Privacy Policy

Last updated: 22 August 2026.

This policy explains what information Out of Box Tools & Hardware ("we", "us") collects when you visit outofboxtools.com or contact us, why we collect it, and the rights you have over it under Kenya's Data Protection Act, 2019 ("the DPA").

Who we are

Out of Box Hardware Limited is the data controller for the personal information described in this policy. We trade as Out of Box Tools and Hardware from Jampark Plaza, Ngong Road, Nairobi, Kenya.

Out of Box Hardware Limited is registered with the Office of the Data Protection Commissioner as a Data Controller under the Data Protection Act, 2019, registration number 532-5345-620C.

If you have any question about this policy or about the information we hold, email us at info@outofboxtools.com.

What we collect, specifically

We do not run an on-site contact form or account system. Data reaches us through exactly these channels:

Direct contact. If you email info@outofboxtools.com or call/WhatsApp +254 110 264 532, we receive whatever you send us directly (name, phone number, email address, and the content of your message) in our email inbox or WhatsApp Business account. This is not collected via our website — the site only provides clickable links (`mailto:`, `tel:`, and `wa.me`) that open your own email or WhatsApp app. When you message us on WhatsApp from our website, the pre-filled message may include a short note of how you found us (for example, "via Google"). It is kept only in your browser for that visit, you can see it before you send, and you can delete it.
Website analytics cookies (Google Analytics 4). If you accept cookies, Google Analytics collects standard usage data: pages viewed, approximate location (city-level, from IP address), device/browser type, referring site, and on-site actions we explicitly track (WhatsApp button clicks, product views). We do not collect your name or email through this.
Advertising cookies (Meta Pixel). If you accept cookies, the Meta Pixel records that you visited the site and which pages/products you viewed, so we can measure the performance of Facebook/Instagram ads and show ads to people with similar interests. This is shared with Meta (Facebook, Instagram, WhatsApp's parent company) under Meta's own terms.
Google Ads. When you click our WhatsApp button, we record that as a conversion in Google Ads. This tells us that our advertising is reaching people who go on to contact us. It is loaded by the same Google tag that loads Google Analytics, and it only runs if you accept advertising cookies.
A cookie-consent record. When you accept or decline cookies, we store that choice in your browser's local storage (not a cookie, not sent to us or anyone else) so we don't ask again every visit.

We do not use cookies to track you before you consent. Analytics and advertising scripts are not loaded on your device at all until you click Accept on the cookie banner.

Why we are allowed to collect it

The law requires us to have a lawful basis for using your information. Ours are:

Your consent, for analytics and advertising cookies. Nothing loads until you accept, and you can change your mind at any time.
Performing our agreement with you, for handling your enquiry, quoting, and fulfilling an order.
Our legitimate interests, for keeping records of customer correspondence and for CCTV at our premises, which protects our staff, our stock and our customers.
Legal obligation, for tax and VAT records we are required to keep.

Where your information goes

The analytics and advertising services we use are operated by Google and Meta, and the information they collect is processed on their servers outside Kenya. This happens only if you accept analytical and advertising cookies, and you can withdraw that consent at any time from the footer of this site.

We do not sell your personal information, and we do not share it with anyone else for their own marketing.

How long we keep it

Enquiries that did not lead to a sale. We delete emails and WhatsApp messages 24 months after we last heard from you. Customers often price a tool and come back for it later, so we keep enquiries long enough to be useful and no longer.

Records connected to a sale. We keep correspondence, invoices and order records for 5 years. The Tax Procedures Act, 2015 requires us to keep business and VAT records for this period.

Website analytics. Google Analytics data is retained for 2 months and then deleted automatically.

We review what we hold twice a year and delete anything past these periods.

If you ask us to delete your information, we will, unless the law requires us to keep it. Tax records are the usual case. Where that applies we will tell you which records we are keeping and why.

Who we share it with

Google. Google Analytics measures how the site is used, and Google Ads records when someone clicks our WhatsApp button so we can tell whether our advertising is working. Both are loaded by a single Google tag and only run if you accept analytical and advertising cookies.
Meta. The Meta Pixel measures the performance of our advertising on Facebook and Instagram, and only runs if you accept advertising cookies.
Couriers, where we need to give a name, phone number and delivery address to get an order to you.

We do not sell your personal information and we do not share it with anyone else for their own marketing.

Your rights

Under the Data Protection Act, 2019 you have the right to ask us what personal information we hold about you, to have it corrected, to have it deleted, to receive a copy in a portable form, and to object to us using it for direct marketing.

Email info@outofboxtools.com. You do not need a special form; a plain email is enough. We will:

give you access to your information within 7 days
correct or delete information within 14 days
provide a portable copy within 30 days
act on a direct marketing objection within 7 days

Access, correction, deletion and marketing objections are free of charge. We may charge a reasonable fee, not more than it costs us, for providing a portable copy.

We may need to confirm your identity before releasing information, so that we do not give your details to someone else.

Deletion may be refused where the law requires us to keep a record, such as tax records. If that applies we will tell you.

If you are unhappy with how we have handled your information, you can complain to us at info@outofboxtools.com, or to the Office of the Data Protection Commissioner, which regulates data protection in Kenya.

Your choices

You can accept or decline analytics/advertising cookies when you first visit, and change your mind at any time via the "Cookie Preferences" link in the site footer. Declining does not affect your ability to browse the catalogue, view products, or contact us.

Marketing messages

We use WhatsApp and email to reply to enquiries and to handle orders. We do not send promotional broadcasts, bulk marketing messages or newsletters.

If that ever changes, we will only send marketing messages to people who have agreed to receive them, every message will include a way to stop them, and you can opt out at any time by replying STOP or emailing info@outofboxtools.com.

Security

We do not collect card or payment details on this website at any point. Payment is by M-Pesa or in cash, arranged directly with us.
Access to our enquiry inbox and WhatsApp Business account is limited to authorised staff.
This site is served entirely over HTTPS. Any request to the non-secure http:// address is automatically redirected.

Children

This website is intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, email info@outofboxtools.com and we will delete it.

Changes to this policy

We will update this page if what we collect or how we use it changes, and update the "Last updated" date above.

Contact us

Out of Box Tools & Hardware, Jampark Plaza, Ngong Road, Nairobi, Kenya. Email: info@outofboxtools.com. Phone/WhatsApp: +254 110 264 532.