Privacy Policy

Moments Packaging Kenya Ltd (“Moments Packaging”, “we”, “us”) is the data controller responsible for personal information collected through momentspackaging.com. We are based in Industrial Area, Nairobi (Ukwala Road, opposite Salvation Army, OTC). This policy is issued in compliance with the Kenya Data Protection Act, 2019 and its supporting regulations.

For any privacy matter — including data access, correction or deletion requests — contact our data protection contact at info@momentspackaging.com or +254 119 556 688.

We collect data through the following forms and touchpoints on this site:

• Account registration & login (/account/register, /account/login, /account/verify, /account/forgot-password, /account/reset-password): full name, email address, phone number, password (stored hashed), and email verification code.
• Profile (/account/profile): business name, default delivery county, town and address details, and marketing preferences.
• Checkout (/checkout): billing name, email, phone, M-Pesa number, destination address (county, town, nearest courier office), dispatch details (sacco / parcel-service name, Nairobi stage or office), order items and any delivery notes.
• Order tracking (/orders/track): order reference and email/phone used to look up an order.
• Contact & enterprise quote forms (/contact, /enterprise-quote): name, business name, email, phone, message, expected volumes and any uploaded artwork files.
• Newsletter / insider email prompt: email address (only if you opt in).
• Product reviews: name shown with the review, rating and review text.
• WhatsApp, phone and email conversations with our sales and support team, kept for service and audit purposes.
• Usage data: pages visited, device type, approximate location and referrer, collected via cookies and local storage (cart, wishlist, session).

We only share personal data with vetted processors, strictly to deliver the service you asked for:

• Safaricom PLC (M-Pesa) — to process mobile-money payments. Your M-Pesa number and transaction reference are shared with Safaricom.
• Banks — when you pay by bank transfer, for reconciliation.
• Saccos, matatus and parcel services nominated by you (own-courier option) — we share your name, phone number and pickup town so the parcel can be collected.
• Our own delivery riders — for zone delivery within Nairobi and surrounds.
• Cloud hosting and database providers (Cloudflare for hosting and Supabase for application database and storage) acting on our instructions.
• WhatsApp / Meta — when you message us via WhatsApp Business.
• Email providers we use to send transactional and (where you opted in) marketing email.
• Regulators, ODPC and law enforcement where we are legally required to disclose.

We never sell your personal data.

This site currently uses the following cookie / local-storage categories:

• Strictly necessary: session, authentication, CSRF, cart contents, wishlist, persona selection and a one-time splash flag. Without these the site cannot function — they do not require consent.
• Functional: remembering your preferred county, recently viewed products and admin UI preferences. They improve usability and persist your choices.
• Analytics: if and when we enable a privacy-friendly analytics tool, it will measure anonymous page views and traffic sources so we can improve the catalogue. No analytics scripts are loaded today; we will update this list before any are added.
• Marketing: we do not currently run third-party advertising pixels (Meta, Google Ads, TikTok). If we add them, we will request your consent first via a cookie banner.

You can clear or block cookies in your browser settings, but parts of checkout and your account may stop working.

Logos, photos and artwork you upload remain your property. We use them only to produce your order. We may keep a copy on file so repeat orders are faster — email us if you want it deleted.

• Order, invoice, M-Pesa and tax records: at least 7 years (KRA requirement).
• Account profile: while your account is active, plus 12 months after closure.
• Marketing list: until you unsubscribe.
• Support conversations (WhatsApp/email): up to 24 months.

Data is transmitted over HTTPS and stored with reputable cloud providers in encrypted form. Passwords are hashed. Access is limited to staff who need it. No system is 100% secure — please use a strong, unique password.

As a data subject in Kenya, you have the right to:

• Be informed of how your data is used (this policy).
• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion (“right to be forgotten”) where the law allows.
• Object to processing, including direct marketing.
• Request data portability in a commonly used format.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) via www.odpc.go.ke.

To submit a data request, email info@momentspackaging.com with the subject line “DPA Request” and include enough information to verify your identity (e.g. the email or phone on your account). We will respond within 30 days as required by the Act.

Moments Packaging Kenya Ltd is in the process of registering as a Data Controller with the Office of the Data Protection Commissioner (ODPC) of Kenya. Our registration reference will be published on this page once issued.

Our service is intended for businesses and adults. We do not knowingly collect data from children under 18.

Some of our processors (e.g. cloud hosting and email) may process data on servers outside Kenya. Where this happens we rely on contractual safeguards as required by the DPA, 2019.

We may update this policy from time to time. The “Last updated” date at the top reflects the current version. Material changes will be notified by email or a notice on the site.

Moments Packaging Kenya Ltd
Ukwala Road, opposite Salvation Army, OTC, Nairobi, Kenya
Email: info@momentspackaging.com
Phone / WhatsApp: +254 119 556 688