Privacy

What we collect

Only what an order actually requires.

• —Your name, email address and phone number
• —The delivery address, landmark and any instructions you give
• —Company name, KRA PIN and PO reference, when you supply them for invoicing
• —The items, amounts and dates of your orders

What we do not hold

We never see or store card numbers, M-Pesa PINs or bank credentials. Payment is handled entirely by our payment provider; we receive only a confirmation, the channel used, and a reference.

Who else sees it

Our payment provider, to take payment. Our courier, to deliver to you. Our email provider, to send order confirmations. Our hosting and database providers, to run the site. Nobody else — we do not sell or rent customer data, and we do not run advertising trackers.

How long we keep it

Order records are kept for seven years, which is what tax and warranty obligations require. Quote requests that do not become orders are deleted after two years. Visit and search records are deleted after six months.

Your choices

Email admin@elffie.com to see what we hold about you, correct it, or ask us to delete it. We will delete anything we are not legally required to keep.

Cookies

We use cookies to keep you signed in, remember your cart and remember your currency. There are no advertising or analytics cookies, which is why you are not being asked to consent to any.

How we measure the site

We count visits and record what people search for, so we know which parts to stock. This is done without cookies and without any third-party analytics service — nothing about you is shared with anyone.

To count visitors without identifying them, we combine your IP address and browser with a secret that changes every day, and store only the resulting one-way code. It cannot be turned back into your IP address, and because the secret rotates daily the same person is a different code tomorrow — so it cannot build a picture of you over time. We keep these records for six months.

We also store search terms and how many results they returned. A search that finds nothing tells us what to stock. Where you arrived from is recorded as the site name only, never the full address.