Privacy Policy

Maven Luxury Limited is the data controller for personal data processed for the purposes described in this Policy. Where a service provider processes data only on our instructions, that provider acts as our data processor. Some providers, such as payment institutions, may act as independent controllers for their own regulated activities.

• Identity and contact data: name, telephone number, email address, delivery address and account identifiers.
• Transaction data: Products viewed or purchased, order number, amount, date, delivery or collection information, returns and complaints.
• Payment-related data: payment method, transaction reference and confirmation status. Full card credentials are normally handled by the payment provider rather than stored by us.
• Account and preference data: password or authentication data, fragrance preferences, wish lists and marketing choices.
• Communications: emails, calls, messages, feedback, reviews and customer-service records.
• Technical and usage data: IP address, device and browser information, cookie identifiers, Website activity, approximate location derived from IP and security logs.
• Store-security data: CCTV images where notices indicate that CCTV is in use.
• Information needed to investigate fraud, legal claims, product safety incidents or suspected counterfeit goods.

We do not intentionally request sensitive personal data for ordinary sales. Please do not send health or other sensitive information unless it is necessary for a specific complaint or legal claim. If you do, we will handle it under the additional protections required by law.

• directly from you when you browse, create an account, order, pay, collect, request delivery, return a Product, contact us or join marketing;
• automatically through cookies, logs and similar technologies, subject to applicable choices and consent;
• from payment, courier, e-commerce, fraud-prevention and communications providers involved in your transaction;
• from a person placing an order or arranging collection on your behalf; and
• from lawful public sources or regulators where necessary for verification, safety or legal compliance.

Where we rely on legitimate interests, we assess the business need, necessity and effect on your rights. You may object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out lawfully.

Fields identified as required are necessary to process an order, arrange delivery or collection, verify payment, meet a legal requirement or answer a request. If you do not provide required information, we may be unable to create an account, accept or fulfil an order, provide delivery, process a return or respond fully. Marketing information is optional.

We share only the personal data reasonably necessary with:

• payment, banking and mobile-money providers;
• couriers, logistics providers and authorised collection locations;
• Website hosting, e-commerce, cloud storage, communications, analytics, security and customer-support providers;
• professional advisers, auditors and insurers subject to appropriate confidentiality duties;
• manufacturers, distributors or laboratories where necessary to investigate authenticity, quality or safety;
• regulators, courts, law-enforcement bodies and other authorities where disclosure is required or lawfully requested; and
• a purchaser, investor or successor in a genuine business transaction, subject to confidentiality and applicable law.

We do not sell personal data.

We require processors to protect it, use it only for agreed purposes and assist us in meeting applicable data-protection obligations.

Some technology or service providers may store or access personal data outside Kenya. Before such a transfer, we will use a safeguard permitted by Kenyan law, such as an adequacy basis, appropriate contractual safeguards, consent where valid, or another lawful transfer ground. You may contact us for information about the applicable safeguard.

We retain personal data only for as long as reasonably necessary for the stated purpose, including legal, tax, accounting, safety, fraud-prevention and claims requirements. Our usual guide is:

• transaction, invoice and tax records: generally 7 years after the relevant transaction or longer if legally required;
• customer-service, return and complaint records: generally up to 7 years after closure where needed for claims or compliance;
• account data: while the account is active and for a reasonable period after closure or prolonged inactivity;
• marketing records: until you opt out or the data is no longer needed, while retaining a minimal suppression record to honour the opt-out;
• Website security logs: ordinarily up to 12 months unless an incident requires longer retention; and
• CCTV: ordinarily up to 30 days unless footage is required for an incident, investigation or claim.

We may anonymise data so that it can no longer identify you and use that anonymous information for lawful statistical or business purposes.

We may use strictly necessary cookies to operate checkout, remember security settings and maintain a shopping session. With your consent where required, we may also use preference, analytics, performance and advertising cookies. Our cookie banner or preference centre should identify the relevant categories and allow you to accept, reject or change non-essential choices. Rejecting non-essential cookies will not prevent basic Website use, although some optional features may be less personalised.

You can also manage cookies through your browser. Browser deletion does not itself withdraw consent for future cookies, so use our preference control where available.

We may send product news, offers or reminders where you have consented or where another lawful basis permits it. You can opt out at any time by using the unsubscribe link, replying “STOP” to an eligible message, changing account preferences, emailing info@feelnzuri.com or calling +254 794 446 480. We will action the request without undue delay and will not charge you for opting out, apart from ordinary communication charges imposed by your provider.

Subject to applicable conditions and exceptions, you may have the right to:

• be informed about how your personal data is used;
• access personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of personal data that we are no longer entitled to retain;
• object to processing, including direct marketing;
• request restriction of processing;
• receive qualifying personal data in a portable format;
• withdraw consent at any time;
• not be subject to a solely automated decision with significant effects except where lawfully permitted and appropriately safeguarded; and
• complain to the Office of the Data Protection Commissioner of Kenya.

To exercise a right, contact us using section 16. We may request proportionate information to verify your identity and protect your data. We will respond within the period required by law and explain any lawful refusal or extension.

We use reasonable organisational and technical safeguards designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures may include access controls, staff confidentiality, secure providers, authentication, backups, monitoring and incident procedures. No online system is completely risk-free.

Where a personal-data breach creates a legally reportable risk, we will notify the Office of the Data Protection Commissioner and affected individuals within the periods and in the manner required by law.

The Website is not directed at children, and we do not knowingly allow a child to create an account or place an order without appropriate involvement of a parent or guardian. If you believe we have collected a child’s data improperly, contact us so that we can investigate and take appropriate action.

The Website may link to social-media, payment, courier or other third-party services. Those organisations may process personal data under their own privacy notices. We encourage you to review them. We are not responsible for an independent third party’s privacy practices.

We may update this Policy to reflect legal, operational or technical changes. We will post the updated version with a new effective date and, where appropriate, give additional notice of a material change.

For a privacy question or to exercise a data-protection right, contact our privacy contact below.

You also have the right to complain to the Office of the Data Protection Commissioner of Kenya through its official complaint channels. We encourage you to contact us first so that we can try to resolve the issue promptly, but you are not required to do so.