Last updated: 25 August 2026

This policy explains what personal data Verlin Naturals collects, why we collect it, and what you can do about it. We handle personal data in line with the Data Protection Act, 2019.

Who we are

Verlin Naturals is the data controller for the personal data described here.

What we collect

When you place an order

  • Your name, phone number and email address
  • Your delivery address
  • What you ordered and what you paid
  • Your M-Pesa transaction reference

We do not see, receive or store your M-Pesa PIN, and we never ask for it. Anyone claiming to be from Verlin Naturals and asking for your PIN is not from us.

When you create an account

Your name, email address, phone number, saved addresses and order history. Your password is stored encrypted and is not visible to us.

When you contact us

Your name, contact details and whatever you tell us in your message, so we can answer and keep a record of the conversation.

When you subscribe to our newsletter

Your email address, and your name if you give it.

When you browse the site

Your IP address, browser and device type, pages visited and referring site. This is collected through cookies and similar technologies.

Why we use it

Purpose Basis
Processing and delivering your order Performance of our contract with you
Confirming payment and handling refunds Performance of our contract with you
Answering your questions and providing support Performance of our contract, and our legitimate interests
Keeping accounting and tax records Legal obligation
Sending marketing emails Your consent
Improving the website and preventing fraud Our legitimate interests

Who we share it with

We do not sell your personal data. We share it only with parties who need it to run the service:

  • Courier and delivery companies, who need your name, address and phone number to deliver your order
  • Safaricom (M-Pesa), to process and confirm payment
  • Our web host and IT providers, who store the site and its data on our behalf
  • Our email and newsletter provider, if you have subscribed
  • Government authorities, where the law requires it

Some of these providers store data outside Kenya. Where that happens, we take reasonable steps to ensure your data remains protected to a comparable standard.

How long we keep it

  • Order and transaction records: seven years, to meet tax and accounting requirements
  • Account details: until you ask us to close your account
  • Support messages: two years
  • Newsletter subscriptions: until you unsubscribe
  • Website analytics: up to 26 months

Cookies

Cookies are small files stored by your browser. We use them to keep your cart and session working, to remember your preferences, and to understand how the site is used so we can improve it.

Cookies that keep the cart and checkout working are necessary for the site to function. Others are optional, and you can decline them through the banner shown when you first visit. You can also block or delete cookies in your browser settings, though blocking necessary cookies will stop checkout working.

Your rights

Under the Data Protection Act, 2019 you have the right to:

  • Ask what personal data we hold about you and receive a copy
  • Have inaccurate data corrected
  • Ask us to delete your data, where we are not required to keep it
  • Object to processing based on our legitimate interests
  • Withdraw consent to marketing at any time
  • Ask us to restrict how we use your data while a concern is resolved
  • Receive your data in a portable format

To exercise any of these, email buy@verlinnaturals.com or call 0718 218 217. We will respond within the timeframe set by law. We may ask you to verify your identity first, so that we do not disclose your data to someone else.

If you are unhappy with how we have handled your data, you may complain to the Office of the Data Protection Commissioner.

Marketing

We only send marketing emails to people who have opted in. Every email includes an unsubscribe link, and you can also reply to any of them or email us to be removed. Unsubscribing from marketing does not stop transactional messages about orders you have placed.

Security

The site uses HTTPS encryption. Access to customer data is limited to people who need it to do their job, and passwords are stored encrypted. No system is completely secure, but we take reasonable measures to protect your data and will notify you and the relevant authority if a breach occurs that is likely to affect your rights.

Children

This website is not intended for children under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Changes

We may update this policy. The date at the top shows when it last changed. Significant changes will be flagged on the website.

Contact

Questions about this policy or your data can go to buy@verlinnaturals.com, or Iconic Business Place, Moi Avenue, Shop B5, Nairobi.