Privacy policy

1. Who we are

GlamByMariga Beauty Studio is a beauty studio and online shop based at Kilimani, Nairobi, Kenya. We are the data controller for the personal information described in this policy. Reach us at hello@glambymariga.com.

2. What we collect

• Account details — name, email, phone number and a hashed password.
• Booking details — the treatment, date and time you choose, plus any notes you send your artist.
• Order details — items purchased, delivery address and delivery preference.
• Payment records — the M-Pesa phone number used, transaction amount and the receipt code returned by Safaricom. We never see or store your M-Pesa PIN.
• Technical data — IP address, browser type and pages visited, used for security and to fix problems.

3. Why we use it

To confirm and manage your appointments, process and deliver your orders, take payment, respond to enquiries, prevent fraud and abuse, and — only if you opt in — send you occasional offers.

4. Payments

Payments are processed through Safaricom's M-Pesa Daraja service. When you pay, we share your phone number and the amount with Safaricom so they can send the STK prompt to your handset. Their handling of that data is governed by Safaricom's own privacy policy.

5. Sharing

We do not sell your data. We share it only with our payment processor, our delivery partner (address and phone only, for delivered orders), our hosting provider, and where the law requires it.

6. How long we keep it

Account, booking and order records are kept for seven years to meet tax and accounting obligations. Marketing subscriptions are kept until you unsubscribe. Server logs are cleared after 90 days.

7. Your rights

Under Kenya's Data Protection Act, 2019 you may request a copy of your data, ask us to correct it, ask us to delete it where we have no obligation to keep it, object to marketing, or withdraw consent at any time. Email hello@glambymariga.com and we will respond within 30 days.

8. Security

Passwords are hashed, all form submissions are protected against cross-site request forgery, and database queries use prepared statements. Access to the admin dashboard is restricted and logged.

9. Cookies

We use a single session cookie to keep you signed in and to remember your shopping bag. No third-party advertising cookies are set.

10. Changes

If this policy changes we will update the date at the top of this page and, for significant changes, notify you by email.