Privacy Policy
Last updated: 3 September 2026
This policy explains what personal data Liora Essence collects when you use lioraessence.co.ke, why we collect it, who we share it with, and the rights you have over it. It is written to comply with the Data Protection Act, 2019 of Kenya.
Who we are
Liora Essence is the data controller for the personal data described in this policy.
Gaberone Street, P.O. Box 50629-00100, Nairobi, Kenya
Phone and WhatsApp: 0116 100 842
What we collect
| Data | Why we hold it |
|---|---|
| Name | To address your order and delivery |
| Mobile phone number | To send the payment prompt, SMS order updates, and to reach you about a delivery |
| Email address | To send order confirmations, invoices and account notices |
| Delivery address | To deliver your order |
| Payment reference | The transaction ID returned by the payment provider, so we can reconcile and trace payments |
| Order history | To operate your account and handle exchange requests |
| Account password | Stored only as a cryptographic hash, never in readable form |
| Technical data | IP address, browser and device type, and pages visited, collected through analytics and security tools |
We never see or store your M-Pesa or Airtel Money PIN. You enter it on your own handset, on your mobile network’s prompt. We receive only confirmation that a payment succeeded or failed, and its reference.
We do not store card numbers. Where card payment is offered, the card is handled entirely by the payment processor.
Why we may lawfully process it
- To perform our contract with you — taking payment, fulfilling and delivering your order, handling exchanges.
- To meet legal obligations — keeping tax and transaction records.
- Our legitimate interests — preventing fraud, securing the site, and understanding how the site is used, balanced against your interests and rights.
- Your consent — for non-essential cookies and for marketing messages, where you have given it. You may withdraw consent at any time.
Who we share it with
We share only what each party needs to do its job:
- KCB Buni — payment processing for M-Pesa and Airtel Money. Receives your phone number and the amount.
- Africa’s Talking — SMS delivery. Receives your phone number and the message text.
- Vumacloud — our hosting provider. Stores the site and its database.
- Google (Analytics 4, Search Console, Merchant Center) — website analytics and product listings.
- StatCounter — secondary website analytics.
- Cloudflare — content delivery and protection against automated abuse.
- Our delivery partners — receive your name, address and phone number to complete delivery.
We do not sell your personal data, and we do not share it for third-party advertising beyond the analytics and listings services named above.
Transfers outside Kenya
Some of the services above process data on servers outside Kenya. Where that happens we rely on the safeguards permitted by Part VI of the Data Protection Act, 2019, and share only the minimum data each service needs.
How long we keep it
- Order and transaction records: seven years, to meet tax and accounting obligations.
- Account details: for as long as your account is open, and 12 months after you ask us to close it.
- Analytics data: as configured in the relevant service, typically 14 months.
- WhatsApp and email correspondence: 24 months.
How we protect it
The site runs over HTTPS with a valid certificate. Passwords are hashed. Administrative access is restricted and protected against brute-force attempts. We keep the platform patched and take regular encrypted backups.
Your rights under the Data Protection Act, 2019
You have the right to:
- Be informed of how your data is used — this policy.
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted, where we have no continuing legal reason to hold it.
- Object to processing based on our legitimate interests.
- Request that we restrict processing while a dispute is resolved.
- Receive your data in a portable format.
- Withdraw consent at any time, where consent is the basis we rely on.
To exercise any of these, contact us on 0116 100 842 or write to the address above. We will respond within the timeframe set by the Act. We may ask you to confirm your identity first, so that we do not disclose your data to someone else.
If you believe we have mishandled your data, you may complain to the Office of the Data Protection Commissioner of Kenya at odpc.go.ke.
Children
This site is not directed at children under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
Changes
If we change this policy we will update the date at the top of this page. Material changes will be notified on the site.