Privacy Policy

1. Who we are

Muthaiga Fine Meats Limited ("Muthaiga Fine Meats", "we", "us") is a meat processing and supply company based at Landhies Road, next to Kamukunji secondary School, Nairobi, Kenya. We supply beef, chicken, goat, lamb, fish and sea foods to customers in Nairobi and across Kenya, and we operate the website muthaigameats.com.

2. Legal framework

We handle personal data in line with the following Kenyan laws:

• Constitution of Kenya, 2010: Article 31 guarantees every person the right to privacy, including privacy of personal information and communications. Article 35 protects access to information. Article 46 protects consumer rights, including the right to goods and services of reasonable quality and to information needed to protect economic interests.
• Data Protection Act, 2019 (No. 24 of 2019) and its regulations: the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, and the Data Protection (Compliance and Enforcement) Regulations, 2021.
• Consumer Protection Act, 2012: fair dealing, accurate information and protection against unfair practices.
• Computer Misuse and Cybercrimes Act, 2018 and the Kenya Information and Communications Act (Cap. 411A): security of systems, electronic communications and electronic transactions.
• Tax Procedures Act, 2015 and the Kenya Revenue Authority's eTIMS requirements: invoicing and tax record keeping.
• National Payment System Act, 2011: governs the mobile money and bank channels through which you pay us.
• Food, Drugs and Chemical Substances Act (Cap. 254), Public Health Act (Cap. 242) and Meat Control Act (Cap. 356): traceability and inspection records for the meat we handle.
• Children Act, 2022: protection of children's interests, including their information.

3. Personal data we collect

• Identity and contact: your name, business or company name, phone and WhatsApp number, email address, and delivery address or location.
• Order information: products ordered, quantities, whether you want items fresh or frozen, delivery instructions, invoices and eTIMS receipts, and any return or quality complaint.
• Payment information: the payment method you use (cash on delivery, bank cheque, M-Pesa or Airtel Money), transaction references, and the mobile number or account name attached to the payment. We do not store your M-Pesa PIN, card PIN or full bank credentials.
• Communications: messages you send through our contact form, WhatsApp, phone calls and email.
• Technical data: IP address, device and browser type, pages visited and time spent, collected through cookies and similar tools.
• Business customer and supplier data: for wholesale, hotel, restaurant and butchery accounts, the contact person, KRA PIN, business registration details and trade references. For suppliers, delivery and inspection records.

We do not intentionally collect sensitive personal data such as health, religion, ethnic origin or biometric data. If you give us such data, for example a Halal or dietary requirement, we handle it only with your consent and with extra care.

4. How we collect it

• Directly from you when you fill in a form, place an order by phone or WhatsApp, request a quotation, or contact us.
• Automatically when you browse muthaigameats.com, through cookies and server logs.
• From payment providers and banks that confirm your payment, and from delivery partners that confirm receipt.
• From public or official sources, such as business registries, where we verify a business account.

5. Why we use it, and our lawful basis

Section 30 of the Data Protection Act allows us to process personal data only on a lawful basis. We rely on these:

We do not sell your personal data. We do not use it for automated decisions that significantly affect you.

6. Who we share it with

We share personal data only as needed, and only with parties bound to protect it:

• Service providers (data processors): our website platform (Shopify), email and messaging tools, and IT support, under written agreements as required by the Data Protection Act.
• Payment providers: Safaricom (M-Pesa), Airtel Money and banks, to confirm and record payments.
• Delivery partners and drivers: your name, phone number and delivery address, for the delivery only.
• Authorities: the Kenya Revenue Authority, public health and veterinary officers, the Office of the Data Protection Commissioner, courts and law enforcement, where the law requires or a valid order compels us.
• Professional advisers: auditors, lawyers and insurers, under confidentiality.
• Business transfers: a buyer or partner if the business is restructured or sold, with the same protections for your data.

7. Transfers outside Kenya

Some of our providers, including our website host and messaging platforms, store data on servers outside Kenya. Under sections 48 to 50 of the Data Protection Act, we transfer personal data abroad only where the destination has adequate data protection safeguards, where we have put appropriate contractual safeguards in place, or where you have given consent. We keep to any rules the Cabinet Secretary prescribes on data that must be processed in Kenya.

8. How long we keep it

Section 39 of the Data Protection Act says we may keep personal data only as long as the purpose requires. In practice:

• Invoices, payment and tax records: at least five years, as the Tax Procedures Act requires.
• Customer account and order history: for the life of the account and a reasonable period afterwards for disputes and warranty or quality claims.
• Traceability and food safety records: for the period required by food safety and public health rules.
• Contact form messages and enquiries: up to 24 months after the last contact.
• Marketing preferences: until you withdraw consent.

When the period ends we securely delete or anonymise the data.

9. Security and data breaches

We use safeguards suited to the risk, in line with section 41 of the Data Protection Act: access limited to staff who need it, password and device controls, encrypted website connections (HTTPS), supplier checks and staff training.

If a breach is likely to put your rights at risk, we will notify the Data Commissioner within 72 hours of becoming aware of it and tell you without unreasonable delay, as section 43 of the Act requires. No online system is completely secure, so please protect your own phone, passwords and payment details.

10. Your rights

Article 31 of the Constitution and section 26 of the Data Protection Act give you the following rights:

To use a right, email us at info@muthaigameats.com or call 0740 941 112. We may ask you to confirm your identity first. We will respond within 30 days, and requests are free unless they are clearly unfounded or excessive.

11. Cookies

Our website uses cookies, small files stored on your device. Essential cookies keep the site and your session working. Analytics cookies, where used, show us which pages are useful so we can improve them. You can block or delete cookies in your browser settings, but parts of the site may then not work properly. We use non-essential cookies only with your consent.

12. Children

Our products and website are meant for adults and businesses. We do not knowingly collect the data of anyone under 18. Where a child's data is processed, section 33 of the Data Protection Act requires it to be done only with the consent of a parent or guardian, or where it is in the child's best interests. If you believe a child has given us data, contact us and we will delete it.

13. Marketing messages

With your consent we may send offers and product news by WhatsApp, SMS or email. Every message tells you how to stop, or you can tell us directly. Order, payment and delivery messages are not marketing and will continue while you have an active order.

14. Changes and third-party links

We may update this policy when our practices or the law change. The date at the top shows the latest version, and we will give clear notice of significant changes. Our website and social pages may link to other sites, including WhatsApp, Facebook, Instagram, X and TikTok. They have their own privacy policies, and we are not responsible for how they handle your data.