Loading the shop…
Last updated 16 September 2026
Privacy Policy
What we collect when you buy from us, why we need it, who else sees it, and how to get it back or get it deleted. Written to be read, not to be survived.
We sell shoes
Not data. We have never sold or rented a customer list.
No tracking
No advertising pixels, no analytics, no cookies on this site.
Yours on request
Ask and we send you a copy, correct it, or delete it.
eCAD Collections (2nd floor, Shop 813, Horizon Business Centre, Ronald Ngala Street, Nairobi, Kenya) is the data controller for the personal information described here. This notice covers ecadcollections.com — our online shop. Buying at the counter in person is covered by the same practices.
It is written under Kenya's Data Protection Act, 2019. If anything below is unclear, write to info@ecadcollections.com and a person will answer it.
What we collect, and why
When you place an order
- Your name — so the rider knows who to hand the parcel to.
- Your phone number — to confirm the order, to reach you on delivery day, and because it is what the M-Pesa receipt is tied to.
- Your delivery address — only if you asked for delivery. If you chose to collect from the shop, we do not ask for one.
- Your email address — required, because it is where we send your receipt. Also used for written follow-up on an exchange.
- What you ordered, and any note you added — the pair, the size, the price you paid, and any landmark or instruction you gave the rider.
We need this to perform the contract you entered when you bought a pair. Without the name, number and address there is no way to deliver anything.
When you pay
M-Pesa payments are processed by Kopo Kopo on Safaricom's M-Pesa network. Your PIN is entered on your own phone, on Safaricom's prompt. We never see it, and it never touches this website. What reaches us is the confirmation: the amount, the time, the transaction reference and the paying number.
When you contact us
The contact form asks for your name, email, phone number, the topic, an order number if you have one, and your message. We keep the enquiry so that whoever picks it up can see what you already told us, instead of asking you to repeat it, and it is emailed to the desk that handles it so that someone sees it rather than it waiting to be noticed. Messaging us on WhatsApp puts that conversation on WhatsApp's infrastructure, under their terms rather than ours.
What stays on your own device
This site sets no cookies. Three things are stored in your browser and are never transmitted to us:
ecad-cart— the pairs and sizes in your basket, so it survives a refresh.ecad-theme— whether you chose the light or dark view.ecad-last-order— your most recent order reference, so the confirmation page can show it. Cleared when you close the tab.
Clearing your browser data removes all three. Nothing is lost that we hold on our side.
What we do not do
- No advertising or analytics trackers. No Meta pixel, no Google Analytics, no TikTok pixel, nothing that follows you to other sites.
- No selling, renting or sharing for marketing. Not to advertisers, not to other shops, not to anyone.
- No automated decisions or profiling that affect you. A person handles every order and every exchange.
- No marketing messages you did not ask for. We contact you about your order. That is all.
Who else handles it
Only where it is necessary to get your shoes to you and to keep the shop running. Each is bound to use it only for that purpose.
- Kopo Kopo and Safaricom — to take and confirm M-Pesa payment.
- Our delivery riders — your name, phone number and address. Nothing else, and only for that delivery.
- Our email provider — to deliver a contact-form enquiry to the shop desk that answers it. That email carries what you wrote and the name, email address and phone number you gave with it, and is addressed so that a reply reaches you.
- Vercel, Cloudflare and DigitalOcean — hosting, content delivery and the database. They keep short-lived technical logs, which include IP addresses, as every web server does. These are for security and fault diagnosis, not for tracking you.
Some of these providers run servers outside Kenya, so your information may be processed abroad. Where that happens it is under the safeguards those providers are contractually bound to, as the Act requires.
We will also disclose information where the law requires it — a court order, a tax audit, or a lawful request from an authority entitled to it.
How long we keep it
- Order and payment records — seven years. Not our choice: Kenyan tax law requires business records to be kept, and an order is a business record.
- Contact enquiries — two years from the last message, so an exchange dispute can be checked against what was actually agreed.
- Technical logs — a matter of days, on our providers' own schedules.
After that it is deleted. If you ask us to delete something we are legally required to retain, we will tell you which part we must keep and why, and delete the rest.
Your rights
Under the Data Protection Act, 2019, you may ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong or out of date;
- delete it, where we are not required to keep it;
- stop using it for a particular purpose;
- hand it to you in a portable format.
Write to info@ecadcollections.com with enough detail to find your records — the phone number you ordered with is usually enough. We answer within seven days and complete the request within thirty. There is no charge.
We may ask you to confirm who you are first. That is not obstruction — handing someone's order history to a stranger who knows their phone number would be the actual failure.
If you are not satisfied with how we handled it, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke). We would rather you told us first so we can put it right.
Keeping it safe
The site and the shop system are served over HTTPS. Access to customer records is limited to staff who need it for their job, each with their own sign-in, and every change to an order or to stock is recorded against the person who made it. Payment card and M-Pesa credentials never reach our systems.
No system is perfect. If a breach ever affects your personal information, we will notify you and the Data Commissioner as the Act requires.
Children
This shop is meant for adults. We do not knowingly collect information from anyone under 18. If you believe a child has given us their details, tell us and we will remove them.
Changes to this notice
If we change how we handle your information, we update this page and move the date at the top. This version is dated 16 September 2026. Material changes affecting existing customers will be told to you directly, not slipped in here quietly.
Contact
eCAD Collections
2nd floor, Shop 813, Horizon Business Centre, Ronald Ngala Street
Nairobi, Kenya
info@ecadcollections.com
+254 717 619 235
Shop hours are Mon–Sat · 8:30AM – 7:00PM. For anything about an order you have already placed, support@ecadcollections.com reaches the same people faster.
Prefer a copy for your records? Download this policy as a PDF. See also our exchange policy and delivery terms.