Privacy Policy

Last updated: [01 01 2025]

Almiria Limited (“Almiria Techstore”, “we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal data when you visit or make a purchase at https://www.almiriatechstore.co.ke (the “Site”). By accessing or using our Site, you agree to the practices described herein. If you do not agree, please leave the Site immediately.

  1. Who We Are

    Almiria Limited supplies, resells, and installs IT networking, security equipment, power backup solutions, and electronics throughout Kenya. This Privacy Policy governs all data collection and processing on our Site and any related mobile applications or subdomains.

  2. What Personal Data We Collect and Why

    We collect different categories of data depending on how you interact with our Site. Each category lists the data elements, purpose, and legal basis under the Kenyan Data Protection Act, 2019.

    Personal & Transactional Data

    Collected when: you register an account; place/return/exchange or request products/services; contact customer service.

    • Data Elements: full name; email; billing & shipping addresses; phone; payment details (card, M-Pesa transaction ID) processed by our payment providers; purchase/returns/exchanges history.
    • Purpose: account maintenance; order processing, invoicing & tax compliance; customer support & warranty; fraud prevention.
    • Legal Basis: performance of a contract; compliance with a legal obligation; legitimate interest (fraud prevention, customer service).

    Technical Data

    Collected when: you browse or interact with Site features.

    • Data Elements: IP address; browser & version; device & OS; referrer; entry/exit pages; clickstream; timestamps.
    • Purpose: security & fraud detection; troubleshooting; performance analysis & UX improvements.
    • Legal Basis: legitimate interest (security, analytics, performance).

    Cookies & Tracking Technologies

    • Purpose: remember cart; authenticate sessions; measure traffic (Google Analytics); enable remarketing.
    • Legal Basis: consent (non-essential analytics/marketing); legitimate interest (strictly necessary cookies for login/checkout).

    Plugin- and Theme-Generated Data

    Comments & Reviews: comment content, name, email (if provided), IP, user agent for spam prevention. Legal Basis: consent (submission) & legitimate interest (spam prevention).

    Media Uploads: filename & EXIF metadata (if any). Legal Basis: consent (upload) & legitimate interest (hosting UGC).

    Contact Forms (Caldera Forms): name, email, subject, message, IP. Purpose: inquiries/quotes/support. Retention: 6 months (unless required longer). Legal Basis: legitimate interest & consent (submission).

    Analytics Data

    We use Google Analytics (via Google Tag Manager) to collect anonymised usage data (page views, session duration, bounce rates, device categories, user flow).

    • Purpose: understand engagement; optimise layout/navigation; measure campaign effectiveness.
    • Opt-Out: Google Analytics Opt-Out Browser Add-On
    • Retention: 14 months (Google default).
    • Legal Basis: legitimate interest (analytics & performance).

  3. Comments

    When visitors leave reviews/comments, we collect the name, email, and comment content. We also record IP and user agent to help detect spam. After approval, a commenter’s Gravatar (if set) may be displayed (Gravatar Privacy).

    Retention: comments & metadata are retained indefinitely to facilitate follow-up approvals and review history. Legal Basis: consent (submission) & legitimate interest (spam prevention).

  4. Media

    If you upload images/media (e.g., in reviews), avoid embedded location (EXIF) data; it may be visible to anyone who downloads the file.

    Retention: retained with the comment/review unless you request deletion. Visibility: public by default. Legal Basis: consent & legitimate interest.

  5. Contact Forms

    We use Caldera Forms. Submissions include name, email, subject, message, and IP.

    • Purpose: reply to questions, quotes, support.
    • Retention: 6 months (unless needed for dispute resolution).
    • No Marketing by Default: we won’t use form data for marketing unless you opt in.
    • Legal Basis: legitimate interest & consent (submission).

  6. Cookies

    We use cookies to keep the Site working properly and to enhance your experience.

