Your privacy matters to us. This policy explains what personal data we collect through mitchellenjoroge.com, why we collect it, who we share it with, how long we keep it and how you can control it. We follow the Data Protection Act, 2019 of Kenya (the “Act”) and its regulations.
1. Who we are
The data controller for this website is Mitchelle Njoroge (“Mitchelle”, “we”, “us”), a model and sustainability advocate based in Nairobi, Kenya. A “data controller” is the person who decides why and how your personal data is used.
You can reach us at info@mitchellenjoroge.com or on WhatsApp at +254720883757.
2. What we collect and why
We only collect the personal data we need, and we tell you what it is used for at the point we ask for it. The table below sets out each situation, the data involved, the purpose and the lawful basis under section 30 of the Act.
| When | Data | Why we use it | Lawful basis |
|---|---|---|---|
| You send a message through a contact form | Name, email address, subject, your message | To read and reply to your enquiry (collaborations, press, bookings, questions) | Your request, and our legitimate interest in responding |
| You subscribe to the newsletter | Email address, the page you signed up on, the date and time you agreed | To send you news about campaigns, events, advocacy and new GreenPod episodes | Your consent (you can withdraw it at any time) |
| You place an order in the shop | Name, phone number, email address (if given), delivery address and region, order contents, payment method, order notes, the time you accepted our Terms | To take payment, prepare and deliver your order, send receipts and download links, arrange bookings and handle any problem with your order | Performing our contract with you |
| We keep order records | Order reference, items, amounts, status, payment confirmation | Accounting, tax and legal record-keeping | Legal obligation |
| You visit the website | IP address, browser type, device, pages requested, date and time (in server logs); a short-lived counter tied to your IP address to stop spam and abuse | To keep the site secure, fix faults and prevent abuse | Our legitimate interest in running a safe website |
| Team members sign in to the admin area | Username, email address, name, sign-in time | To let authorised people manage the website | Our legitimate interest; the team member’s agreement |
Payments
If you pay with M-Pesa, your phone number and the amount are sent to Safaricom so that the payment prompt can appear on your phone. If you pay by card, you are sent to Paystack, which collects and processes your card details. We never see or store your full card number. If you order through WhatsApp, the conversation is also governed by WhatsApp’s own privacy policy. For cash on delivery we only use the contact and delivery details you gave us.
What we do not do
- We do not sell your personal data.
- We do not use advertising trackers, social-media pixels or third-party analytics on this website.
- We do not make decisions about you by automated means that have legal or similarly significant effects.
- We do not knowingly ask for sensitive personal data (such as health, religion, ethnicity or biometric data). Please do not include it in messages.
3. Cookies and similar technologies
We use only what the site needs to work:
- Your cart. Items you add to the shop cart are saved in your own browser (local storage) so they are still there if you come back. This stays on your device and you can clear it at any time in your browser settings.
- Sign-in cookie. A secure session cookie is used only when a team member signs in to the admin area. Visitors do not receive it.
- Embedded videos. Podcast episodes may be shown with a YouTube or Vimeo player (we use YouTube’s privacy-enhanced mode). Those services may set their own cookies once you press play. Their privacy policies apply to that viewing.
Because we do not use tracking or advertising cookies, there is no cookie banner to accept. If that ever changes, we will ask for your consent first.
All fonts and code libraries on this site are served from our own server, so your browser does not contact Google or other content networks just to display the page.
4. Who we share it with
We share personal data only with the people and services needed to run the website and fulfil your requests (“data processors” and other recipients). They may only use it for those purposes.
- Our web hosting and email providers, who store the website, its database and our mailboxes.
- An email delivery service (such as SMTP2GO) that sends newsletters and some notifications on our behalf.
- Safaricom (M-Pesa) and Paystack, to process payments.
- Couriers or delivery partners, to whom we give your name, phone number and delivery address so your order reaches you.
- Meta (WhatsApp), if you choose to message or order through WhatsApp.
- YouTube and Vimeo, if you play an embedded episode.
- Professional advisers, regulators or law enforcement, only where the law requires it or to protect our legal rights.
5. Transfers outside Kenya
Some of the services above (for example email delivery, card payments, WhatsApp and video players) process data on servers outside Kenya. Where this happens, we only use providers that apply appropriate data-protection safeguards, and we limit what we send to what is necessary to deliver the service you asked for, as required by sections 48 and 49 of the Act. By placing an order, subscribing or contacting us you understand that this may involve such a transfer.
6. How long we keep it
| Data | How long |
|---|---|
| Contact-form messages | Up to 24 months after our last exchange, then deleted |
| Newsletter subscription | Until you unsubscribe or ask us to delete it |
| Order and payment records | For as long as Kenyan tax and accounting law requires us to keep financial records. If you ask us to erase your details, we remove your name, phone, email, address and notes and keep only the anonymous financial record. |
| Server logs and anti-spam counters | Logs for a short period set by our host; anti-spam counters expire within minutes |
| Team accounts | While the person helps with the site; deleted when they stop |
7. How we protect it
- The whole website is served over encrypted HTTPS.
- Passwords are stored in hashed form, never in plain text, and repeated wrong sign-in attempts are blocked.
- The admin area is private; each team member can only open the sections they need.
- Payment details are handled by Safaricom and Paystack, not stored by us.
- Uploaded files are checked, and nothing uploaded is allowed to run as a program on our server.
- We keep software up to date and take regular backups.
No system is perfectly secure. If a breach puts your personal data at real risk of harm, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, and tell the people affected, as required by section 43 of the Act.
8. Your rights
Under the Act (in particular sections 26, 32, 35, 38 and 40) you have the right to:
- Be informed about how your data is used (this policy and the notices on our forms).
- Access the personal data we hold about you, and get a copy.
- Object to all or part of the processing of your data, including direct marketing.
- Correct data that is false, inaccurate or misleading.
- Have it deleted where it is false or misleading, no longer needed, or you withdraw consent and there is no other lawful reason to keep it.
- Withdraw your consent at any time. This does not affect processing that was lawful before you withdrew. For the newsletter, use the unsubscribe link at the bottom of every email.
- Receive your data in a structured, commonly used, machine-readable format, and have it sent to another organisation where technically possible (data portability).
- Not be subject to a decision based only on automated processing that significantly affects you. We do not make such decisions.
How to use your rights. Email info@mitchellenjoroge.com with the subject “Data protection request”, tell us which right you want to use and the email address or phone number you used with us. We may ask you to confirm your identity so we do not give your data to the wrong person. We aim to reply within 30 days, and we do not charge a fee for ordinary requests. A parent, guardian or someone you authorise in writing may make a request for you.
9. Children
This website is for a general audience and is not directed at children under 18. We do not knowingly collect personal data from children without the consent of a parent or guardian, as required by section 33 of the Act. If you are a parent or guardian and believe a child has given us personal data, please contact us and we will delete it.
10. Complaints
If you have a concern about how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) in Kenya: odpc.go.ke/file-a-complaint or info@odpc.go.ke.
11. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last updated. If we make a significant change to how we use your data, we will tell you in a clear way, for example on the site or by email to subscribers.
12. Contact us
Questions about this policy or your data?
Email info@mitchellenjoroge.com · WhatsApp +254720883757
Nairobi, Kenya
See also our Terms of Use & Sale.