Privacy notice

Last updated 2 November 2026 · Version 2026-11-02

This notice explains what Trendysh Accosmetic does with the details you give us when you use this website, order from us or message us, and the choices you have. We use your details only to take, deliver and support your orders and to look after your account. We never sell them, rent them out or give them to anyone for their own use.

Who we are

Trendysh Accosmetic is a beauty supplies shop in Nairobi, Kenya, with three shops: Superior Arcade (Basement, Shop B33 and B10, Dubois Road), Simara Mall (Ground floor, Shop GS 07, Tom Mboya Street) and Junction (Beauty Galleria, Stalls D5, Dubois Road). We decide how the details in this notice are used, so we are responsible for them under Kenya's Data Protection Act, 2019.

What we collect

Only what you give us, or what an order needs:

• When you order: your name (or your business name), phone number and email address; whether you pick up or have it delivered; the delivery place, directions and the name and phone number of whoever receives the parcel, when you give them; and the order itself (products, quantities, prices and totals).
• When you pay: the Paybill account reference for your order and the name on the M-PESA payment you type in. We never ask for, see or keep card numbers or your M-PESA PIN.
• When you create an account: your name, email address, phone number and a password. The password is stored only as a one-way scrambled form (a hash) that nobody, including us, can read back.
• When you write a review: the name you give, your rating and what you write.
• When you suggest a delivery place: the place and any contact you choose to leave.
• When you send an order by Metro: the stop you name is kept, without any phone number in it, and offered to other customers choosing that Metro, so they can pick it.
• When you message or call us, or send your basket to us on WhatsApp: what you tell us.

Like every website, our servers receive your device's internet (IP) address when you use the site. We use it only to keep the site working and to stop abuse, such as too many attempts in a row.

What we use it for

Your details are used only to:

• take, confirm and prepare your order, and arrange its delivery or pickup;
• match your M-PESA payment to your order;
• send you emails about your order (order placed, payment reminder, payment received) and the one-time codes you ask for;
• let you track your orders and see them in your account;
• answer your questions and sort out any problem with an order;
• keep your account working; and
• show the reviews you choose to publish.

We use them for nothing else. We do not build advertising profiles, and we do not send advertising messages from these details.

We use your details because you asked us to carry out an order or keep an account for you, because you chose to publish a review, or because Kenyan law requires us to keep sales records.

Who sees it

Our own staff see what they need for their work, and each staff account can open only the parts of the system its role allows.

Outside the shop, your details go only to the services that carry out your order or run this website, and only what each one needs:

• the delivery provider you choose (a rider, a Metro or matatu sacco, or a courier): the name and phone number to contact, the drop-off point and your directions;
• Brevo, the service that sends our order emails: your name, email address and the order details in the email;
• Railway, which hosts the system that stores orders and accounts, and Render, which hosts the website pages.
• Safaricom carries your M-PESA payment under its own terms, and WhatsApp carries any message you send us there under its own privacy policy.

Product photos are stored with Cloudinary and hold no customer details. The website's fonts load from Google Fonts, which sees your device's internet address when your browser fetches them.

We never sell, rent, trade or give your details to anyone else. The only exception is when Kenyan law requires us to hand something over, for example under a court order.

Some of these services may keep data on servers outside Kenya.

What stays on your device

Your basket, your sign-in, your wishlist and the products you viewed recently are kept in your own browser's storage. What the shop suggests to you is worked out on your device from the products you viewed, added, or scrolled past without opening; that history is not sent to us and is forgotten after a few weeks. The delivery you last used (the way it travels, the stop or address, who receives it) is kept on your device, and on your account when you are signed in, so your next order is filled in for you. A cookie keeps you signed in to your account.

We use no advertising or tracking cookies. We count how often each product page is opened, without recording who opened it.

How we protect it

• Everything between your device and the shop travels over an encrypted connection (HTTPS).
• Passwords are stored only as hashes.
• One-time codes expire after 10 minutes and allow only a few tries.
• Repeated failed sign-ins are slowed down.
• Every staff action is checked against the staff member's role on our server, and a staff account that is switched off loses access at once.

No system can be perfectly secure. If a breach puts your details at risk, we will tell you and the Data Protection Commissioner as the law requires.

How long we keep it

• Your account: until you ask us to delete it.
• Order records: for as long as Kenyan tax law requires us to keep sales records.
• Reviews: until you ask us to remove yours, or until we remove it under our Terms of use.
• One-time codes, expired sign-ins and order look-up sessions: deleted automatically every night.

Your rights

Under the Data Protection Act, 2019, you have the right to:

• be told how your details are used (this notice);
• see the details we hold about you and get a copy;
• have wrong or incomplete details corrected;
• have your details deleted, except order records the law requires us to keep;
• object to a use of your details; and
• take back your agreement to a published review at any time.

To ask, contact us (below) from the phone number or email address on your order or account, so we know it is you. We reply within 7 days. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

Registration

Registration with the Office of the Data Protection Commissioner (ODPC): pending approval.

Changes to this notice

If we change this notice, we update its version and date at the top. When you place an order, we record which version you agreed to.

Contact us about your details

For any question or request about your details:

WhatsApp or call 0793 506 900.