Privacy Policy

Avenue Fashion (a trade name of Nyota Imara Technologies, a general partnership registered in Kenya)

Effective Date: 1st July 2026

1. Introduction

Avenue Fashion ("we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and your rights with respect to it.

This Policy applies to all users of our website (avenuefashion.co.ke), our mobile application, and any related services (collectively, the "Platform"). It is prepared in accordance with the Kenya Data Protection Act, 2019, and reflects internationally recognised privacy principles including those of the General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Account and Identity Data

When you create an account via Nyota ID, we collect:

• Full name
• Email address
• A unique Supabase user identifier (UUID) linked to your Nyota ID

2.2 Delivery and Address Data

When you save a shipping address or place an order, we collect:

• Recipient name and phone number
• Physical address, estate or area, and county
• Delivery instructions or landmarks

2.3 Order and Transaction Data

When you place an order, we collect and retain:

• Items purchased, including size, colour, quantity, and unit price
• Order number, subtotal, shipping fee, discount applied, and total amount
• Payment method and provider transaction reference
• Order and payment status

For legal, accounting, and fraud prevention purposes, order and transaction records are retained even if you later delete your account.

2.4 Reviews and User-Generated Content

If you submit a product review, we retain the content of that review alongside your rating and the associated product.

2.5 Device and Notification Data

If you use our mobile application and grant permission, we store an Expo push notification token to deliver order status updates and relevant product announcements directly to your device. This token is stored against your account and can be removed by revoking notification permissions in your device settings.

2.6 Support Data

If you raise a support ticket, we collect the content of your communications and any information necessary to resolve your request.

3. How We Use Your Data

We use your personal data for the following purposes:

• To process and fulfil orders — including calculating delivery fees, coordinating dispatch, and sending order confirmations and status updates.
• To communicate with you — including transactional emails, push notifications, and responses to support queries.
• To maintain your account — including authenticating your identity and storing your saved addresses and preferences.
• To moderate user content — including reviewing submissions such as product reviews before they are published on the Platform.
• To improve the Platform — including diagnosing technical issues and understanding usage patterns in aggregate.
• To comply with legal obligations — including retaining records required under Kenyan tax and commercial law.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

4. Legal Bases for Processing

We process your personal data under the following lawful bases (as recognised by the Kenya Data Protection Act, 2019, and aligned with GDPR principles):

• Performance of a contract — processing necessary to fulfil your orders and manage your account.
• Legal obligation — retaining transaction records as required by applicable law.
• Legitimate interests — fraud prevention, platform security, and service improvement, where these interests are not overridden by your rights.
• Consent — for push notifications, which you may withdraw at any time through your device settings.

5. Third-Party Data Processors

We share your data only with trusted third-party service providers as necessary to operate the Platform. These are:

ProcessorPurposeData Shared

Supabase (USA)

Identity, authentication, and secure session management

Email, Supabase UUID

M-Pesa / Safaricom (Kenya) /

Mobile money payment processing

Phone number, transaction reference

Expo (USA)

Mobile push notification delivery

Device push token

We do not sell your personal data to any third party. We do not share your data with advertisers.

All third-party processors are bound by data processing agreements and are required to handle your data in accordance with applicable data protection law.

6. Data Retention

We retain your personal data for as long as necessary for the purposes described in this Policy, or as required by law:

• Account and address data — retained while your account is active. Deleted upon a verified account deletion request, subject to the exceptions below.
• Order and transaction records — retained for a minimum of 7 years after the transaction date, as required for tax and accounting compliance, regardless of account status.
• Support ticket records — retained for a minimum of 3 years for audit and dispute resolution purposes.
• Push notification tokens — deleted when you delete your account or revoke notification permissions.

7. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your account and associated profile data (subject to our legal retention obligations).
• Restriction — request that we limit processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Data portability — receive your data in a structured, machine-readable format where technically feasible.

To exercise any of these rights, contact us at privacy@avenuefashion.co.ke. We will respond within 21 days.

7.1 Account Deletion

You may permanently delete your Avenue Fashion account from within the Platform. Upon deletion, your profile, saved addresses, and preferences will be erased from our active systems. Historical order receipts and support ticket records will be retained as required by law but will be disassociated from your active profile where technically feasible.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted transmission of data (HTTPS/TLS)
• Role-based access controls within our internal systems, restricting staff access to personal data on a need-to-know basis
• Separation of sensitive fields (e.g., supplier relationships, cost prices) from publicly accessible data

No system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner of Kenya and affected users as required by law.

9. Children's Privacy

The Platform is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at privacy@avenuefashion.co.ke and we will take prompt steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you via email or a prominent notice on the Platform. Continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy.

11. Contact

For any privacy-related queries or to exercise your rights:

Avenue Fashion (Nyota Imara Technologies)

Parklands, Nairobi, Kenya

Email: privacy@avenuefashion.co.ke

Website: avenuefashion.co.ke

This Privacy Policy was last updated on 25th June 2026.