Privacy Policy
Last updated: 2 July 2026
1. Who we are
This store is operated by Dennis Muraguri ("we", "us", "our"), trading as Dennis Muraguri Art Prints, based at Kuona Artists Collective, Centre for the Visual Arts, Likoni Ln, Likoni Cl, off Denis Pritt Rd, Hurlingham, Nairobi, Kenya. We are the data controller for personal data collected through this website. You can contact us at sales@shop.dennis-muraguri.co.ke.
This policy applies to all visitors and customers of https://shop.dennis-muraguri.co.ke. It is governed by Kenya's Data Protection Act 2019 and any implementing regulations.
2. Data we collect
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account | Name, email, password (hashed) | Account management, order history | Contract |
| Order | Items ordered, price, currency | Fulfilling your purchase | Contract |
| Shipping | Delivery address, phone number | Delivering your order | Contract |
| Payment reference | Transaction ID (no card numbers stored here) | Fraud prevention, receipts | Legitimate interest |
| Technical | IP address, browser type, session token | Security, preventing abuse | Legitimate interest |
| Analytics | Page views, events (when enabled) | Understanding site usage | Consent |
We never store full card numbers. Payment card data is handled directly by PesaPal or PayPal under their own PCI-DSS certification.
3. Third parties and processors
- Saleor Commerce — our e-commerce platform provider, acting as a data processor. Your order and account data is stored on Saleor's infrastructure.
- PesaPal — processes M-Pesa and card payments for Kenyan and regional buyers.
- PayPal — processes card and PayPal wallet payments for international buyers.
- Hosting provider — serves the website infrastructure.
We do not sell your personal data to any third party.
4. International transfers
Some of our processors (including Saleor and PayPal) may process data outside Kenya. Where this occurs, we rely on appropriate safeguards such as standard contractual clauses or the processor's own certification under equivalent frameworks.
5. Retention
- Order data: retained for 7 years to meet Kenyan tax and accounting obligations.
- Account data: retained until you request deletion (see section 6).
- Session tokens: expire within 30 days of inactivity.
- Analytics data: retained per the analytics provider's policy (not yet active).
6. Your rights
Under Kenya's Data Protection Act 2019 you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (subject to legal retention requirements)
- Object to processing based on legitimate interests
- Restrict processing in certain circumstances
- Withdraw consent at any time (where processing is based on consent)
To exercise any of these rights, email sales@shop.dennis-muraguri.co.ke with the subject line Data Subject Request. We will respond within 21 days. If you are not satisfied with our response, you may lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC).
7. Children
This store is not directed at persons under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
8. Security
We use HTTPS encryption for all data in transit. Access to order and account data is restricted to authorised personnel. Passwords are stored as one-way hashes. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ODPC in accordance with the Data Protection Act.
9. Cookies
We use essential cookies and local storage to operate the website (authentication, cart). For analytics cookies, we require your consent. See our Cookies Policy for full details.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email (where we hold your address) and by posting an updated notice on this page with a revised date.
11. Governing law
This policy is governed by and construed in accordance with the laws of Kenya.