it
We use HTTPS, store passwords in hashed form, restrict database access with role-based rules, and limit staff access to what they need. No system is perfectly secure, but we take care to protect your data.
10Children
The app isn’t meant for children under 18 to use on their own. If you think a child has given us personal data without a parent or guardian’s permission, please tell us and we’ll delete it.
12Changes to this notice
We may update this notice. The “Last updated” date will change, and we’ll tell you in the app about significant changes.