Privacy Policy

Last updated: 19 September 2026

Mercy Delicacies ("we", "us") bakes and delivers cakes in Nairobi. This page explains what personal details we collect when you order, why we need them, and your rights under Kenya's Data Protection Act, 2019.

1. What we collect

Your name and phone number, so we can confirm your order and contact you.
Delivery details: your delivery address or chosen pickup point, and the date and time you want the cake.
Order details: cake size, flavour, shape, message and any special instructions.
Photos you upload as design inspiration.
Payment records: amounts paid and the M-Pesa transaction code. We never see or store your M-Pesa PIN.

2. Why we use it

To make, deliver and hand over your order.
To contact you about your order, for example to confirm the design or arrange payment.
To keep proper business and tax records.

We do not sell your details, and we do not send you marketing messages unless you ask us to.

3. Who can see it

Our staff, only as needed for their part of your order (for example, the bakers see the cake details and the rider sees the delivery address).
Our website hosting company, which stores the data for us on its servers.
Safaricom (M-Pesa) and WhatsApp, when you pay or chat with us through them. Their own privacy policies apply.
Government authorities, only if the law requires it.

4. How long we keep it

We keep order and payment records for as long as the law requires for business and tax records (usually up to 5 years). Inspiration photos are only needed while we make your cake, and you can ask us to delete them at any time.

5. How we protect it

Only staff with a personal login can see customer details. The website uses a secure (https) connection, and we limit each staff member to what their job needs.

6. Your rights

Under the Data Protection Act, 2019 you can:

ask what details we hold about you and get a copy;
ask us to correct details that are wrong;
ask us to delete your details, unless we must keep them by law (for example, tax records);
object to us using your details for a particular purpose.

To make any of these requests, message us on WhatsApp 0740 071 787. We will reply as soon as we can.

If you are not happy with how we handle your details, you can also complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

7. Changes to this policy

If we change this policy, we will update this page and the date at the top.