This policy explains what personal information Royal Delites collects when you use our website, why we collect it, who sees it and the choices you have. We have tried to keep it in plain language. If anything is unclear, please ask us.
Who we are
Royal Delites is a Nairobi bakery located on Aerodrome Road, not far from Nyayo Stadium. We run this website, royaldelites.co.ke, and we decide how the information you give us is used. Under the Kenya Data Protection Act, 2019, that makes us the data controller.
To ask us anything about your information, use the form on our Contact page, or visit the bakery.
What we collect and why
We ask only for what we need. This is what we collect in each part of the website.
When you place an order
- Your name, email address and phone number, so we can confirm your order and reach you if there is a question.
- What you ordered, whether you will collect it or want it delivered, and the date and time of day you need it.
- Your delivery area and street, if you choose delivery.
- Any message you want on a cake and any notes you add.
- Allergies or dietary needs, if you choose to tell us (see the section below).
- How you chose to pay. We do not see or store your card or mobile-money details; if you pay online, the payment provider handles them.
- Where your visit came from (for example a search, another website or a link we shared), the first page you opened and how many pages you viewed, so we know which of our channels bring orders.
We use this to prepare and deliver your order, to keep a record of it for our accounts, and to tell you how it is going.
When you create an account
- Your name, email address and password, and your phone number if you give it.
- A saved delivery address and your allergy information, if you choose to save them.
- A list of your past orders, so you can see them and order again.
- If you use our free baking lessons (the Academy), which lessons you opened and finished, and when.
We never see your password in readable form; WordPress, which runs our website, keeps it in a scrambled form. We use your account details so you can sign in, follow your orders, check out faster and open the full baking lessons. We use your lesson progress so you can carry on where you stopped, and the people who run the Academy can see each student’s progress to help them and to improve the lessons.
When you contact us or join our newsletter
- The contact form asks for your name, email address, an optional phone number, what your message is about and the message itself. We use it to reply to you.
- The newsletter signup asks for your email address only. We use it to send you our news, and you can ask us to remove it at any time.
When you comment on our blog
We collect the name, email address and comment you enter. Your name and comment are shown publicly under the article. Your email address is kept by us and is not shown.
When you review a cake
We collect the name, email address, star rating and review you enter. Your name, rating and review are shown on the cake’s page once we have approved them. Your email address is kept by us and is not shown. WooCommerce, which runs our shop, compares it with our orders to mark a review as coming from a verified buyer.
What stays on your own device
Your shopping cart and wishlist are kept in your browser. We do not receive them until you check out.
Your browser also keeps a short record of how your visit began (where you came from, the first page you opened and the pages you viewed), which is added to an order you place. After you place an order, your browser also remembers the name, phone number, email address and delivery address you entered, so you do not have to type them again next time. They stay on your device and reach us only inside an order you place. Allergy information is never kept this way. You can remove these details by clearing this website’s data in your browser settings.
Technical information
Like most websites, our web host records basic technical details when a page is requested, such as your IP address, browser and the pages you open. We use this to keep the website running and secure. We also use your IP address to limit repeated sign-in and form attempts, which protects accounts from abuse.
Allergies and health information
Allergy and dietary information can say something about your health, so the law asks us to handle it with extra care. We ask for it only so that we can prepare your order safely. Giving it to us is always your choice.
When you tell us about an allergy at checkout, it is added to your order so the people preparing it can see it, and it is used for nothing else. If you are signed in, you can also tick a box to keep it on your account so it is filled in next time. We never tick that box for you.
You can change or remove saved allergy information at any time under My account, in the Details tab; clearing the text removes it from your account. Past orders keep the note you gave us at the time, because they are our record of what we prepared.
Cookies and similar technologies
Some of these are needed for the website to work, and some help us understand how it is used.
Needed for the website to work
- Your cart and wishlist, and the contact and delivery details from your last order, kept in your browser’s storage.
- Your sign-in, if you have an account. If you choose Remember me, it stays until you sign out; otherwise it lasts only until you close the tab.
- A small cookie set when you place an order, which lets you see your order confirmation. It expires after one day.
Google Analytics and Google Tag Manager
We use Google Analytics to understand how people use our website, for example which pages are popular and how visitors find us. Google Tag Manager is the tool we use to manage this and similar services.
