Privacy policy

• Orders: your name, email, phone number and delivery address, and what you bought.
• Accounts: your name, email, phone and a securely hashed password (we can't see your password).
• Payments: handled by Paystack. Card and M-Pesa details go straight to Paystack and never reach our servers; we only receive a payment confirmation.
• Messages, reviews and commission ideas you send us, including any photos you upload.
• Email preferences: if you subscribe, your email, the topics you chose, when and where you agreed, and which of our emails you clicked.

• To process, deliver and support your orders, and to send receipts.
• To answer your messages and quote commissions.
• Marketing emails only if you say yes. We send gift ideas, new arrivals and offers only to people who tick the box (and, for sign-ups on the website, confirm by email). If you subscribed, we may also send a welcome series, a reminder about an unpaid order, and a request to review an order.
• To keep the site secure and prevent fraud.

Every marketing email has an unsubscribe link, and you can change your choice any time under Account → Settings. Order receipts and updates still arrive, because they're part of your purchase.

We use a small number of cookies, all needed for the site to work:

• A secure sign-in cookie that keeps you logged in and lets you pay for your order.
• If you arrive from one of our emails, a cookie for 7 days that tells us which email helped, so we can send fewer, better emails.

Your cart, wishlist and currency choice are saved in your own browser. We don't use advertising or third-party tracking cookies.

Only the services that help us run the shop: Paystack (payments), our email provider (to deliver emails), our hosting and database providers, file storage for uploaded photos, and delivery partners (your name, phone and address, to deliver your order). We don't sell or rent your data.

Order records are kept as long as the law requires for accounting. If you unsubscribe, we keep a note of your email so we don't email you again. You can ask us to delete your account or marketing data at any time.

You can ask to see, correct or delete the personal data we hold about you, or object to how we use it. Email us at info@tommysgiftshop.com or use our contact page, and we'll respond promptly. You can also complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.