01
Overview & Legal Framework
Mambo Pawsitory Ltd operates the digital storefront and artisan fulfillment hub reachable via
mambopawsitory@gmail.com. We act as a certified Data Controller under Section 2 of the
Kenya Data Protection Act, 2019 (Act No. 24 of 2019).
This document explains the lifecycle of all information captured during your interactions
with our storefront, subscription services, customized pet accessories, and delivery
operations across the Nairobi Metropolitan Area and upcountry Kenya. We believe privacy is an
intrinsic dimension of good craftsmanship.
⚖️ GOVERNING PRINCIPLES OF PROCESSING
1. Lawfulness & Fairness
Processed with clear, prior consent and explicit legitimate intent.
2. Purpose Limitation
Collected strictly for pet supply curation, fulfilment & order
updates.
3. Data Minimization
No extraneous personal telemetry is sought or archived.
02
Information We Collect
To assemble bespoke leather collars, custom-portioned treats, and seamless same-day drops, we
process three clear categories of data:
👤
Customer Identity & Contact
Directly Provided
Full legal name, active telephone number (for M-Pesa push prompts and dispatch
coordination), billing address, and electronic mail address for instant invoices.
🐾
Pet Profiles & Sizing Specs
Lifestyle Tailoring
Pet name, breed, weight category, chest circumference (cm), dietary sensitivities
(e.g. grain-free, chicken protein intolerance), and age bracket used to configure
recurring treat boxes and ergonomic harnesses.
📍
Geographical Drop Coordinates
Delivery Logistics
Estate name, apartment/house number, street address, postal landmarks, and GPS pin
drop (via Google Maps Places API) to facilitate rapid Nairobi motorcycle courier
route planning.
03
How We Use Your Data
Every data point collected serves an explicit operational purpose. We never sell, lease, or
monetize customer or pet records to commercial brokers.
📦 Order Fulfillment
Generating order receipts, calculating tailored size recommendations,
laser-engraving pet name tags, and batching orders for kitchen dispatch.
💬 SMS & WhatsApp Notifications
Real-time order dispatch notifications, rider ETA tracking links, and
auto-reminders for scheduled wellness replenishments.
🛡 Fraud Prevention
Mitigating unauthorized card attempts, reversing duplicate M-Pesa STK queries, and
preserving cryptographic transaction trails.
🧾 Statutory Tax Records
Fulfilling Kenya Revenue Authority (KRA) eTIMS invoicing requirements and standard
commercial bookkeeping standards.
04
Payment Security (Paystack & M-Pesa)
🛡 ZERO RAW STORAGE GUARANTEE
We never touch, view, or store your credit card CVV, full
16-digit card number, or private M-Pesa PIN.
All checkout interactions are initiated via tokenized interfaces governed by licensed
financial technology providers regulated by the Central Bank of Kenya (CBK).
M-PESA / SAFARICOM
📱
Direct STK Push Protocol
When choosing M-Pesa, an instantaneous STK push prompt is dispatched to your
registered Safaricom handset via the official Daraja API. Your personal PIN is
entered exclusively on your handset's encrypted SIM application toolkit. Mambo
Pawsitory receives only the confirmation receipt, amount, and Safaricom Transaction
ID (e.g. SKG47BY211).
VISA / MASTERCARD
💳
Paystack PCI-DSS Level 1
Card payments are routed through Paystack Payments Ltd, certified under Payment
Card Industry Data Security Standard (PCI-DSS) Level 1. Card numbers are instantly
transformed into irreversible algorithmic tokens. Neither our team nor our
databases can decipher your card expiry or security code.
CRYPTOGRAPHIC TOKENIZATION LIFECYCLE
👤 User Terminal
⇄
🔐 Paystack 256-Bit Encryption
⇄
✅ Tokenized Callback
05
Third-Party Sharing & Courier Dispatch
We uphold a strict principle of least-privilege information routing. When your artisanal pet
package leaves our fulfillment desk, only strictly essential logistical fragments are
delegated.
The Vetted Rider Protocol
We contract vetted Nairobi logistics networks (including Sendy, Glovo Courier Logistics,
and our direct in-house fleet). Riders receive a restricted dispatch manifest:
✅ What Dispatch Riders See
- First Name & Phone Contact (for gate clearance)
- Designated Delivery Location & Estate Pin
- Special Drop-off Instructions ("Leave with security at Gate B")
❌ What Riders Never See
- Billing or card payment details
- Customer order history or financial totals
- Full profile credentials or personal email
_ctsU-qTt3t.jpg)
Data Erasure from Rider Devices
Waybills printed on parcel exteriors use redacted phone digits (e.g. +254 7** ***
892) to avoid scope in transit. Digital manifest tasks automatically close and scrub
customer addresses from rider devices once status is marked as "Delivered".
06
Cookies & Local Storage
We employ lightweight session tokens and localized browser cookies strictly required to
ensure your cart remembers your pet's selected collar size and keep your shopping bag
persistent.
| COOKIE CATEGORY |
OPERATIONAL ROLE |
LIFESPAN |
Essential Session (mp_cart_sess) |
Stores active shopping bag items and checkout steps. |
7 Days |
Pet Preference (mp_pet_pref) |
Remembers previously toggled Dog vs. Cat curation. |
30 Days |
Security & CSRF (mp_auth_csrf) |
Prevents Cross-Site Request Forgery during payment submission. |
Session End |
07
Data Retention Schedules
We retain personal data only for as long as necessary to complete the operational purpose for
which it was sourced, or to satisfy legal, statutory tax, and accounting mandates in Kenya.
Tax & Fiscal Records
7 YEARS STATUTORY HOLD
Sales logs, eTIMS invoices, and VAT reconciliations are preserved for 7 years in
compliance with the Kenya Revenue Authority Tax Procedures Act.
Inactive Accounts
24-MONTH PURGE CYCLE
Pet profiles, customer measurement logs, and addresses linked to dormant accounts
without purchase activity for 24 continuous months are scrubbed from live
databases.
08
Your Legal Rights Under KDPA 2019
Section 26 of the Kenya Data Protection Act awards explicit, enforceable entitlements to
every customer:
👁
Right to Access
You may petition for an electronic copy of all personal and pet telemetry files
currently archived in our systems.
✏️
Right to Rectification
Easily update incorrect phone numbers, moved addresses, or modified pet dietary
allergies via your profile or customer support.
🗑
Right to Erasure ("Right to be Forgotten")
Demand complete destruction of your profile where ongoing retention is no longer
justified under Kenyan commercial statutes.
🚫
Right to Object & Restrict
Opt out of SMS seasonal promotional broadcasts with immediate effect via the
automated UNSUBSCRIBE token or an email to our DPO.
09
Children's Privacy
Mambo Pawsitory designs high-end goods for adult pet parents. In strict harmony with Section
33 of the Kenya Data Protection Act, our platform does not knowingly request or gather
personal data from individuals aged under 18 years without verifiable consent from a parent
or legal guardian.
⚠️
If you suspect that a minor has submitted unauthorized personal info to our checkout or
membership program, notify our Data Protection Officer immediately for swift purge.
10
Data Protection Officer (DPO) Contact
We have formally appointed a resident Data Protection Officer to supervise all compliance
frameworks, conduct periodic data protection impact assessments, and liaise with the Office
of the Data Protection Commissioner (ODPC).
📞 Regulatory Phone Desk
+254-115-315-542
Monday through Friday, 08:30 – 17:00 EAT.
Submit an Instant Statutory Request
Trigger an automated verification flow for personal data extract generation,
rectification, or account decommissioning.
