Privacy Policy

Last updated: 2 November 2026

In short: we collect only what we need to process your orders, we share your delivery details with the vendor fulfilling your order, we never sell your personal data, and you can ask us to see, correct or delete your information at any time.

1. Who we are

FLEVAMALL (https://flevamall.com/) is an online marketplace that connects customers with independent vendors selling flowers, gifts and event rentals. For the personal data described in this policy, FLEVAMALL acts as the data controller under the Kenya Data Protection Act, 2019. Our contact details are at the end of this policy.

2. What information we collect

  • Account details: your name, email address, phone number and password (stored securely, never in plain text).
  • Order details: the items you order, delivery or pickup address, delivery instructions and gift messages.
  • Payment details: payments are handled by M-Pesa (Safaricom) and our payment partners. We do not see or store your card numbers or M-Pesa PIN. We keep only the transaction reference, amount and status.
  • Vendor details: if you sell on FLEVAMALL, your store information, contact details and the information needed to pay you.
  • Technical details: your IP address, browser and device type, and pages visited, collected through cookies and similar technologies.
  • Communications: messages you send us and your notification preferences.

3. How we use your information

  • To create and manage your account and process, deliver and support your orders.
  • To confirm payments and prevent fraud.
  • To send order updates by email, SMS or WhatsApp.
  • To let vendors see the details they need to prepare and deliver your order.
  • To handle refunds, complaints and customer support.
  • To keep our website secure, understand how it is used and improve it.
  • To meet our legal, tax and accounting obligations.

4. Who we share your information with

We share personal data only where it is needed to run the marketplace:

  • Vendors: the vendor fulfilling your order receives your name, phone number, delivery address, delivery notes and order contents. Vendors are required to use this only to fulfil your order.
  • Payment providers: M-Pesa (Safaricom) and our card and bank payment partners process your payment.
  • Delivery partners: riders or couriers who deliver your order.
  • Messaging and service providers: email, SMS and WhatsApp (Meta) providers that deliver order notifications, and our website hosting provider.
  • Authorities: where the law requires it, or to protect our rights and the safety of others.

We do not sell your personal data.

5. Cookies

We use cookies that are essential for the site to work (such as your cart and login), and optional cookies that help us understand how the site is used. When you first visit, a banner lets you accept, reject or customize the optional ones, and you can change your choice at any time through the cookie settings on the site. Blocking essential cookies may stop parts of the site, such as checkout, from working.

6. Our legal basis for using your data

Under the Kenya Data Protection Act, we process personal data to perform our contract with you (your orders), to meet legal obligations, for our legitimate interests in running and securing the marketplace, and, where required, with your consent, which you may withdraw at any time.

7. How long we keep it

We keep your data for as long as your account is active and as long as needed to handle orders, returns and disputes, and to meet legal, tax and accounting requirements. After that we delete it or make it anonymous.

8. Keeping your data safe

We use reasonable technical and organizational measures to protect your data, including encrypted connections, restricted access and trusted service providers. No online service is completely risk-free, so please use a strong, unique password.

9. Transfers outside Kenya

Some of our service providers (for example messaging and hosting providers) may process data outside Kenya. Where this happens we take steps to make sure your data is protected as the law requires.

10. Your rights

Under the Kenya Data Protection Act you have the right to:

  • be informed about how your data is used;
  • access the personal data we hold about you;
  • object to or restrict how we use your data;
  • have inaccurate data corrected;
  • have your data deleted, where we have no legal reason to keep it;
  • receive your data in a portable format; and
  • withdraw your consent at any time.

To use any of these rights, email us at the address below. If you are unhappy with how we handle your data you may also complain to the Office of the Data Protection Commissioner (ODPC) of Kenya at odpc.go.ke.

11. Children

FLEVAMALL is intended for people aged 18 and over. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed, and we will tell you about significant changes.

13. Contact us

Questions or requests about your data? Contact us at admin@flevamall.com, or write to us at Nairobi, Kenya.