Privacy Policy

1. Data Controller

OffGridIt is the data controller for personal information collected through this website. You can reach us via our Contact page.

2. Data We Collect

We collect the following categories of personal data:

• Account data: email address, display name (when you create an account)
• Order data: full name, phone number, delivery address, order history
• Payment data: payment method selection. Card and M-Pesa transactions are processed by third-party payment providers; we do not store card numbers
• Usage data: pages visited, products viewed (stored locally on your device)
• Communications: messages you send us via the contact form

3. Purpose and Legal Basis

• Order fulfilment — to process, deliver and support your purchases (contractual necessity)
• Order confirmation emails — to notify you of purchase details (contractual necessity)
• Customer support — to respond to enquiries (legitimate interest)
• Service improvement — to understand how the site is used (legitimate interest)
• Marketing — newsletter updates, only with your explicit consent

4. Data Sharing

We do not sell your personal data. We share it only where necessary with:

• Payment processors (M-Pesa / card networks) to complete transactions
• Email service providers (Resend) to deliver order confirmations
• Cloud infrastructure providers (Supabase, Vercel) that host this platform under strict data processing agreements
• Law enforcement or regulatory bodies when required by Kenyan law

5. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes above, or as required by law. Order records are retained for 7 years for tax and legal compliance. You may request deletion of your account at any time.

6. Your Rights under the KDPA

As a data subject you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data where no legal obligation requires retention
• Data portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — at any time for consent-based processing (e.g. newsletter)

To exercise any right, contact us via the Contact page. We will respond within 21 days as required by the KDPA.

7. Cookies

We use browser localStorage (not third-party cookies) to store your cart, wishlist, and recently viewed products entirely on your device. We do not use advertising or tracking cookies.

8. Security

We use industry-standard security measures including HTTPS encryption, row-level security on our database, and restricted access to personal data. However, no system is 100% secure, and we encourage you to use a strong, unique password.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on this website. Continued use of the site after changes constitutes acceptance of the updated policy.

10. Complaints

If you believe we have not handled your data correctly, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.