Privacy Policy

• Contact details: name, phone number, email address, organisation and delivery address.
• Order and quotation details: products, quantities, prices, LPO numbers, invoices and delivery records.
• Payment details: M-Pesa transaction references and amounts. We do not store card numbers or M-Pesa PINs.
• Account details: login email and an encrypted password, if you create an account.
• Agent details: ID or business registration, KRA PIN and payout details, if you apply to be a sales agent.
• Messages you send us through the website, email or WhatsApp, including attachments.
• Technical data: IP address, browser type and pages visited, collected through cookies and analytics tools.

• To prepare quotations, process orders, arrange delivery and issue invoices and receipts.
• To reply to enquiries and send updates about your quotation, order, delivery or payment, including by WhatsApp.
• To run the agent programme and pay agent commission.
• To meet tax and accounting obligations, including KRA eTIMS invoicing.
• To improve the website and, where you have agreed, to tell you about offers.

When you message us on WhatsApp, or ask us to contact you there, your phone number, name and messages are processed through the WhatsApp Business Platform provided by Meta Platforms. We use them only to answer you and to send updates about your quotations, orders, deliveries and payments. You can ask us to stop at any time by replying STOP or by contacting us.

We do not sell personal data. We share it only with service providers who help us run the business:

• Our business management system (Odoo), where sales, stock and accounting records are kept.
• Meta Platforms, for WhatsApp messaging.
• Safaricom and our payment partners, to process M-Pesa payments.
• Courier and logistics partners, to deliver orders.
• Our hosting provider and, where enabled, Google Analytics and the Meta Pixel.
• Government bodies such as KRA, where the law requires it.

We keep order, invoice and payment records for as long as Kenyan tax law requires, currently at least five years. Other data, such as enquiries and chat history, is kept only as long as needed to serve you and is then deleted.

You may ask to see the personal data we hold about you, correct it, object to its use for marketing, or have it deleted. To make a request, email sales@afyadirect.com. See our data deletion page for the steps. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner.

The website uses HTTPS, passwords are stored encrypted, and access to customer records is limited to staff who need it. No system is completely secure, so please tell us at once if you suspect misuse of your account.

We may update this policy from time to time. The date at the top of this page shows when it was last changed.