These services use cookies and similar technology to collect information such as the pages you view, how long you stay, the type of device and browser you use, and your approximate location, but not your exact address. Google’s analytics cookies, such as the ones named _ga and _ga_ followed by an identifier, can last up to two years. The information is linked to your browser or device and not to your name, but we treat it as personal information. Google handles it under its own terms; see Google’s privacy policy and how Google uses information from sites that use its services.
You can stop Google Analytics collecting information about your visits by installing the Google Analytics opt-out browser add-on, or by blocking cookies in your browser settings. The website works either way. We use this information to improve our website, and we do not use it to show you adverts. We do not use Google’s advertising or remarketing features; if that ever changes, we will update this policy first.
Ahrefs Web Analytics
We also use Ahrefs Web Analytics, a second statistics service, to see which pages are viewed and where visitors come from. It does not use cookies.
When a page loads, it records the page address, the page you came from, your browser, device type, screen size and language setting, and roughly where you are, down to the city at most. Your IP address is used to work out that location and is not stored. To count visitors, it makes a visitor code from your connection details that is replaced every day, so it cannot follow you from one day to the next, and it does not follow you to other websites. It is linked to your device and not to your name. Ahrefs, the company behind it, handles the information under its own terms; see how Ahrefs Web Analytics handles information.
Maps
The map on our Contact page is provided by Google. When it loads, Google may receive information such as your IP address and may set its own cookies, under the Google privacy policy linked above.
Who we share your information with
We do not sell your information. We share it only with people and companies who help us serve you:
- Our website host, which stores the website and its data and sends the emails the website produces, such as order confirmations.
- The people who deliver your order, if you choose delivery. They receive your name, phone number and address.
- A payment provider, if you pay online.
- WhatsApp (Meta), if we send you order updates on WhatsApp. In that case your phone number and a short summary of your order are sent through the WhatsApp Business Platform.
- Google, for the website statistics and the map described above.
- Ahrefs, for the second set of website statistics described above.
We may also share information when the law requires it, for example to answer a valid request from a court or a public authority.
Where your information is stored
Our website and its data are kept with our hosting provider. Some of the services above, such as Google, Ahrefs and WhatsApp, are run by companies that process information outside Kenya. We choose services that protect information responsibly, and we do not send them more than they need.
How long we keep it
- Order records: for as long as we need them for our accounts and to meet legal duties.
- Your account and anything saved on it, including allergy information and lesson progress: until you remove it or ask us to delete your account.
- Contact messages: for as long as it takes to deal with your question, and a reasonable time afterwards in case you follow up.
- Newsletter email address: until you ask us to stop.
- Blog comments: until you ask us to remove them or we remove them ourselves.
- Cake reviews: until you ask us to remove them or we remove them ourselves.
- Website statistics from Google Analytics: for the period set in our Google Analytics account.
- Website statistics from Ahrefs Web Analytics: in our Ahrefs account, where they are not tied to your name; the daily visitor code that counts you once is replaced every day.
How we protect it
The website uses an encrypted (HTTPS) connection. Passwords are stored in scrambled form. Only people who need customer information to run the bakery can see it. No system is completely secure, so please choose a strong password and keep it to yourself.
Children
Our website is meant for adults. If you are under 18, please ask a parent or guardian to place orders and manage an account for you.
Your rights
Under the Kenya Data Protection Act, 2019, you can:
- be told how we use your information, which is what this policy is for;
- ask for a copy of the information we hold about you;
- ask us to correct anything that is wrong or out of date;
- ask us to delete information we no longer need or that is wrong;
- object to the way we use your information;
- ask for your information in a form you can take elsewhere, where the law allows;
- withdraw a consent you gave us, which does not affect what we did before you withdrew it.
You can correct your name, phone number, delivery address and allergy information yourself under My account. For anything else, including deleting your account, use the form on our Contact page and tell us what you would like. We will answer as quickly as we can, and within the time the law allows. We may need to check that it is really you before we share or change anything.
If you are not happy with how we have handled your information, you can complain to the Office of the Data Protection Commissioner of Kenya.
Changes to this policy
If we change how we use your information, we will update this page. If a change matters, for example using your information for a new purpose, we will tell you before it applies.
Contact us
Questions about this policy or your information? Use the form on our Contact page, or call in at the bakery.