Privacy Policy

Jowam Coffee Roasters is the data controller for personal data collected through https://jowamroasters.com, our WhatsApp and email, and at the café. We handle it in line with the Data Protection Act, 2019 and its regulations.

For any privacy question or request, email hello@jowamroasters.com with "Privacy" in the subject line, or write to us at Lavington Mall, James Gichuru Road, Nairobi, Kenya.

• Orders: your name, phone number, email, delivery address, the items you order, any notes you add, and your order reference.
• Payments: the M-Pesa transaction code, the paying name and number, and the amount. We never see or store your M-Pesa PIN.
• Enquiries for wholesale, cupping, training or events: your name, business name, email, phone, location and the details you give us.
• Messages you send us by WhatsApp, email, phone, Instagram or TikTok.
• Technical data: your IP address, browser type and the pages you request. Our hosting provider processes this to deliver the site, keep it secure and limit abuse.

If you tell us about an allergy or health need in an order note or booking, that is sensitive personal data. By giving it to us, you consent to us using it only to prepare your order or event safely. You can ask us to delete it at any time.

Our website is not aimed at children. We do not knowingly collect data from anyone under 18 without a parent or guardian's consent.

• To confirm, prepare, deliver and support your order. We need this to perform our contract with you.
• To reply to enquiries and run bookings, which is in our legitimate interest and yours.
• To keep the website and our accounts secure and to prevent fraud, which is in our legitimate interest.
• To keep sales and tax records, which the law requires.
• To send you news or offers, only if you have asked us to. You can opt out at any time.

We do not make decisions about you by automated means alone, and we do not sell your personal data.

We share only what each party needs to do its job:

• Google, which stores our order records in Google Sheets.
• Resend, which sends order and enquiry emails for us.
• Cloudflare, which hosts and protects our website.
• Safaricom, which processes M-Pesa payments.
• Meta, which runs WhatsApp, when you message us there.
• Riders and couriers, who receive your name, phone number and delivery address only.
• Government bodies or courts, where the law requires us to.

Our Visit page shows a Google Maps embed, and the site loads fonts from Google Fonts. Your browser connects to Google directly for these, so Google receives your IP address and may set its own cookies. Google's privacy policy applies to that data.

Some of these providers store data on servers outside Kenya, including in the United States and the European Union. We only use providers that commit to protecting personal data, and we transfer data abroad only as the Data Protection Act allows, for example where it is needed to fulfil your order or where suitable safeguards are in place.

• Order and payment records: 5 years after the order, as required for tax purposes.
• Enquiries that do not lead to an order or booking: up to 12 months.
• WhatsApp and email conversations: up to 12 months, unless they form part of an order record.
• Technical logs: kept by our hosting provider for a short period, usually days.

After that, we delete the data or anonymise it so it no longer identifies you.

Our website uses HTTPS. Access to order records and our email and WhatsApp accounts is limited to the staff who need it, using protected accounts. If a breach puts your data at real risk, we will notify the Office of the Data Protection Commissioner within 72 hours and tell you without undue delay.

Under the Data Protection Act, 2019 you have the right to:

• Be told how your data is used, which is what this policy does.
• Get a copy of the personal data we hold about you.
• Have wrong or incomplete data corrected.
• Have data deleted when we no longer need it or hold it unlawfully.
• Object to, or ask us to restrict, how we use your data.
• Receive your data in a portable format.
• Withdraw consent you have given, such as for marketing.

To use any of these rights, email hello@jowamroasters.com. We may ask you to confirm your identity. There is no charge, and we reply within the time limits set by the Data Protection (General) Regulations, 2021.

If you are not happy with how we handle your data, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke. We would appreciate the chance to sort it out with you first.

We do not use advertising cookies, and our analytics tool sets no cookies at all. Your shopping bag is saved in your browser's local storage so it is still there when you come back. It stays on your device and only reaches us when you place an order. You can clear it at any time in your browser settings.

We use Umami, an analytics tool we run on our own server, to count page visits and actions such as adding coffee to your bag, placing an order, sending an enquiry or tapping our WhatsApp, phone and directions links. Umami does not store your IP address and cannot tell us who you are. We only see totals, for example how many people opened the shop page and which country, browser and type of device they used. We use these numbers to improve the site and plan which coffees to stock.

Third-party content such as the Google Maps embed may set its own cookies, as explained above. If we ever add advertising tools, we will update this policy and ask for your consent where the law requires it.

We will update this page when our practices or the law change. The date at the top shows the current version. If a change affects how we use data you have already given us, we will let you know.