0718 414 222 workshop@montessoriforkenya.org Mon - Fri: 9:00 - 18:00

Privacy Policy

This policy is a plain-language draft for the shop owner to review before launch. It is not legal advice.

Who we are

Montessori For Kenya (“we”) runs this online shop. We are the data controller for the personal data described below. Contact: workshop@montessoriforkenya.org, 0718 414 222.

What we collect and why

  • Orders: your name, email, phone number, delivery address and what you ordered, so we can take payment, deliver and support your order. We keep order records for seven years for accounting and tax purposes.
  • M-Pesa payments: the phone number you enter and the transaction result, shared with Safaricom to process the payment. We never see your M-Pesa PIN.
  • Account: if you create one, your name, email, phone and a securely hashed password, so you can see your orders.
  • Messages: what you send through the contact form, to reply to you. Messages are deleted after 24 months.
  • Technical data: a hashed form of your IP address for security and abuse prevention (rate limits, fraud checks). Cloudflare Turnstile checks that forms are used by people.
  • Approximate location: on your first visit we may look up the country of your IP address (using the ipwho.is service, or Cloudflare's country header) only to show prices in a suitable currency and pre-select your delivery country. We keep a hashed copy of the result for 30 days, and you can change the currency at any time.

Who we share it with

Only the providers needed to run the shop: Safaricom (M-Pesa), our email provider, our hosting provider, Cloudflare (Turnstile), and couriers who deliver your order. We do not sell your data and we do not run advertising or analytics tracking.

Cookies

We set only the cookies the shop needs; see the Cookie Policy.

Your rights

Under the Kenya Data Protection Act, 2019 you may ask to see, correct or delete your personal data, object to its use, or ask for a copy. Email workshop@montessoriforkenya.org and we will respond within 30 days. You may also complain to the Office of the Data Protection Commissioner.

Security

The shop is served over HTTPS, passwords are hashed, and staff accounts are protected with two-factor authentication.

Last updated: 26/10/2026