Executive Summary: Cellar254 Express Kenya Ltd respects your privacy. We collect solely the information necessary to dispatch your chilled beverages safely and verify statutory 18+ drinking age in Nairobi. We never store M-Pesa PINs or credit card credentials, and we never sell customer details to third parties.
1. Legal Scope & Identity of Data Controller
This Privacy Policy governs the collection, processing, and protection of personal data by Cellar254 Express Kenya Ltd, a registered company operating under the laws of Kenya with headquarters along Ring Road Kilimani, Nairobi. We act as Data Controller in full compliance with the Kenya Data Protection Act, 2019 overseen by the Office of the Data Protection Commissioner (ODPC).
2. Categories of Information We Collect
- Delivery Fulfillment Data: Full customer name, contact phone number, Nairobi delivery estate, and exact delivery residence/office address provided at checkout.
- Transaction Records: Order reference ID, date and timestamp of dispatch, itemized list of beverages purchased, delivery fee, and payment method selected.
- Statutory Verification Data: Date-of-birth confirmation confirming you are 18 years of age or older as mandated by the Alcoholic Drinks Control Act.
- Technical Interaction Data: IP address, device type, and shopping basket cookie state strictly utilized to maintain your active cart drawer and verify session integrity.
3. How We Protect Your Payment & M-Pesa Data
Cellar254 operates under a strict Pay on Delivery • Zero Risk framework. When you select Lipa Na M-Pesa, card tap, or cash:
- All M-Pesa payments occur directly on your personal handset via the official Safaricom Daraja M-Pesa Buy Goods Till. No payment credentials or secret PINs ever pass through or reside on our web servers.
- Wireless card POS transactions are processed through certified, PCI-DSS compliant bank card readers carried by our vetted couriers.
4. Courier Confidentiality & Data Minimization
Our motorcycle couriers receive only the physical delivery destination and contact number required to notify you upon arrival at your compound gate. Couriers operate under strict corporate non-disclosure agreements and are prohibited from retaining customer contact records post-delivery.
5. Your Rights Under the Kenya Data Protection Act, 2019
Under Sections 26 through 40 of the Act, you possess the right to:
- Request access to all transaction records associated with your phone number.
- Request correction or rectification of outdated contact or delivery address records.
- Request permanent deletion (‘Right to be Forgotten’) of your marketing communication preferences.
6. Data Protection Officer (DPO) Contact
For data inquiries, access requests, or privacy concerns, contact our designated Data Protection Officer:
Email: orders@cellar254.co.ke
Hotline: +254 799 000 595
Physical Address: Legal Department, Cellar254 Express Kenya Ltd, Ring Road Kilimani, Nairobi, Kenya.