We respect your privacy and process personal data in line with the Kenya Data Protection Act, 2019. This policy is written in plain language. We trade as mydrink. For privacy questions, contact support@mydrink.co.ke.

What we collect

Depending on how you use our Services, we may process:

• Account and contact details — for example name, email address, and Kenya phone number when you register, sign in, or place an order.
• Order and payment-related information — items purchased, delivery details, and transaction references. Payments are processed by Paystack (which supports cards and M-Pesa); we receive confirmation of payment status and a transaction reference, not your full card number or mobile-money PIN.
• Age confirmation — you must confirm you are 18 or older to browse and buy. Your confirmation is stored on your own device (see our Cookie Policy), and delivery staff may check ID on handover.
• Communications — messages you send to us (e.g. support, WhatsApp, or the on-site shopping assistant) and records needed to assist you.
• Technical and usage data — such as IP address, device or browser type, and pages viewed, to secure the site and improve performance. We use cookies and similar technologies as described in our Cookie Policy.

How we use your information

We use personal data to:

• Provide the storefront, process orders, and deliver products;
• Verify that customers meet the legal drinking age and authenticate your account;
• Protect against fraud, abuse, and security threats;
• Communicate about your orders, service updates, or support;
• Comply with legal obligations applicable in Kenya; and
• Analyse and improve the Services (including optional analytics when enabled).

We do not sell your personal information. Marketing messages, if any, will be sent in line with your preferences and applicable law.

Cookies, local storage, and your cart

We use cookies for sign-in and security, and browser local storage for things like your shopping cart, age confirmation, and recently viewed products. Data kept in local storage stays on your device unless we sync it to our servers as part of an order or account feature. Full details are in our Cookie Policy.

Third-party services

We rely on service providers who process data on our behalf under contracts. These include:

• Payments (Paystack) — when you pay, Paystack processes your payment details (card or M-Pesa) under its own privacy policy. We receive the outcome and a reference, not your credentials.
• Content and commerce data (Sanity) — product information and CMS content are hosted and delivered via Sanity's platform.
• Hosting and infrastructure — our application runs on cloud providers (such as Vercel and Neon) that process technical request data (e.g. IP address, headers) as part of hosting and storing our database.
• Authentication (Google) — if you sign in with Google, Google receives information according to its own policies when you choose that option.
• Delivery partners — where you choose delivery or a pickup point, we share the details needed to fulfil your order (such as name, phone number, and destination) with the courier or pickup network handling it.
• AI shopping assistant — messages you send to the on-site assistant are processed by our AI provider to generate responses. Do not include sensitive personal information in chat messages.

Retention

We keep personal data only as long as needed for the purposes above, including legal, tax, and accounting requirements in Kenya, and then delete or anonymise it where appropriate.

Your rights

Under the Kenya Data Protection Act, 2019, you have rights to access, correct, delete, or object to certain processing of your personal data, and to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). To exercise your rights or ask questions, contact us at the email below. We may need to verify your identity before responding.

Children

Our Services are strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have collected data from a minor, contact us and we will delete it.

International transfers

Some of our providers may process data outside Kenya. Where that happens, we use appropriate safeguards as required by law (such as contractual clauses or provider certifications).

Changes to this policy

We may update this policy from time to time. The “Last updated” date will reflect changes. For material changes, we may provide additional notice on the site or by email.

Contact

Privacy enquiries: support@mydrink.co.ke.