Who we are
Mikono Creations is a business in Kenya, run by women across the country. We do not have a physical shop. We work online and by WhatsApp. Mikono Creations is the data controller for the personal data described here ("Mikono", "we"). Our registration with the Office of the Data Protection Commissioner is number [ODPC REGISTRATION NUMBER].
Our Privacy Contact is [PRIVACY CONTACT NAME]. Email Mikonocreations@gmail.com (the general business address). Phone or WhatsApp +254 724 592 115.
In short
We keep your order details so we can make, deliver and support your order. Marketing messages, analytics and ads stay off unless you say yes. This site is for adults. We do not want children's names, ages, schools or photos.
What we collect and why
We collect a piece of information only when we have a reason, and the order works if you leave the optional boxes blank. The table below is grouped by what the information is for.
- Order data (name, phone number, delivery area, address and notes): to take, make, deliver and support your order. Lawful basis: performing the contract. Kept until [ORDER DATA RETENTION] days after delivery, then deleted or made anonymous.
- Order record (order reference, items, amounts): to keep accounts and meet tax duties. Lawful basis: contract and legal obligation. Kept [ACCOUNTS RETENTION] years without contact details.
- Custom brief (your choices, notes, links, and pictures you send): to quote and make your piece. Lawful basis: contract. Pictures are deleted [IMAGE DELETION PERIOD] days after your order closes.
- Trade enquiry (business name, outlet, volume, contact person, invoice name): to quote and supply. Lawful basis: contract. Kept while we trade and [TRADE RETENTION] months after.
- Email address and WhatsApp number for news: only if you tick the box. Lawful basis: your consent. Kept until you withdraw.
- Occasion reminders (occasion type, day and month only): only if you tick the box. Lawful basis: your consent. Kept until the date has passed once, then renewed or deleted.
- Visit measurement (pages, device type, coarse region, campaign link): only if you accept analytics. Lawful basis: your consent. Kept up to 14 months, then in totals only.
- Ad measurement through Meta, TikTok and Google: only if you accept advertising. Lawful basis: your consent. We keep none; the platforms keep theirs under their own policies.
- Proof of consent (what you agreed to, when, the wording version): to show we asked properly. Lawful basis: legal obligation and legitimate interest. Kept while the consent is live plus [CONSENT LEDGER YEARS] years.
- Security and fraud checks: to protect the site and orders. Lawful basis: legitimate interests.
What is saved on your device
The Site saves some items in your browser, such as your order list and your draft order. These stay on your device. Our Cookie and Tracking Policy lists every item. When you tap Send, your order text goes into WhatsApp, and our copy of it lives in our WhatsApp chat and any order records we keep.
Consent and taking it back
Marketing, analytics, advertising and occasion reminders are all off until you tick a separate box for each. Accepting the Terms of Sale and this Privacy Policy is only a confirmation that you have read them, and does not mean you agree to marketing. You can withdraw any consent at any time: reply STOP, use the link in an email, change your cookie choice, or contact the Privacy Contact. Withdrawing does not affect anything done before, and does not affect your order.
Children
This site is for adults. We do not want children's names, ages, schools or photos. If you send them by mistake, we use them only to complete your order and then delete them (see the table for periods). We do not target children with marketing or build profiles from children's data. A child's data may be processed only with a parent or guardian's consent.
Sending data abroad
Some of these providers are outside Kenya, including the United States and Europe. Where we send personal data abroad we use a written contract or another safeguard the law accepts, and for advertising and analytics we ask for your consent after telling you data leaves Kenya. The risk is that other countries' laws may give you different protection. Countries: [TRANSFER COUNTRIES].
Keeping it safe
We use access controls, multi factor sign in for our accounts, encryption in transit, and a limit on who can see customer data. We do not store card numbers or PINs. We never store a tax PIN on the Site.
If something goes wrong
If personal data is lost or accessed without permission and there is a real risk of harm, we tell the Data Commissioner within 72 hours of becoming aware and tell the people affected without undue delay.
Your rights
You have the right to be told how your data is used, to see it, to have it corrected, to have it deleted, to object, to restrict use, to receive it in a portable form, to withdraw consent, and to object to direct marketing at any time. Use the Data Request page or contact the Privacy Contact. We aim to respond within these times:
- Access to your data: within 7 days, free.
- Correcting your data: within 14 days.
- Deleting your data: within 14 days, free. We keep only what the law requires, such as a financial record without your contact details.
- Objecting to use: within 14 days. Objecting to marketing takes effect straight away.
- Moving your data to you or to another provider: within 30 days.
- Withdrawing consent: within 2 working days, and sooner for messages.
We may ask you to confirm it is you, for example by replying from the phone number we have, but we will not ask for a copy of your ID.
Complaints
Please tell us first so we can put it right. You may also complain to the Office of the Data Protection Commissioner, Kenya, at https://www.odpc.go.ke.
What is optional
You need to give name, phone number and delivery area to place an order. Everything else is optional, and refusing marketing, analytics or advertising never affects your order or the price.
Changes
We will update this policy when what we do changes. The version number and date are at the top. We will tell you of important changes on the Site.
What this website saves on your device
This site has no accounts. It does not send your name, phone number, address or order to any server of ours. What you type into the order and enquiry forms stays on your device until you choose to send it to us yourself, as a WhatsApp message. Everything below lives in your browser’s local storage and is never uploaded. The cookies page lists each item by its exact name.
- Your order list, with any note you added to a line. Kept 30 days after the last change.
- Items you put aside with Save for later. Kept 30 days.
- Your delivery estimate (pickup, Nairobi area or town). Kept 30 days.
- A draft of the order form, which can include the name, phone number and delivery details you typed. It never includes a KRA PIN or your marketing choices. Kept up to 24 hours.
- Only if you tick Remember me on this device: your name, phone, email, delivery details and, for a business, its name, type, outlet and invoice name. Kept 90 days after you last send an order with the box ticked. Never a KRA PIN, a gift note or a recipient’s details. Use Forget me on this device in the order form at any time.
- A short list of your last orders: reference, time and items. No name, phone number or address.
- A draft of your Custom Studio brief, and your answers in the gift finder, size finder and safari family builder. They stay on your device for up to 24 hours. The finder answers are never sent anywhere.
- Your cookie choice, your display choices (density and the Animals switch), which hidden animals you have found, and that you saw the home page welcome and, only if you accept analytics, the campaign link you arrived from.
The link Clear my saved details in the footer removes all of this at once, except your cookie choice. Clear my data on the cookies page also removes the cookie choice.
When you send a message on WhatsApp
The forms prepare a message and open WhatsApp. Nothing is sent until you press send in WhatsApp. The message goes to Mikono Creations, and WhatsApp (Meta) handles it under its own terms. If WhatsApp does not open, you can copy the message and send it yourself.
The message holds what you entered: your items, name, phone number, delivery details and any note. If you gave a KRA PIN, it is in the message and nowhere else. After you send, the message sits in our WhatsApp chat with you, and we use it to deal with your order. This site does not keep a copy on a server.
Your choices
Change your cookie choice or clear what is saved on this device.