Privacy Policy

1. Who we are

Epoxy Floor Solutions ("we", "us", "our") is a Kenyan-registered business based in Ongata Rongai, Kajiado County, offering epoxy flooring materials and installation services nationwide. For the purpose of the Data Protection Act, 2019 (the "Act"), we act as the Data Controller of the personal data you share with us.

2. Personal data we collect

• Identity & contact: name, phone number, email, physical / delivery address.
• Project details: room dimensions, photos of your space, design preferences.
• Order & payment: items purchased, amount, M-Pesa transaction references and proof of payment.
• Communications: messages sent via our website, WhatsApp or email.
• Technical: device, browser, IP address and cookies used to operate the site.

3. Lawful basis & purpose

We process your personal data under the lawful bases set out in section 30 of the Act:

• Performance of a contract — quoting, fulfilling orders, scheduling installation and delivery.
• Consent — sending you marketing updates, where you have opted in.
• Legitimate interest — fraud prevention, securing our website and improving our services.
• Legal obligation — tax, accounting and consumer-protection records (KRA, etc.).

4. Your rights under the Act

As a data subject in Kenya you have the right to:

• Be informed of the use of your personal data.
• Access the personal data we hold about you.
• Object to or restrict the processing of your data.
• Have inaccurate or misleading data corrected, updated or deleted.
• Data portability — receive your data in a structured, commonly used format.
• Withdraw consent at any time (without affecting prior lawful processing).

To exercise any of these rights, email epoxyfloorsolutionssalesandacc@gmail.com or call 0737 323 325. We will respond within the statutory timelines.

5. Sharing & disclosure

We do not sell your personal data. We share it only with trusted processors who help us run the business — payment processors (Safaricom M-Pesa), delivery/logistics partners, cloud hosting and database providers, and professional advisors — strictly to deliver the service you requested. We may also disclose information where required by Kenyan law or a lawful order of a competent court or regulator.

6. Cross-border transfers

Some of our service providers (e.g. cloud hosting) operate servers outside Kenya. Where we transfer your data abroad, we rely on appropriate safeguards as required by sections 48–50 of the Act and the Data Protection (General) Regulations, 2021.

7. Data retention

We keep your personal data only for as long as necessary to fulfil the purposes above, meet our legal obligations (e.g. tax records: 5 years) or resolve disputes. After that it is securely deleted or anonymised.

8. Security

We apply appropriate technical and organisational safeguards — encrypted connections (HTTPS), restricted role-based access, audited logs, row-level security on our database and private storage for customer-uploaded photos — to protect your data from unauthorised access, alteration or loss.

9. Cookies

Our site uses strictly necessary cookies to keep your cart and session working, and limited analytics to understand site usage. You can disable cookies in your browser at any time; some features may not work as expected.

10. Children

Our services are intended for adults (18+). We do not knowingly collect personal data from children without verifiable parental or guardian consent.

11. Complaints

If you believe we have mishandled your personal data, please contact us first so we can put it right. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) — www.odpc.go.ke.

12. Changes to this policy

We may update this policy from time to time. Material changes will be highlighted on this page with a new "Last updated" date.