Privacy Policy

01.

Information We Collect

At Sky Tea Company, we collect only the necessary data to roast, package, dispatch, and tailor your high-altitude Kenyan tea orders. We adhere strictly to the principle of data minimization under Kenya's Data Protection Act (2019) and global privacy benchmarks.

Data CategorySpecific ElementsCollection Method
Identity & ContactFull name, delivery address, phone number, email address.Checkout forms, account sign-up.
Transactional & BillingSafaricom M-PESA mobile numbers, transaction reference codes, card token hashes. (No raw CVV stored).Payment processing gateway.
Telemetry & UsageIP address, browser version, regional location, tea browsing preferences (e.g. Tangawizi vs Green Tea).Cookies, session logs, browser analytics.
M-PESA Security: When paying via Safaricom Lipa Na M-PESA, your transaction is routed directly via Safaricom's encrypted Daraja API. Sky Tea never accesses, sees, or stores your secret M-PESA PIN.
02.

How We Use & Process Data

Your data enables us to deliver fresh volcanic highland harvests to your doorstep and enhance your purchasing experience:

Fulfillment & Dispatch

Routing parcels to courier partners (e.g., G4S, Fargo Courier, DHL Express) and dispatching SMS parcel tracking updates.

Sky Tea Club Perks

Managing your reward points, seasonal reserve tasting invites, and early access notifications for small-batch single estate flushes.

Customer Care

Resolving order inquiries, processing returns or refunds under our Fresh Harvest Guarantee, and brewing instruction consultations.

Fraud Mitigation

Validating legitimate payment tokens, preventing unauthorized account takeovers, and auditing digital transaction integrity.

03.

Data Sharing & Third-Party Processors

We will never sell, rent, or trade your personally identifiable information to advertisers. We share specific subsets of data strictly with vetted processors bound by strict confidentiality:

Logistics Partners: Delivery carriers receive only your recipient name, contact phone number, and street address for parcel drops.
Payment Gateways: Safaricom M-PESA, Visa, Mastercard, and Apple Pay process tokenized payment requests over bank-grade encrypted channels.
Legal Mandates: Where compelled by valid Kenyan court orders or statutory regulatory decrees under Kenyan law.
04.

Cookies & Tracking Technologies

Cookies preserve items in your cart and help us remember whether you prefer Whole Leaf, Granulated, or Tangawizi spiced blends. You have complete control over your preferences below:

Manage Cookie PreferencesInteractive
Essential Cookies
Required for checkout, security tokens, and cart state.
Always Active
Functional & Preference Cookies
Remembers preferred currency (KES / USD) and pouch size defaults.
Analytics & Harvest Reports
Anonymous visit telemetry to optimize web store responsiveness.
05.

Data Retention & Archival

All customer data is encrypted in transit using TLS 1.3 cryptographic protocols and stored on secure cloud clusters with AES-256 resting encryption. Access to our internal ordering database is strictly restricted via zero-trust multi-factor authentication.

7 YRS
Tax & Invoicing Records (Statutory Kenya Law)
30 Days
Telemetry Server Access & Traffic Logs
Immediate
Erasure on Account Deletion
06.

Your Statutory Rights

As a consumer, you maintain full sovereignty over your personal data under the Kenya Data Protection Act and respective international statutes:

Right to Access & Rectification
Request a copy of the personal information we hold or correct inaccurate contact coordinates.
Right to Forgotten Status (Erasure)
Demand complete wiping of your account history, purchase reviews, and mailing profiles.
Right to Withdraw Marketing Consent
Opt-out at any time via the one-click unsubscribe footer in our seasonal newsletters.
07.

International Data Transfers

Sky Tea ships to tea enthusiasts across Africa, North America, Europe, and Asia. When transferring data across borders to facilitate global logistics, we ensure our global partners implement Standard Contractual Clauses (SCCs) providing equivalent safeguards to those mandated by the Kenyan Office of the Data Protection Commissioner (ODPC).

08.Children's Privacy

Our website and products are oriented toward adults of legal age. We do not knowingly collect personal identifiers from children under 18 years of age without explicit parental consent.

09.Policy Updates & Notifications

Any material modifications to how we handle customer information will be announced with 14 days' advance notice via email and prominent site notices before enactment.