Legal · East Africa Packaging
Privacy Policy
Last updated: 17 September 2026
About This Privacy Policy
This Privacy Policy explains how East Africa Packaging collects and processes your personal data when you visit our website, create an account, place an order, or contact us. It describes what data we hold, why we hold it, who we may share it with, and the rights you have over your own information.
We take privacy seriously. We collect only what we need, use it only for the purposes described in this policy, and never sell your personal data to third parties.
We comply with the Kenya Data Protection Act, 2019 and the regulations made under it. By using our website you agree to the collection and use of your information as described in this policy.
Who We Are & Data Controller
East Africa Packaging is a premium packaging supplier operating from Kenya House Complex, Koinange Street, Nairobi, Kenya. We operate the website at eastafricapackaginghub.co.ke and related mobile-accessible services.
For the purposes of the Kenya Data Protection Act, 2019, East Africa Packaging is the data controller responsible for the personal data collected through our website - meaning we determine the purposes and means of processing your personal data.
If you have any questions about how we handle your data, or wish to exercise any of your rights, contact us using the details in the final section of this policy.
Information We Collect About You
Personal data means any information that can be used to identify you, directly or indirectly. We collect the following categories:
A. Information you provide directly
- Account registration: name, email address, and password (stored as a secure one-way hash - never in plain text).
- Orders: billing and delivery address, phone number, order contents, and order value.
- Contact form: name, email, phone number, subject, and message.
- Reviews & wishlist: ratings, feedback, and products you save while logged in.
- Marketing preferences: whether you wish to receive promotional communications.
B. Information collected automatically
- IP address: used for rate-limiting, fraud prevention, and abuse detection.
- Session data: your cart contents and login state stored in a server-side session.
- Device & usage data: device, browser, pages visited, and products viewed - used to improve the website.
C. Information we do NOT collect
- Full card numbers, CVV/CVC codes, or M-Pesa PINs - these go directly to the payment processor and never pass through our servers.
- Government ID or passport numbers.
- Sensitive personal data (health, religion, ethnicity, biometric) as defined under the Act.
Sign in with Google & Google User Data
Our website offers Sign in with Google as an optional, faster way to create an account or log in. If you choose it, Google shares with us only your basic profile information: your name, email address, and Google account identifier.
We use this information solely to create your customer account, sign you in securely, link your orders to your account, and send you emails about your own orders and account activity. We do not receive your Google password, contacts, files, or any other content from your Google account, and we never post anything on your behalf.
- Google user data is never sold, rented, or shared with advertisers, data brokers, or any other third party.
- It is not used for advertising, profiling, or to train AI/machine-learning models.
- It is stored securely alongside your account data and protected by the safeguards described in this policy.
- It is retained and deleted under the same rules as your account data - request deletion at any time via info@eastafricapackaginghub.co.ke.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
You can disconnect our website from your Google account at any time from your Google Account's Security → Third-party access page. Doing so does not delete your customer account with us - contact us if you would like it removed entirely.
How We Use Your Information
We collect and use your personal data to register you as a customer; fulfil and communicate about your orders; provide customer support; manage your account; run promotions or surveys you opt into; improve the website; prevent fraud and abuse; and comply with Kenyan tax and commercial law.
With your consent only, we may send you updates about new products, promotions, or offers. You can unsubscribe at any time via the link in any marketing email or by contacting us.
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
AI & Automated Processing
We do not use your personal data to train artificial-intelligence or large-language models, and we never sell or share your data for that purpose.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you. Any recommendation or analytics features we use are limited and never decide outcomes such as pricing or order acceptance on their own.
Where we use third-party tools that may involve automated processing (for example analytics or fraud-screening), those providers act as our processors under data-protection agreements and may not use your data for their own purposes.
Legal Basis for Processing
Under the Kenya Data Protection Act, 2019, we must have a lawful basis to process your personal data. Depending on the purpose, we rely on one or more of the following:
- Consent - e.g. when opting in to marketing. You may withdraw it at any time.
- Performance of a contract - to process your order, manage delivery, and provide support.
- Legitimate interests - to understand customers, improve services, and prevent fraud, balanced against your privacy rights.
- Legal obligation - to retain transaction records under tax law and respond to valid legal requests.
