Privacy Policy

EUROFIT HEALTH & BEAUTY LTD
Effective Date: 18 June 2026
Last Updated: 18 June 2026

This Privacy Policy explains how Eurofit Health & Beauty Ltd collects, uses, shares, stores, and protects your personal data when you use our website, create an account, or buy from us. We are committed to handling your personal data lawfully, fairly, and transparently, in line with the Data Protection Act, 2019 of Kenya.

Please read this Policy together with our Terms of Service. By using our website or placing an order, you acknowledge that you have read and understood this Policy.

1. Who We Are (Data Controller)

Eurofit Health & Beauty Ltd is the data controller responsible for your personal data.

• Registered Name: Eurofit Health & Beauty Ltd
• Company Number: PVT-271JVEWL
• KRA PIN: P052430670Y
• Registered Office: Sixth Street Tower, Sixth Street, Eastleigh, Starehe, Nairobi County
• Postal Address: P.O. Box 8047–00610, Nairobi, Kenya
• Email: [email protected]
• Phone: +254 110 990 666

For any privacy questions or to exercise your rights, contact us at [email protected].

2. What This Policy Covers

This Policy covers personal data we collect when you:

• Visit or browse our website.
• Create or manage an account.
• Place an order or make a payment.
• Contact our customer support.
• Sign up for marketing communications.
• Interact with us in any other way connected to our services.

3. Personal Data We Collect

We collect the following categories of personal data:

3.1 Information you give us:

• Identity and contact details — name, email address, phone number, and delivery and billing addresses.
• Account details — your username and password (stored securely; we never store passwords in plain text).
• Order information — the products you buy, order history, and preferences.
• Communications — messages, enquiries, complaints, and feedback you send us.
• Marketing preferences — your consent to receive marketing and your contact preferences.

3.2 Information we collect automatically:

• Technical data — IP address, browser type and version, device information, and operating system.
• Usage data — pages viewed, products browsed, time spent, and how you navigate the website.
• Cookies and similar technologies — see Section 9 below.

3.3 Payment information:

When you pay, your card or mobile money details are collected and processed directly by our payment provider, Paystack. We do not receive or store your full card details. We only receive confirmation of payment status and limited transaction information needed to manage your order.

We do not intentionally collect sensitive personal data (such as health information) beyond what you voluntarily share, for example if you tell us about an allergy when asking about a product.

4. How and Why We Use Your Data (Lawful Basis)

Under the Data Protection Act, 2019, we must have a lawful basis for processing your personal data. We use your data for the following purposes:

PurposeLawful Basis

To create and manage your account

Performance of a contract

To process and fulfil your orders

Performance of a contract

To take payment via Paystack

Performance of a contract

To arrange delivery through our couriers

Performance of a contract

To provide customer support and handle complaints

Performance of a contract; legitimate interest

To send order and account updates (transactional messages)

Performance of a contract

To send marketing communications

Your consent

To detect, prevent, and investigate fraud and abuse

Legitimate interest; legal obligation

To meet tax, accounting, and legal requirements

Legal obligation

To improve our website, products, and services

Legitimate interest

You can withdraw your consent to marketing at any time (see Section 8). Withdrawing consent does not affect processing we carry out to fulfil your orders or to meet our legal obligations.

5. Who We Share Your Data With

We do not sell your personal data. We share it only with the service providers and parties needed to run our store and fulfil your orders, and where required by law. These include:

5.1 Service providers (data processors) who process data on our behalf under appropriate agreements:

• Paystack — payment processing. Handles your payment securely; Paystack acts as its own controller for payment data under its terms and privacy policy.
• Email service provider — used to send transactional emails (order confirmations, verification, password resets) and, where you consent, marketing emails.
• Hosting and storage providers — used to host our website and store data and uploaded files securely.
• Security and anti-fraud providers — including bot-protection and verification tools used to keep our forms and checkout secure.
• Courier and logistics partners — provided with the delivery details necessary to deliver your order.

5.2 Professional advisers and authorities — such as accountants, auditors, lawyers, or regulators, where reasonably necessary or required by law.

5.3 Business transfers — if our business is reorganised, merged, or sold, your data may be transferred to the new owner, subject to this Policy.

Each provider is permitted to use your data only for the specific service they provide to us, and not for their own unrelated purposes.

6. International Data Transfers

Some of our service providers (including our payment, email, hosting, storage, and security providers) operate or store data on servers located outside Kenya. This means your personal data may be transferred to and processed in other countries.

Where we transfer personal data outside Kenya, we take reasonable steps to ensure it is protected to a standard consistent with the Data Protection Act, 2019, for example by relying on providers that offer appropriate safeguards, contractual protections, or where you have given consent. By using our website and services, you understand that your data may be processed outside Kenya for the purposes described in this Policy.

7. How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purposes set out in this Policy, including to:

• Fulfil your orders and provide our services.
• Comply with tax, accounting, and other legal obligations (for example, transaction records are typically retained for the period required by Kenyan law).
• Resolve disputes and enforce our agreements.

When your data is no longer needed, we will securely delete or anonymise it. If you close your account, we may retain certain information where we have a legal obligation or legitimate need to do so.

8. Your Rights

Under the Data Protection Act, 2019, you have the following rights in relation to your personal data:

• Right to be informed — to know how your data is collected and used (this Policy).
• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to request deletion of your data where there is no lawful reason to keep it.
• Right to object — to object to certain processing, including direct marketing.
• Right to restrict processing — to ask us to limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used format where applicable.
• Right to withdraw consent — to withdraw consent for processing based on consent (such as marketing) at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by law. We may need to verify your identity before acting on your request.

You can opt out of marketing at any time using the unsubscribe link in our emails or by contacting us. This will not affect transactional messages necessary to service your orders.

9. Cookies and Similar Technologies

9.1 Our website uses cookies and similar technologies to make the site work, keep you signed in, remember your cart and preferences, protect against fraud and abuse, and understand how the site is used.

9.2 We use:

• Essential cookies — required for the website to function, including your session and guest cart. These cannot be switched off.
• Security cookies — used by our bot-protection and verification tools to secure forms and checkout.
• Functional and analytics cookies — used to remember preferences and to understand and improve how the website performs.

9.3 You can control or delete cookies through your browser settings. Blocking essential cookies may affect how the website works, including your ability to log in or complete checkout.

10. Data Security

10.1 We take reasonable technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These include encrypted connections, access controls, secure password storage, and use of reputable service providers.

10.2 Payment data is handled by Paystack using industry-standard security; we do not store your full card details.

10.3 While we work hard to protect your data, no method of transmission or storage over the internet is completely secure. You are responsible for keeping your account password confidential and for any activity under your account.

11. Children's Privacy

Our website and products are intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will take reasonable steps to delete it.

12. Third-Party Links

Our website may contain links to third-party websites or services. This Policy does not apply to those sites. We are not responsible for the privacy practices of third parties, and we encourage you to read their privacy policies before sharing your data with them.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or the law. The updated version takes effect when posted on the website, and the "Last Updated" date will be revised. Where changes are significant, we will make reasonable efforts to notify you. Please review this Policy periodically.

14. Complaints and Contact

14.1 If you have any questions, concerns, or requests about this Policy or how we handle your personal data, please contact us first:

• Email: [email protected]
• Phone: +254 110 990 666
• Address: Sixth Street Tower, Sixth Street, Eastleigh, Starehe, Nairobi, P.O. Box 8047–00610, Kenya

14.2 If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya, the supervisory authority responsible for data protection.