Privacy Policy

DRAFT — not yet legally reviewed. This page is an AI-assisted first draft prepared to give our lawyer a concrete starting point. It has not been reviewed or approved for accuracy or compliance and must not be relied on as final until that review is complete and this notice is removed.

Last updated: [DATE PENDING — set when this page is approved for publication].

This policy explains what information Out of Box Tools & Hardware ("we", "us") collects when you visit outofboxtools.com or contact us, why we collect it, and the rights you have over it under Kenya's Data Protection Act, 2019 ("the DPA").

Who we are

Out of Box Tools & Hardware, Jampark Plaza, along Ngong Road, Nairobi, Kenya. Email: info@outofboxtools.com. Phone/WhatsApp: +254 110 264532. We are the data controller for the information described below.

[OWNER/LAWYER TO CONFIRM: registration status with the Office of the Data Protection Commissioner (ODPC) Kenya, and registration number if registered. Do not publish this page claiming ODPC registration until that status is confirmed.]

What we collect, specifically

We do not run an on-site contact form or account system. Data reaches us through exactly these channels:

  • Direct contact. If you email info@outofboxtools.com or call/WhatsApp +254 110 264532, we receive whatever you send us directly (name, phone number, email address, and the content of your message) in our email inbox or WhatsApp Business account. This is not collected via our website — the site only provides clickable links (`mailto:`, `tel:`, and `wa.me`) that open your own email or WhatsApp app.
  • Website analytics cookies (Google Analytics 4, via Google Tag Manager). If you accept cookies, Google Analytics collects standard usage data: pages viewed, approximate location (city-level, from IP address), device/browser type, referring site, and on-site actions we explicitly track (WhatsApp button clicks, product views). We do not collect your name or email through this.
  • Advertising cookies (Meta Pixel). If you accept cookies, the Meta Pixel records that you visited the site and which pages/products you viewed, so we can measure the performance of Facebook/Instagram ads and show ads to people with similar interests. This is shared with Meta (Facebook, Instagram, WhatsApp's parent company) under Meta's own terms.
  • Google Tag Manager (GTM). GTM is the delivery mechanism for the analytics and advertising tags above — it does not itself collect additional data beyond what those tags collect.
  • A cookie-consent record. When you accept or decline cookies, we store that choice in your browser's local storage (not a cookie, not sent to us or anyone else) so we don't ask again every visit.

We do not use cookies to track you before you consent. Analytics and advertising scripts are not loaded on your device at all until you click Accept on the cookie banner.

Why we collect it (legal basis under the DPA)

  • Direct contact data: processed to respond to your enquiry or order — necessary to take steps at your request before a possible sale (contract-related legitimate interest).
  • Analytics and advertising cookies: processed only on the basis of your consent, given via the cookie banner. You can withdraw consent at any time — see "Your choices" below.

Where your data is stored

Analytics and advertising data (if you consent) is processed by Google and Meta on their own infrastructure, which involves transferring data outside Kenya (Google and Meta both process data in the United States and the European Union, among other locations, under their respective data transfer safeguards). Direct emails and WhatsApp messages are stored in our own email and WhatsApp Business accounts.

How long we keep it

[OWNER TO CONFIRM: how long enquiry emails/WhatsApp messages are kept before deletion.] Google Analytics and Meta Pixel data is retained according to Google's and Meta's own default retention settings for our accounts, which we have not customised. [LAWYER TO ADVISE: whether DPA compliance requires us to actively shorten these defaults.]

Who we share it with

Google (Google Analytics, Google Tag Manager) and Meta (Meta Pixel, WhatsApp), only if you consent to cookies. We do not sell your data to anyone, and we do not share direct-contact data (emails, phone numbers) with any third party.

Your rights under the Data Protection Act, 2019

You have the right to:

  • be informed of how your data is used (this page);
  • access the data we hold about you;
  • request correction of inaccurate data;
  • request deletion of your data;
  • object to or restrict processing;
  • withdraw consent to cookies at any time (use "Cookie Preferences" in the footer of any page);
  • lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, if you believe your data has been mishandled.

To exercise any of these rights, email info@outofboxtools.com. [LAWYER TO CONFIRM: required response timeframe under the DPA and whether a formal Data Subject Access Request process is needed beyond a plain email.]

Your choices

You can accept or decline analytics/advertising cookies when you first visit, and change your mind at any time via the "Cookie Preferences" link in the site footer. Declining does not affect your ability to browse the catalogue, view products, or contact us.

Security

[OWNER/LAWYER TO CONFIRM: any specific security measures worth stating (e.g. site served over HTTPS, no card or payment data collected on-site — we accept M-Pesa and cash only, handled outside this website).]

Children

This site is intended for trade professionals, contractors, and DIY adults. We do not knowingly collect data from children.

Changes to this policy

We will update this page if what we collect or how we use it changes, and update the "Last updated" date above.

Contact us

Out of Box Tools & Hardware, Jampark Plaza, along Ngong Road, Nairobi, Kenya. Email: info@outofboxtools.com. Phone/WhatsApp: +254 110 264532.

Chat with us