How Payments Are Handled
We accept M-Pesa and bank transfer. Payments are handled by third-party processors or your bank, and your financial credentials are never stored on our servers.
M-Pesa: a payment prompt is sent directly to your phone by Safaricom. You enter your PIN on your own device - it is never transmitted to or accessible by us. We only receive a transaction confirmation reference.
Bank transfer: payments are made directly from your bank to ours through standard encrypted channels. We receive only the incoming transfer record to match against your order.
We will never ask for your M-Pesa PIN or banking password through any channel. If anyone claiming to be from East Africa Packaging asks for this, report it to us immediately at info@eastafricapackaginghub.co.ke.
Who We Share Your Data With
We do not sell, rent, or trade your personal data. We share it only where strictly necessary:
- Courier & delivery partners: your name, phone number, and delivery address, to fulfil your order.
- Payment processors: Safaricom processes M-Pesa transactions and receives only what is required.
- IT & service providers: hosting, email delivery, and analytics, under data-processing agreements.
- Legal authorities: where required by a valid court order or law-enforcement request.
- Business transfers: if we sell or transfer part of our business, with notice where required.
We never share your data with advertisers, data brokers, or marketing companies.
Third-Party Links
Our website may contain links to third-party websites, social media pages, or payment providers. This Privacy Policy applies only to our website.
We are not responsible for the privacy practices or content of external sites. We encourage you to review their own privacy policies before sharing any information with them.
International Transfers of Your Data
Our primary operations and data storage are based in Kenya. However, some third-party providers (such as cloud hosting or email delivery) may process data in other countries.
Where we transfer your data outside Kenya, we take steps to ensure it receives a comparable level of protection to that required under the Kenya Data Protection Act, 2019, including using providers in countries with adequate standards and requiring contractual data-protection commitments.
How Long We Keep Your Data
We retain your personal data only for as long as necessary for the purposes described in this policy:
- Order records: retained for 7 years as required by Kenyan tax regulations.
- Account data: retained while your account is active; on a deletion request we remove your personal data within 30 days, except where retention is required by law.
- Contact messages: retained up to 12 months, then deleted.
- Session & fraud records: expire automatically on a short rolling cycle.
How We Protect Your Data
We have put in place appropriate technical and organisational measures to protect your personal data, including:
- Password hashing - passwords are stored as one-way cryptographic hashes, never in plain text.
- HTTPS encryption - all data between your browser and our website is encrypted with TLS.
- Access controls - access is restricted to staff with a legitimate need, under confidentiality obligations.
- Payment isolation - payment credentials are never transmitted through our systems.
In the event of a personal data breach likely to result in a risk to your rights, we will notify you and the Office of the Data Protection Commissioner of Kenya as required. No method of transmission or storage is 100% secure, but we use commercially reasonable measures to protect your data.
Your Rights Under the Data Protection Act 2019
As a data subject under Kenyan law, you have the right to access your data; correct inaccurate data; request erasure; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time.
To exercise any of these rights, contact us at info@eastafricapackaginghub.co.ke. We will respond within 21 days as required by the Act, and may ask you to verify your identity first.
If you believe we have handled your data unlawfully, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya.
Your Privacy Choices
You are in control of your data. You can:
- Marketing: opt out at any time via the unsubscribe link in any marketing email, or by contacting us.
- Cookies: manage or delete cookies through your browser settings (disabling essential cookies affects login and checkout).
- Your account: update your details in your account dashboard, or request deletion to remove your profile data.
- Access & corrections: request a copy of your data or ask us to correct it - see "Your Rights Under the Data Protection Act 2019".
Children Under 18
Our website and services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, applicable law, or best practices. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify registered account holders by email.
Continued use of our website after changes are posted constitutes your acceptance of the updated policy.
Privacy Enquiries
For any questions, requests, or concerns about this policy or how we handle your personal data, contact us:
Email: info@eastafricapackaginghub.co.ke
Phone: +254 704 736 664
Address: Kenya House Complex, Koinange Street, Nairobi, Kenya
We will investigate any complaint about how we manage personal data and respond to all substantiated complaints within 21 days as required by the Kenya Data Protection Act, 2019.
Questions about this policy? Contact us and our team will be happy to help.