    WordPress Default Cookies

    • comment_author_{HASH}, comment_author_email_{HASH}, comment_author_url_{HASH} — remember your comment details (1 year).
    • wordpress_[hash], wordpress_logged_in_[hash] — login/session (2 days; 2 weeks if “Remember Me”).
    • wp-settings-{userID}, wp-settings-time-{userID} — admin UI prefs (1 year).

    WooCommerce Cookies

    • woocommerce_cart_hash, woocommerce_items_in_cart — cart change indicators (session).
    • wp_woocommerce_session_{hash} — unique code to identify your cart (2 days).

    Analytics & Third-Party Cookies

    • _ga, _gid, _gat — Google Analytics (14 months / 24 hours).
    • Facebook Pixel cookies (if used): retention per Facebook policy.
    • Cookies set by embedded content (YouTube, Vimeo, social widgets).

    Cookie Management

    • Strictly Necessary: essential for login/checkout; disabling may break functionality.
    • Performance & Analytics: you can opt out via the GA Opt-Out Add-On.
    • Marketing: manage via browser settings or provider opt-outs (e.g., youronlinechoices.com).

    Browser controls: Chrome (Settings → Privacy & security → Cookies), Firefox (Preferences → Privacy & Security), Safari (Preferences → Privacy), Edge (Settings → Cookies and site data).

  7. Embedded Content From Other Websites

    Embedded content (e.g., YouTube videos, social posts) behaves as if you visited that site. Third parties may collect your data via their cookies and trackers. Review their privacy policies (e.g., Google/YouTube, Facebook).

  8. Analytics (Google Analytics)

    We use Google Analytics via Google Tag Manager to collect aggregated, anonymised usage data (page views, session duration, device type, referral source, user flow).

    • Retention: 14 months.
    • Purpose: UX improvements, performance, and marketing measurement.
    • Legal Basis: legitimate interest.
    • Opt-Out: GA Opt-Out Browser Add-On

  9. Who We Share Your Data With

    We do not rent or sell your personal information. We share data only in these cases:

    Payment Processors

    Hosting & Infrastructure

    SiteGround hosts our Site/databases (primarily U.S.). SiteGround Privacy

    Shipping & Delivery Partners

    We share name, address, phone, and order contents with logistics partners (e.g., G4S, DHL, Posta Kenya) to fulfil deliveries.

    Analytics & Marketing Partners

    Google Analytics (via GTM); Facebook Pixel (if enabled); Mailchimp (if you opt in). Mailchimp Privacy

    Other Third-Party Plugins & Integrations

    • Caldera Forms — stores submissions temporarily.
    • Smush (WPMU DEV) — image optimisation may process EXIF; Smush Privacy, Drip Privacy

    Legal Requirements

    We may disclose information if required by law, regulation, or legal process.

    Business Transfers

    In a merger, acquisition, bankruptcy, or asset sale, data may transfer to the acquirer. We’ll notify you and outline your choices.

  10. How Long We Retain Your Data

    • Order & Transaction Records: 10 years (tax/accounting).
    • Customer Accounts: until you delete or request erasure, subject to legal obligations.
    • Contact Forms: 6 months (unless needed for a legal claim).
    • Comments & Reviews: indefinite (unless you request deletion).
    • Analytics: 14 months.
    • Cookies: session cookies expire on browser close; persistent per “Cookies”.

  11. Your Rights Over Your Data

    Under the Kenyan Data Protection Act, 2019, you may exercise the following rights:

    • Access (get a copy of your data)
    • Rectification (correct inaccuracies)
    • Erasure (“right to be forgotten” where applicable)
    • Restriction of processing
    • Data Portability
    • Object to processing based on legitimate interests
    • Withdraw Consent (for marketing, etc.)

    How to exercise: email privacy@almiria.co.ke or write to: Data Protection Officer, Almiria Limited, Old Mutual Building, 2nd Floor, Room 221, Kimathi Street, Nairobi, Kenya. We’ll respond within 30 days and may request proof of identity.

