Your information

Privacy notice

This notice explains what personal information the storefront handles when you browse, create an account, place an order, pay, request support, or submit a review.

Who is responsible for your information

Pep Lush Aesthetics operates this storefront and is responsible for deciding how personal information collected through it is used. You can contact customer care through the Contact page to ask a privacy question or exercise a data-protection right.

Information we collect

Account information: your name, email address, phone number, password credentials, saved addresses, communication preferences, and account-security activity.
Order and delivery information: cart contents, recipient details, delivery or collection location, optional order notes, order history, and the date and version of the terms you accepted.
Payment information: the phone number used to start an M-Pesa payment, transaction references, amount, and payment status. We do not ask for or store your M-Pesa PIN.
Customer-care and review information: WhatsApp enquiry details created through the storefront, support messages you choose to send, cancellation requests, ratings, review titles, and review comments.
Technical and security information: IP address, browser or device information, sign-in sessions, security and audit events, page route, limited performance measurements, and bounded error identifiers. The frontend telemetry is designed not to collect page-query data or arbitrary error text.
Essential cookies and browser storage used for secure sign-in, CSRF protection, cart continuity, guest-order access, checkout and payment state, and dismissed or completed interface notices.

How and why we use it

We rely on steps requested before a purchase and performance of a purchase contract for account, order, payment, and fulfilment processing; legal obligations for required records and compliance; and legitimate interests for proportionate security, support, fraud prevention, and service reliability. Where a use requires consent, we will ask separately and you may withdraw it.

To create and secure an account, authenticate you, and provide account features you request.
To maintain your cart, create and manage an order, confirm payment, issue a receipt, and coordinate collection or a separately arranged delivery.
To send necessary account, order, payment, and fulfilment communications and respond to customer-care requests.
To confirm review eligibility, moderate reviews for privacy and respectful content, and publish a review only through the review workflow.
To protect customers and the storefront, prevent or investigate misuse, maintain audit records, diagnose failures, and improve reliability.
To meet accounting, consumer-protection, data-protection, and other legal obligations, and to establish or respond to legal claims.

What is required and what is optional

Fields marked as required during registration are needed to create an account. The identity, contact, order, and fulfilment details required at checkout are needed to process the purchase. If you do not provide required information, we cannot complete that request, but you may continue browsing the public storefront.

Creating an account is optional where guest checkout is available. Order notes, saved addresses, reviews, and optional communication preferences are also voluntary. Please do not include passwords, payment PINs, identity documents, or unnecessary health information in notes, reviews, or support messages.

Who receives information

We disclose only the information reasonably needed for the relevant service. Recipients may include the providers that host and support the storefront and backend, deliver account or transaction messages, process M-Pesa payments, or provide a courier service you request. Authorised staff may access information according to their role. We may also disclose information where Kenyan law, a court order, or a lawful regulatory request requires it.

If you choose WhatsApp, the storefront opens WhatsApp with the message or enquiry details needed for that conversation. WhatsApp and Meta process information under their own terms and privacy notice. Do not send sensitive or unnecessary information through WhatsApp.

Some service providers may process information outside Kenya. Where that happens, we require an applicable lawful transfer basis and appropriate safeguards under Kenyan data-protection law.

Cookies and browser storage

The storefront currently uses cookies and browser storage for essential security and service functions only. It does not currently use third-party advertising cookies, cross-site tracking, or third-party analytics cookies, so it does not show an advertising-cookie consent banner.

Guest-order access may use a secure, HTTP-only cookie for up to seven days. Other session storage normally lasts for the browser-tab session, while cart and limited interface state may remain in local storage until it is cleared by the application or through your browser controls. Blocking essential storage may prevent sign-in, cart, checkout, payment, or order-access features from working.

How long we keep information

We keep personal information only for as long as it is needed for the purposes above. Account information is kept while the account is active and for any further period needed to complete deletion, protect account security, resolve a dispute, or meet a legal obligation. Order, payment, receipt, and audit records may be retained for applicable accounting, fraud-prevention, dispute, and legal periods.

When information is no longer required, it is deleted, anonymised, or access to it is restricted, unless the law requires it to be retained.

Your choices and rights

Under Kenya’s Data Protection Act, you may ask to be informed about the use of your personal information, access information held about you, object to processing, correct inaccurate or misleading information, or request deletion of information that may lawfully be deleted. Additional rights, including restriction, portability, or withdrawal of consent, apply in the circumstances set out by law.

Use the Contact page and provide enough information for us to identify you and the request. We may need to verify your identity before acting. You may also lodge a complaint with Kenya’s Office of the Data Protection Commissioner.

Security and changes to this notice

We use measures including access controls, protected authentication, restricted session credentials, security headers, input limits, and audit records to reduce unauthorised access, disclosure, alteration, or loss. No online service can guarantee absolute security.

We will update the date and version above when this notice changes materially. We will request a new choice before introducing any processing that requires consent.

Information we collect

Account information: your name, email address, phone number, password credentials, saved addresses, communication preferences, and account-security activity.
Order and delivery information: cart contents, recipient details, delivery or collection location, optional order notes, order history, and the date and version of the terms you accepted.
Payment information: the phone number used to start an M-Pesa payment, transaction references, amount, and payment status. We do not ask for or store your M-Pesa PIN.
Customer-care and review information: WhatsApp enquiry details created through the storefront, support messages you choose to send, cancellation requests, ratings, review titles, and review comments.
Technical and security information: IP address, browser or device information, sign-in sessions, security and audit events, page route, limited performance measurements, and bounded error identifiers. The frontend telemetry is designed not to collect page-query data or arbitrary error text.
Essential cookies and browser storage used for secure sign-in, CSRF protection, cart continuity, guest-order access, checkout and payment state, and dismissed or completed interface notices.

How and why we use it

To create and secure an account, authenticate you, and provide account features you request.
To maintain your cart, create and manage an order, confirm payment, issue a receipt, and coordinate collection or a separately arranged delivery.
To send necessary account, order, payment, and fulfilment communications and respond to customer-care requests.
To confirm review eligibility, moderate reviews for privacy and respectful content, and publish a review only through the review workflow.
To protect customers and the storefront, prevent or investigate misuse, maintain audit records, diagnose failures, and improve reliability.
To meet accounting, consumer-protection, data-protection, and other legal obligations, and to establish or respond to legal claims.

What is required and what is optional

Who receives information

Some service providers may process information outside Kenya. Where that happens, we require an applicable lawful transfer basis and appropriate safeguards under Kenyan data-protection law.

Cookies and browser storage

How long we keep information

When information is no longer required, it is deleted, anonymised, or access to it is restricted, unless the law requires it to be retained.

Your choices and rights

Security and changes to this notice

We will update the date and version above when this notice changes materially. We will request a new choice before introducing any processing that requires consent.