Privacy Policy & Data Security Matrix
In full alignment with the Office of the Data Protection Commissioner (ODPC) under the Data Protection Act, No. 24 of 2019, Laws of Kenya. Learn how your information assets are collected, stored, and systematically safeguarded.
Data Controller Declaration: TopNote processes all consumer data in complete adherence to strict regulatory guidelines governing the digital commerce landscape within Kenya.
1. Statutory Processing Framework
TopNote ("the Company") operations are firmly instituted upon Section 25 of the Data Protection Act, 2019. We process metrics with absolute fairness, lawful precision, and maximum transparency. Data points collected on our system exist uniquely to execute commercial transactions or to optimize user engagement, strictly avoiding unauthorized third-party commercial distributions.
2. Personal Identifiers Collected
We collect and securely index the following records explicitly supplied during verification setups or checkout actions:
- Identity & Registration: Complete legal names, physical shipping addresses, and delivery preferences.
- Contact Parameters: Active telephonic numbers (including mobile payment routing numbers) and business email addresses.
- Financial Logs: Transaction validation strings corresponding to mobile payment APIs (e.g., M-Pesa tracking codes). Raw payment PIN entries are completely restricted from our servers.
- Digital Signatures: IP addressing logs, login cookies, and analytics mapping tracking the interaction with fragrance vaults.
3. Operational Intent and Retention
In absolute agreement with Section 28 of the Act, personal metrics are compiled solely to fulfill logistics routing, custom fragrance selections, anti-fraud evaluation, and promotional releases where clear user affirmation has been received. Records are securely retained strictly for the duration necessary to fulfill fiscal tracking required under the Income Tax Act or until requested for removal.
4. Statutory Rights of Kenyan Consumers
Under Section 26 of the Act, every user retains unconditional legal power to command structural access to stored personal logs, demand immediate modification of erroneous variables, object to algorithmic marketing profiles, or completely command records deletion (The Right to be Forgotten). Inquiries or requests to exercise these statutory rights should be directed to our data liaison desk at privacy@topnote.co.ke.