  12. Where Your Data Is Sent (International Transfers)

    Some third-party services operate servers outside Kenya:

    • SiteGround (Hosting): primarily U.S. (uses Standard Contractual Clauses; see their policy).
    • Payment Processors: PayPal/Stripe may process globally (SCCs/PCI DSS). M-Pesa processes in Kenya.
    • Analytics & Marketing: Google Analytics, Facebook Pixel, Mailchimp, Smush may process internationally under contractual safeguards.

    By using our Site, you consent to these transfers under the described safeguards.

  13. How We Protect Your Data

    • Encryption: TLS (in transit); encrypted backups/files (at rest).
    • Access Controls: role-based access; strong passwords; 2FA for admin.
    • Updates & Audits: prompt security patches; vulnerability scans; firewalls/IDS.
    • Staff Training: privacy & data protection training; confidentiality agreements.
    • Customer Best Practices: use strong, unique passwords; keep devices/antivirus up to date; never share passwords.

    Despite robust measures, no system is 100% secure. See the next section for breach response.

  14. Data Breach Procedures

    • Containment: immediate internal reporting; isolate systems; revoke credentials.
    • Investigation: determine scope, cause, severity; assess risk to individuals.
    • Notification: if required, notify Kenya’s Office of the Data Protection Commissioner within 72 hours; inform affected individuals without undue delay.
    • Remediation: patch vulnerabilities; update controls; document all breaches.

  15. Children’s Privacy

    Our Site is intended for users aged eighteen (18)+. We do not knowingly collect data from children under 18. If we learn we have done so without verifiable parental consent, we will delete it. Contact privacy@almiria.co.ke if you believe this has occurred.

  16. Industry Regulatory Disclosures

    We comply with the Kenyan Data Protection Act, 2019, and follow PCI DSS standards via our payment processors. We will update this policy if additional regulations apply.

  17. Changes to This Policy

    We may update this Policy to reflect changes in practices, services, or legal requirements. When material changes occur, we’ll post a notice on our homepage and update the “Last updated” date above. Please review periodically.

  18. Third-Party Links & Embedded Content

    Our Site may contain links to external websites (e.g., manufacturers, social media, payment portals). Clicking such links takes you to another site; we’re not responsible for their practices. Review each third party’s privacy policy.

  19. WooCommerce-Specific Information

    Data Collected During Shopping

    • Products Viewed: to show recently viewed and related items.
    • Location & IP: estimate shipping costs and taxes.
    • Addresses: shipping/billing required at checkout.
    • Cart Contents: tracked via cookies so your cart persists.

    Checkout Process

    We collect name, addresses, email, phone, payment details (processed by PayPal/Stripe/M-Pesa), and order details to confirm orders, ship items, process refunds/returns, prevent fraud, comply with tax/accounting, and send marketing only if you opt in.

    Who Has Access

    Authorised Shop Managers & Administrators can view order details necessary to operate the store. All staff with access must maintain confidentiality.

    Payment Gateways

    We accept M-Pesa, Direct Bank Transfer, Cash on Delivery (Nairobi), PayPal, and Visa/Mastercard (Stripe). We share necessary billing/order data with the chosen gateway. See PayPal and Stripe policies.

    Order Retention

    Order records are kept for 10 years to comply with Kenyan tax laws. You may request deletion of data not legally required, subject to retention obligations.

    Marketing Opt-In/Opt-Out

    You’ll receive promotional emails only if you opt in at checkout or in your account settings. To unsubscribe, use the link in any marketing email or contact privacy@almiria.co.ke. Operational emails (order confirmations, shipping notices) will continue.

  20. Your Contact Information & How to Reach Us

    Data Protection Officer
    Almiria Limited
    Old Mutual Building, 2nd Floor, Room 221
    Kimathi Street, Nairobi, Kenya
    Email: privacy@almiria.co.ke
    Phone: +254 700 449 778

    For marketing opt-out by phone, you may also call +254 700 449 778. This opt-out does not apply to operational communications (e.g., order confirmations).

Thank you for trusting Almiria Techstore with your personal data. We are committed to protecting your privacy and ensuring a safe, seamless shopping experience.