YOUR DATA
Privacy Policy
LAST UPDATED 25 AUGUST 2026
This policy explains what personal data LumaCraft Kits collects when you buy a jersey from us, why we collect it, who else sees it, and what you can ask us to do about it. We have written it to describe what our website actually does — not what a template says a shop might do.
We are the data controller for the information described here. We operate from Maseno, Kisumu County, Kenya, and we process personal data under Kenya’s Data Protection Act 2019. We are working through our registration position with the Office of the Data Protection Commissioner (ODPC) and will publish our registration number here once it is issued.
What we collect, and why
We collect the minimum needed to get a jersey to your door and to take payment for it. There is no account to create, and we do not ask for anything we do not use.
| What | Why we need it |
|---|---|
| Your name | To address the order, the receipt, and the delivery. |
| Email address | Where your receipt and delivery notice are sent. This is our main way of replying to you. |
| Phone number | So the rider can reach you on the day, and — unless you nominate a different one — it is the number we send the M-Pesa prompt to. |
| M-Pesa number (only if you choose one) | If the line paying is not your delivery number, you can nominate the payer's number at checkout. We store it only to send the payment prompt to the right phone. |
| Delivery address and area | To route the delivery. The area is chosen from the zones we actually serve. |
| Landmark and delivery notes (optional) | Most addresses here are not formal street addresses. A nearby landmark or a gate instruction is often the only way a rider finds you. |
| A GPS pin (optional) | Only if you tap “Pin my location” and your browser asks your permission first. It is a one-off coordinate pair used to place your door on a map for the rider. We do not track your location, and declining changes nothing else about your order. |
| What you ordered | The jerseys, sizes, versions, and any name, number and lettering style you chose for printing — this is the specification we print from. |
| Payment result | The M-Pesa receipt reference and the amount, so we can confirm your payment and reconcile our accounts. |
| Message you send us | If you use the contact form: your name, email, optional phone, and your message, so we can answer it. |
| Technical details with a contact-form message | Your IP address and browser user-agent are stored alongside contact-form messages only. This is for abuse triage — if one source floods the form, this is what lets us stop it. |
We do not ask for your date of birth, ID number, gender, or any special-category data. We do not buy personal data from anyone, and we do not build advertising profiles.
Our lawful basis
Under the Data Protection Act 2019, we rely on:
- Performance of a contract — for everything needed to accept, print, pay for and deliver your order. If you do not provide this, we cannot fulfil the order.
- Consent — for the optional GPS pin, and for any non-essential cookies or analytics. Consent is asked for separately, and you can withdraw it at any time without affecting your order.
- Legitimate interests — for keeping the site secure and preventing abuse of the contact form and checkout, and for keeping an internal record of administrative actions on our own system.
- Legal obligation — for retaining sales and tax records for as long as Kenyan law requires.
Buying from us never requires agreeing to marketing. Our checkout has no newsletter box, no pre-ticked opt-in, and no marketing consent bundled into the purchase.
How long we keep it
We keep personal data only while it still serves the purpose it was collected for:
- Order and payment records — kept while we may still need them for delivery, returns, warranty questions and accounting. Sales and tax records are kept for as long as Kenyan tax law requires us to.
- Contact-form messages — kept while the enquiry is open and for a reasonable period afterwards so we have context if you come back to us.
- Abuse-prevention records — the IP and user-agent stored with a message are kept only as long as they are useful for that purpose.
- Your cart — never leaves your own browser until you check out. Clearing your browser storage deletes it.
If you ask us to delete data we are not legally required to keep, we will. See your rights below.
Your rights
Under the Data Protection Act 2019 you can ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct anything inaccurate — a misspelt name or a wrong delivery address;
- delete data we no longer have a lawful reason to keep;
- stop or restrict a particular use of your data;
- withdraw a consent you previously gave, such as the GPS pin or analytics;
- object to processing we base on legitimate interests.
To exercise any of these, email support@lumacraftkits.co.ke from the address you used for your order, or tell us the order number. We will respond as soon as we can and in any case within the time the Act allows. There is no charge.
Two honest limits worth stating: we may need to keep some records even after a deletion request where tax law requires it, and we cannot delete a payment record held by Safaricom — that one is theirs, and you would need to approach them directly.
If you are not satisfied with how we have handled your data, you can complain to the Office of the Data Protection Commissioner (ODPC), Kenya.
How we protect it
Security here is specific rather than a reassuring adjective. The measures actually in place include:
- HTTPS on every page and every API call, with HSTS so browsers refuse to connect any other way.
- A Content Security Policy that restricts which scripts, styles, images and connections the site may load at all — so an injected third-party script has nowhere to load from.
- Your order confirmation page is reachable only with a token tied to that specific order, so order numbers cannot be guessed to read someone else’s details.
- The M-Pesa number we charge is read from your stored order, never from the request the browser sends — so nobody can redirect a payment prompt to a phone of their choosing.
- Payment callbacks from Safaricom are authenticated before they are allowed to mark anything paid.
- Administrator access is password-protected with hashed passwords, session cookies that JavaScript cannot read, and an internal log of administrative actions.
- Rate limiting on checkout, payments and the contact form.
- Data is encrypted in transit and at rest at our database host, and we never store card numbers or your M-Pesa PIN — we never receive them in the first place.
No system is perfectly secure. If you believe you have found a vulnerability in our site, please email support@lumacraftkits.co.ke and give us a reasonable chance to fix it before disclosing it publicly. We will not pursue anyone who reports a genuine issue in good faith.
Children
Our shop is intended for adults. We do not knowingly collect personal data from children under 18. A parent or guardian is welcome to buy a kit for a child — in that case the personal data is the adult’s, and a child’s name printed on a jersey is a printing instruction, not a profile. If you believe a child has given us their data directly, tell us and we will delete it.
Changes to this policy
When we change how we handle personal data, we update this page and the date at the top. If a change is material — a new processor, a new purpose, a new category of data — we will make that clear rather than quietly editing the text, and where the change needs your consent we will ask again.
Contact us
For anything in this policy, including a data request, email support@lumacraftkits.co.ke. We are based in Maseno, Kisumu County, Kenya.