Last Updated: 11/06/2026
Mafraq Enterprises Limited (“we”, “us”, “our”, or “Mafraq”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website https://www.mafraqenterprises.com/ (the “Site”) or make purchases from us.
By using our Site or providing us with your personal information, you consent to the practices described in this Privacy Policy.
1. Information We Collect
We may collect and process the following categories of personal information:
a. Information You Provide to Us Voluntarily
Identity and Contact Data: Your full name, billing address, delivery address, email address, phone number, and, if applicable, your company or organisation name.
Transaction Data: Details about the products you purchase, payment information (credit/debit card details, M-Pesa transaction reference, bank transfer reference), and order history.
Account Credentials: If you create an account on our Site, we may store your username and a securely hashed password.
Communications: Any correspondence you send to us (e.g., via email, phone, or our contact forms), including inquiries, complaints, or feedback.
b. Information Collected Automatically
When you browse our Site, we may automatically receive and record certain technical information from your device, including:
Device Information: IP address, browser type and version, operating system, screen resolution, and device identifiers.
Usage Data: Pages you view, links you click, search queries, time spent on pages, and referring/exit pages.
Cookies and Similar Technologies: We use cookies to enhance your browsing experience and analyse website traffic. (See Section 9 below.)
c. Information from Third Parties
We may receive information about you from third parties such as payment service providers (e.g., to confirm a transaction) or delivery partners (e.g., to update delivery status).
2. How We Use Your Personal Information
We use your personal information for the following purposes:
| Purpose | Legal Basis (under Kenyan Data Protection Act) |
|---|---|
| To process and fulfil your orders, including payment processing and delivery. | Performance of a contract |
| To communicate with you about your order, including order confirmations, delivery updates, and customer support. | Performance of a contract |
| To manage your account (if you register one). | Performance of a contract |
| To process refunds, returns, and warranty claims. | Performance of a contract / Legal obligation |
| To prevent fraudulent transactions and enhance the security of our Site. | Legitimate interest |
| To comply with legal obligations (e.g., tax and record‑keeping requirements). | Legal obligation |
| To send you marketing communications (only if you have opted in). | Consent |
| To improve our website, products, and customer service through analytics. | Legitimate interest |
We will not use your personal information for purposes incompatible with those listed above without notifying you and, where required, obtaining your consent.
3. Disclosure of Your Information
We do not sell, rent, or trade your personal information to third parties for marketing purposes. However, we may share your information with the following categories of recipients:
Service Providers: Third‑party companies that help us operate our business, such as:
Payment processors (banks, Visa/Mastercard, M-Pesa providers)
Delivery and courier companies
IT and hosting services (e.g., website hosting, data backup)
Email and customer support platforms
Legal and Regulatory Authorities: If required by Kenyan law, court order, or to protect our legal rights, we may disclose your information to law enforcement, regulators, or other government bodies.
Business Transfers: In the event of a merger, acquisition, or sale of all or part of our assets, your information may be transferred to the new owner, subject to the same privacy commitments.
All third parties with whom we share your data are contractually obliged to respect the confidentiality of your information and to process it only in accordance with our instructions and the Kenyan Data Protection Act.
4. International Data Transfers
We primarily store and process your personal information within Kenya. If we engage service providers located outside Kenya (e.g., cloud hosting in other jurisdictions), we will ensure that appropriate safeguards are in place, such as standard contractual clauses approved by the Office of the Data Protection Commissioner (ODPC), to protect your data.
5. Data Retention
We will retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, or reporting requirements.
Transaction Data: We retain order and payment records for at least 7 years to comply with Kenyan tax laws (Income Tax Act, VAT Act).
Account Data: If you have an account with us, we retain your information until you close your account or after a period of inactivity (e.g., 3 years), after which we may anonymise or delete it.
Marketing Data: We retain your consent records for marketing communications until you withdraw your consent.
When data is no longer needed, we will securely delete or anonymise it.
6. Your Rights Under the Kenyan Data Protection Act
You have the following rights regarding your personal information:
Right to Access: You can request a copy of the personal information we hold about you.
Right to Rectification: You can ask us to correct inaccurate or incomplete data.
Right to Erasure (“Right to be Forgotten”): You can request that we delete your personal data, subject to legal obligations (e.g., tax records).
Right to Restriction of Processing: You can ask us to stop processing your data in certain circumstances (e.g., while we verify its accuracy).
Right to Data Portability: You can request a copy of your data in a structured, machine‑readable format.
Right to Object: You can object to processing based on legitimate interests (e.g., direct marketing).
Right to Withdraw Consent: If processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us using the details in Section 11. We will respond within 30 days as required by Kenyan law. There is no fee for making a valid request, but we may charge a reasonable fee for manifestly unfounded or excessive requests.
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.
7. Data Security
We take the security of your personal information seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include:
Encryption: We use SSL/TLS encryption on our website to secure data transmitted between your browser and our servers. Payment information is encrypted during transmission.
Access Controls: Only authorised employees and contractors who need access to your data to perform their duties are granted access, and they are bound by confidentiality obligations.
Regular Reviews: We periodically review our security practices and update them as necessary.
Despite our efforts, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.
8. Cookies and Tracking Technologies
Our Site uses cookies – small text files placed on your device – to improve your browsing experience. We use:
Essential Cookies: Necessary for the website to function (e.g., shopping cart, login).
Analytics/Performance Cookies: To analyse how visitors use our Site (e.g., Google Analytics), helping us improve functionality.
Functionality Cookies: To remember your preferences (e.g., language, location).
You can control cookies through your browser settings. You may disable cookies, but please note that some parts of our Site may then become inaccessible or not function properly.
We do not currently respond to “Do Not Track” signals from browsers.
9. Children’s Privacy
Our Site and services are not intended for children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected such data, please contact us, and we will delete it promptly.
10. Third-Party Links
Our Site may contain links to other websites (e.g., payment gateways, courier tracking pages). This Privacy Policy does not apply to those third‑party sites. We are not responsible for the privacy practices or content of any external websites. We encourage you to read their privacy policies before providing any personal information.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact our Data Protection Officer (DPO) or designated representative at:
Mafraq Enterprises Limited
Popman House, Ground Floor,
Off Moi Avenue, Opposite The Bazaar Plaza,
Nairobi, Kenya.
Email:
info@mafraqenterprises.comPhone: +254 712 493 390
12. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational needs. Any changes will be posted on this page with an updated “Last Updated” date. If we make material changes, we will notify you by email (if you have an account) or by a prominent notice on our Site before the change becomes effective. Your continued use of the Site after any changes indicates your acceptance of the revised policy.