Privacy notice
This explains what personal data Toolsman collects, why we collect it, how long we keep it, and the rights you have under Kenya's Data Protection Act 2019.
Last updated 20 August 2026
Data controller: Toolsman, GoodHope Plaza, Nairobi, Kenya. Contact us about anything on this page at toolsmanstore@gmail.com or 0701 043 041.
What we collect and why
| Data | Why we need it | Lawful basis |
|---|---|---|
| Name and phone number | To take payment, to deliver, and to reach you about the order | Performance of a contract |
| Delivery address and landmark | So the rider or courier can find you | Performance of a contract |
| Email address | Order confirmation and receipt | Performance of a contract |
| M-Pesa transaction records | To confirm payment and resolve disputes | Legal obligation and legitimate interest |
| KRA PIN (trade customers) | To issue a compliant tax invoice | Legal obligation |
| Marketing preferences | To send price-drop and stock SMS if you asked for them | Consent |
Consent for marketing is separate
The marketing box at checkout is unticked by default and is not bundled with anything else. Order updates — payment confirmed, dispatched, delivered — are transactional messages needed to fulfil your order and are sent whether or not you opt in to marketing. You can opt out of marketing at any time by replying STOP or telling us.
How long we keep it
- Order and payment records: seven years, as tax law requires.
- Delivery addresses: three years from your last order, so reordering is quick.
- Marketing preferences: until you withdraw consent, then a record that you opted out.
- Abandoned carts: 30 days, then deleted.
Your rights
Under the Data Protection Act 2019 you have the right to:
- be told how your data is used — this notice;
- ask for a copy of the data we hold about you;
- have inaccurate data corrected;
- ask us to delete data, where we are not legally required to keep it;
- object to processing based on legitimate interest;
- withdraw consent for marketing at any time.
Email toolsmanstore@gmail.com to exercise any of these. We respond within 30 days. If you are not satisfied, you can complain to the Office of the Data Protection Commissioner (ODPC).
Cookies
We use a small number of strictly necessary cookies — one to remember what is in your cart, and one to keep you signed in if you have an account. Analytics cookies are off until you accept them, and declining them does not change how the site works.
Security
The site runs over HTTPS. Payment card details are never handled by us. Access to customer data is limited to staff who need it to fulfil orders. If a breach affects your data, we will tell you and the ODPC as the law requires.