Privacy Policy
Effective date: 1 January 2026
1. Introduction
PhiBakes Bakery Ltd ("PhiBakes", "we", "us", "our") operates the phibakes.co.ke website and related ordering platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, place an order, or otherwise interact with us. We process personal data in accordance with the Data Protection Act, 2019 of Kenya and the regulations issued by the Office of the Data Protection Commissioner (ODPC).
2. Information We Collect
We collect information you provide directly, such as your name, email address, phone number, delivery address, and order details when you create an account, place an order, or contact our support team. We also collect payment-related information necessary to process M-PESA and card transactions (such as your M-PESA phone number and transaction reference), though we never store your M-PESA PIN or full card numbers — these are handled by our licensed payment processors. Additionally, we automatically collect certain technical information, including your IP address, browser type, device information, and browsing behaviour on our site, via cookies and similar technologies.
3. How We Use Your Information
We use your information to: process and fulfil your cake orders; communicate with you about order status, delivery, and support requests; process payments and prevent fraud; personalise your experience and recommend products; send you marketing communications where you have opted in (which you may unsubscribe from at any time); and comply with our legal and regulatory obligations, including tax and consumer protection laws.
4. Legal Basis for Processing
We process your personal data on the basis of: your consent (for marketing communications); the necessity to perform a contract with you (processing and delivering your order); our legitimate business interests (fraud prevention, service improvement); and compliance with legal obligations under Kenyan law.
5. Sharing Your Information
We do not sell your personal data. We share information only with trusted third parties necessary to operate our service: licensed payment processors and M-PESA/Safaricom for transaction processing; delivery riders and logistics partners to fulfil your order; cloud hosting and IT service providers who process data on our behalf under confidentiality agreements; and regulatory or law enforcement authorities where required by law.
6. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, including to satisfy legal, accounting, or reporting requirements. Order records are typically retained for 7 years in line with Kenyan tax record-keeping obligations. You may request deletion of your account data at any time, subject to our legal retention obligations.
7. Your Rights
Under the Data Protection Act, 2019, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data, subject to legal exceptions; object to or restrict certain processing, including direct marketing; request data portability; and lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been violated. To exercise any of these rights, contact us at privacy@phibakes.co.ke.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including encrypted data transmission (SSL/TLS), restricted internal access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
9. Cookies
We use cookies and similar technologies to keep you signed in, remember your preferences, understand site usage, and improve our services. You can control cookies through your browser settings, though disabling them may affect site functionality.
10. Children's Privacy
Our services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy on this page with a revised effective date, and where changes are material, we will notify you directly.
12. Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please contact us at privacy@phibakes.co.ke, call +254 700 123 456, or write to us at Argwings Kodhek Road, Kilimani, Nairobi, Kenya.