Privacy Policy

1. Data Controller

TerryWin Flowers, Cianda House, Koinange St, Nairobi, is the Data Controller. Contact our data contact: sales@terrywinflowers.com, +254 717 864 459. Complaints may also go to the Office of the Data Protection Commissioner (ODPC), Kenya.

2. What we collect & why (lawful basis)

• Order details — name, phone, email, delivery address, message-card note: to fulfil your contract (Art. 30(b)(i) — performance of a contract).
• Payment details — we do not currently accept online payments or store payment credentials. If an agreed payment method requires a reference, we use it only to confirm the order.
• Messages — WhatsApp, calls, contact form, reviews: to support you (legitimate interest / consent).
• Technical & analytics — device, pages, consent choice, purchase totals via GTM/GA4 only after you Accept cookies: consent (Art. 30(b)(vi)). Decline keeps essentials only.

3. Cookies & Consent Mode v2

We use essential cookies (cart, security, consent memory) and, only with your Accept, analytics/marketing cookies via Google Tag Manager. Our banner defaults to denied until you choose. You can change your choice anytime by clearing this site's storage or contacting us. We do not sell personal data.

4. Sharing

We share data only to deliver your order: riders/couriers (recipient name, phone, address), payment providers (to verify payment), and IT providers (hosting, email) under contracts. Safaricom / banks process payments on their own terms. We may disclose where required by Kenyan law.

5. Retention

Order records are kept up to 7 years for tax (Tax Procedures Act) and warranty handling, then deleted or anonymised. Marketing contacts are kept until you opt out. CCTV, if any in-store, is kept briefly for security.

6. Your rights

Under the Data Protection Act 2019 you may request access, correction, deletion, restriction, objection, portability, and to withdraw consent. We respond within 14 days. Email sales@terrywinflowers.com with subject "Data Request". You may complain to the ODPC if unsatisfied.

7. Children & sensitive data

Do not send national ID numbers, passwords or PINs. Our services are for adults placing orders; message-card notes should not include sensitive personal data about others without their consent.

8. Security & transfers

Our website uses HTTPS. Online payment is not currently available; please contact us before ordering. Analytics data (Google), when configured and consented to, may be stored outside Kenya with safeguards. Never share your M-Pesa PIN.

9. Changes

We will post updates here with a new date and, for material changes, notify you by email or site notice.