Who is responsible

The data controller is Apostle Charles Mutuku. The website is built and hosted for us by LitWebTech, which handles the information only on our instructions.

What we collect

• Orders: your name, phone number, email address and delivery address, with any map pin and delivery instructions you add.
• Payments: the payment status, the method used and the confirmation or M-Pesa receipt code. Card numbers, PINs and mobile money details are entered on Pesapal's or Safaricom's own screens; we never see or store them. If you pay to our M-Pesa Till by hand, the M-Pesa code and phone number you send us.
• Your account (optional): your email address, and any name, phone number, display name, saved addresses and wishlist you add. You sign in with a one-time code sent to your email, or with your Google account, so there is no password to store. With Google we receive only your name, email address and a Google account number, never your Google password.
• Community and reviews: what you post, when, and which book it is about. If you post anonymously, other readers see "Anonymous reader". The site owner can still see which account wrote it, so abuse can be dealt with.
• Waiting lists and news: your email and the book you asked about, and whether you asked for news of new books.
• Institutional enquiries: your name, organisation, role, email, phone and the details of your request.
• Notifications: the alerts shown under the bell (replies, order updates, new articles) and which kinds you switched off. If you turn on notifications on a device, your browser gives us an address at its push service and a key; alerts are sent there encrypted, so only your device can read them.
• Your agreements: when you ticked a box to accept our terms or this notice, and which version you accepted.
• Technical records: your IP address and browser type, kept briefly to protect the shop from fraud and abuse.

Why we use it, and on what basis

• To sell and deliver your books (to perform our contract with you): taking the order, confirming payment, delivery, order emails, and your account if you open one.
• To keep records the law requires (legal obligation): sales and tax records.
• To keep the shop and community safe (legitimate interests): preventing fraud, limiting abuse, moderating posts and securing the site.
• With your consent: the soft-copy waiting list, news of new books, and replies to enquiries. You can withdraw consent at any time under Account, Settings, or by writing to us; it does not affect what was done before.

We do not sell your information, use it for advertising, or make decisions about you by automated means.

Who else sees it

• Pesapal, a Kenyan payment service, processes card, mobile money and bank payments. It receives your name, email, phone and the order amount.
• Safaricom receives your phone number and the amount when you pay with an M-Pesa prompt or to our Till.
• Couriers and riders receive the name, phone number and address needed to deliver your order.
• LitWebTech hosts the website and its database and sends our emails from its mail server.
• Push services run by your browser's maker (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox, Microsoft for Edge) carry notifications to devices where you turned them on. They receive only an encrypted message they cannot read, and when it was sent.
• Google Fonts: your browser downloads the site's typefaces from Google's servers, which receive your IP address and browser details. No cookies are set.
• Sign in with Google: when you are not signed in, pages load Google's sign-in service so it can offer to sign you in. Google then knows you visited this site, under its own privacy policy. If you choose Google, we receive your name, email address and a Google account number.

Each receives only what it needs. What you post in the community is public, under your display name or as "Anonymous reader".

Information stored outside Kenya

Some of these services may store or process information on servers outside Kenya, such as our web host and Google Fonts. We use providers that protect personal information to a standard comparable to Kenyan law, as sections 48 and 49 of the Data Protection Act require.

How long we keep it

• Orders and payment records: as long as tax law requires, currently five years under Kenya's Tax Procedures Act.
• Your account and what you posted: until you delete your account.
• Enquiries: up to two years, unless they lead to an order.
• Sign-in codes: removed as soon as they are sent and deleted within two days; security records of failed attempts are deleted within a day.
• Waiting-list entries: until the soft copy is released or you leave the list.
• Notifications: 90 days after you read them, 180 days at most. A device stops receiving them when you turn them off, sign out, or it stops answering.

How we protect it

The site runs only over encrypted connections (HTTPS). The dashboard is limited to the owner and named staff, each protected by a password and a code from an authenticator app. Payment details never reach our servers. Access to your order needs its number and a private key sent only to you.

Your rights

Under the Data Protection Act you may:

• be told how your information is used (this notice);
• get a copy of it: signed-in readers can download their data at any time;
• have it corrected, or deleted: you can delete your account yourself, and we remove your account, reviews, posts, wishlist, addresses, waiting-list entries and devices straight away (paid orders are kept, detached from you, because the law requires sales records);
• object to a use of it, or withdraw consent you gave.

For anything else, use the contact details on the contact page. We reply as soon as we can, within the time the law sets. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner, www.odpc.go.ke.

Children

The shop and community are meant for adults. Readers under 18 should use them with a parent or guardian.

Cookies

We use essential cookies only. The cookie policy lists each one.

Changes

If this notice changes in a way that matters, we change the version number below and say so on the site.

Version 2026-09-25. Last updated 30 September 2026.