Privacy Policy

This is a starter policy drafted for review. It is not legal advice. Please have it checked and edit it in the dashboard (Site settings) before the site goes live.

## Who we are
This website is run by Beam Brand, a branding business based in Kisii, Kenya ("we", "us"). We decide how and why your personal data is used, so we are the data controller. Contact details are on our Contact page.

## What information we collect
- Account details: your name, email address, mobile number and an encrypted version of your password.
- Messages you send us through the contact form: your name, email, phone number (optional), your message, and the IP address it was sent from.
- Orders and quote requests (when these features are available): the items, delivery details and contact information you give us.
- Payment details: when you pay with M-Pesa we receive the phone number, amount and transaction reference. We never see or store your M-Pesa PIN or card numbers.
- Technical data: essential cookies that keep you signed in and protect forms from forgery.

## How we use your information
- To run your account and respond to your messages.
- To process and deliver orders and confirm payments.
- To keep the site secure and prevent abuse.
- To meet our legal and accounting obligations.

We do not sell your personal data.

## Cookies
We use only essential cookies, for example to keep you logged in and to protect forms. We do not use advertising or tracking cookies.

## Who we share data with
We share data only where needed to provide our service, for example with Safaricom (M-Pesa) to process payments, our web hosting provider, and delivery partners when you ask us to deliver an order. We may also disclose information where the law requires it.

## How long we keep it
We keep information only as long as needed for the purposes above, including legal and accounting requirements. Contact messages are kept until we have dealt with your request and for a reasonable period afterwards.

## Your rights
Under the Kenya Data Protection Act, 2019, you may ask to see the personal data we hold about you, correct it, ask us to delete it, or object to how we use it. To make a request, contact us using the details on our Contact page.

## Security
Access to personal data is limited to authorised staff, passwords are stored in encrypted form, and the site uses secure connections.

## Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last changed.