At Elle Glamm Enterprise, your personal information deserves the same care we put into every piece we curate. This Privacy Policy explains what personal data we collect when you shop with us, how we use it, who we may share it with, and the rights you hold under Kenyan law — specifically the Data Protection Act, No. 24 of 2019.
By using our website, creating an account, or placing an order, you acknowledge that you have read and understood this policy. If you have questions, our contact details are at the end of this document.
Who we are: Elle Glamm is a retail fashion brand based in Nairobi, Kenya, selling high quality stylish handbags, genuine leather bags, premium watches and a wide range of accessories for both men and women. We act as the data controller in respect of the personal data you share with us.
01 Information We Collect
We collect information you provide directly and information gathered automatically when you use our website.
Information you give us:
- Your full name, email address, phone number and delivery address
- Account login credentials (email and password)
- Purchase history and wishlist items
- Payment method details — processed securely by our payment partners; we do not store your card or M-Pesa PIN
- Communications you send us, including customer service enquiries
- Your size preferences, style choices or product reviews (where provided)
Information collected automatically:
- Device type, browser type and IP address
- Pages visited, time spent on site and links clicked
- Referring website or search terms used to find us
- Cookie identifiers and similar tracking data (see Section 9)
We collect only what we need. Under Section 25(d) of the Data Protection Act, 2019, personal data must be adequate, relevant and limited to what is necessary for its purpose. We apply this principle to everything we collect.
02 How We Use Your Information
We use your personal information to:
- Process and fulfil your orders, including confirming payment and arranging delivery
- Create and manage your Elle Glamm account
- Send order confirmations, shipping updates and receipts
- Respond to your questions, complaints or returns requests
- Send promotional emails, lookbooks and special offers — only where you have opted in or where permitted by law
- Personalise your browsing experience and recommend products relevant to you
- Detect and prevent fraud or unauthorised account activity
- Improve our website performance, product range and customer experience
- Comply with our legal and regulatory obligations
We will not use your data for any purpose incompatible with the reason it was collected, in line with Section 30(2) of the Data Protection Act, 2019.
03 Legal Basis for Processing
Under the Data Protection Act, 2019 (Section 30), we may only process your personal data where we have a valid legal basis. For Elle Glamm, those bases are:
- Contract performance — processing your order and delivering your purchases requires us to use your name, address and contact details.
- Your consent — for marketing emails and non-essential cookies. You may withdraw consent at any time without affecting past processing.
- Legal obligation — keeping financial records for tax and regulatory purposes.
- Legitimate interests — fraud prevention, website security and improving our services, where these interests are not overridden by your rights.
Where we rely on your consent, you may withdraw it at any time by contacting us or clicking the unsubscribe link in any marketing email.
04 Sharing Your Information
We do not sell your personal data. We share it only where necessary, with the following categories of recipients:
- Delivery and logistics partners — to arrange dispatch and track your orders
- Payment processors — to securely handle transactions (M-Pesa, card processors, etc.). These providers comply with PCI-DSS security standards
- Technology and platform providers — who support our website, email systems and order management tools
- Customer support tools — used to manage enquiries and returns
- Legal and regulatory authorities — where required by law, court order, or to protect the rights and safety of Elle Glamm, our customers or others
- Business transfers — in the event of a merger, acquisition or sale of the business, your data may transfer to the new owner, who will be bound by equivalent privacy obligations
All third parties we work with are contractually required to handle your data only as instructed by us and to maintain appropriate security measures, in accordance with Section 42(2) of the Data Protection Act, 2019.
05 Transfers Outside Kenya
Some of our third-party service providers (such as cloud platforms or email delivery services) may process your data outside of Kenya. Where this occurs, we take steps to ensure an adequate level of protection is in place.
In accordance with Section 48 of the Data Protection Act, 2019, we only transfer personal data abroad where:
- The receiving country has data protection laws comparable to Kenya's, or
- We have put appropriate contractual safeguards in place with the recipient, or
- The transfer is necessary to perform your order or service contract with us
By using our website and placing orders, you acknowledge that such transfers may occur under these safeguards.
06 How Long We Keep Your Data
We retain your personal data only for as long as is reasonably necessary (Section 39, Data Protection Act, 2019):
- Active account data — held for as long as your account remains open
- Order and transaction records — retained for 7 years to meet Kenyan tax and financial reporting obligations
- Marketing preferences — until you withdraw consent or unsubscribe
- Customer service correspondence — up to 3 years from the date of last interaction
- Website analytics data — held in aggregated, anonymised form
When data is no longer required, we will securely delete, anonymise or pseudonymise it so that you can no longer be identified from it.
07 Your Data Protection Rights
Under Section 26 of the Data Protection Act, 2019, you have the following rights:
| Your Right |
What It Means |
| Right to Be Informed |
You have the right to know what data we hold and how we use it. |
| Right of Access |
You may request a copy of the personal data Elle Glamm holds about you at any time. |
| Right to Correct |
If any information we hold is inaccurate or incomplete, you can ask us to correct it without delay. |
| Right to Delete |
You may ask us to erase personal data where there is no longer a lawful reason to retain it. |
| Right to Object |
You can object to processing for direct marketing or where we rely on legitimate interests. |
| Right to Portability |
You may request your data in a structured, machine-readable format to transfer elsewhere (Section 38). |
To exercise any of these rights, contact us using the details in Section 12. We will respond within 30 days.
How to complain: If you feel your rights have been violated, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke. You may also approach the High Court of Kenya for relief under Section 64 of the Data Protection Act, 2019.
08 Children's Privacy
Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from minors.
In accordance with Section 33 of the Data Protection Act, 2019, where a child (under 18) accesses our website, we require parental or guardian consent before processing their personal data. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately and we will remove that information.
09 Cookies & Tracking
Our website uses cookies and similar tracking technologies to improve your experience. A cookie is a small file placed on your device when you visit our site.
We use:
- Essential cookies — required for the website to function (e.g., keeping items in your cart, managing your login). These cannot be disabled.
- Functional cookies — remember your preferences such as your size, language or recently viewed items.
- Analytics cookies — help us understand how visitors use our site so we can improve it. We use anonymised aggregate data only.
- Marketing cookies — used (with your consent) to show you relevant Elle Glamm adverts on other platforms.
You may manage your cookie preferences through our cookie consent tool or your browser settings. Disabling certain cookies may affect your experience on our website.
10 Security & Data Breaches
We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, alteration or disclosure — including secure server environments, encrypted data transmission (SSL/TLS), and internal access controls.
No method of transmission over the internet is completely secure. While we take every reasonable precaution, we cannot guarantee absolute security.
In the event of a data breach that poses a real risk of harm to you, we will:
- Notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach (Section 43(1)(a), Data Protection Act, 2019)
- Inform you directly in writing within a reasonable period, unless your identity cannot be established
- Provide details of what happened, what data was affected, and steps you can take to protect yourself
11 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our business, technology or legal requirements. When we make material changes, we will:
- Update the "Last updated" date at the top of this document
- Notify you by email (where you have provided your address) or by displaying a prominent notice on our website
We encourage you to review this policy periodically. Continued use of our website after any update constitutes your acknowledgement of the revised policy.
