1. Introduction

Nordic Beverages Limited (“Nordic Beverages”, “we”, “us”, or “our”) operates the Happy Hour E-commerce Platform (the “Platform”), an online marketplace for the sale and delivery of alcoholic beverages and related products within Kenya.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data belonging to visitors, registered users, and customers of the Platform (“you” or “your”), in accordance with the Data Protection Act, 2019 (the “DPA”), the Data Protection (General) Regulations, 2021, and other applicable laws of Kenya, as well as internationally recognised data protection practices adopted by leading e-commerce platforms.

By creating an account, browsing the Platform, placing an order, or otherwise submitting personal data to us, you acknowledge that you have read and understood this Privacy Policy and agree to the processing of your data. If you do not agree with this Privacy Policy, please do not use the Platform.

2. Who We Are

For the purposes of the DPA, Nordic Beverages is the “data controller” and/or “data processor” responsible for your personal data.

3. Age Restriction and Eligibility to Purchase

Alcoholic beverages may only be sold to, and purchased by, persons who are 18 years of age or older, in accordance with the Alcoholic Drinks Control Act, 2010 and related county liquor licensing regulations. By registering an account or placing an order, you confirm that you are at least 18 years old.

• Registration-stage verification: we require you to confirm that you are 18 years and above and, where applicable, provide a national identity document or passport number to verify eligibility before you can complete a purchase.
• Delivery-stage verification: our delivery riders or courier partners may be required to request a valid identification document from the recipient at the point of delivery, and may refuse delivery where age cannot be confirmed.

We do not knowingly offer the Platform to, or collect personal data from, individuals under 18 years of age.

4. Information We Collect

We collect the following categories of personal data:

(a) Identity and account information

• Full name, age, phone number, email address.

(b) Order and transaction information

• Products purchased, order value and history, delivery address, delivery instructions, order status, returns and complaints.

(c) Payment information

• Mobile money details (e.g., M-Pesa phone number and transaction reference), card payment details, billing address, and transaction confirmations. Card and mobile money credentials are processed by our PCI-DSS-compliant payment service providers; we do not store full card numbers or mobile money PINs on our systems.

(d) Delivery and location information

• Delivery address, and, where you grant permission through the Platform, real-time or approximate device location used to facilitate delivery and estimate delivery times.

(e) Device and usage information

• IP address, device identifiers, browser type and version, operating system, referring/exit pages, clickstream data, and other diagnostic and log data collected automatically when you use the Platform.

(g) Communications and support information

• Records of customer support enquiries, complaints, product reviews and ratings, and survey responses.

(h) Marketing preferences

• Your choices regarding receipt of promotional emails, SMS, WhatsApp messages, or push notifications.

5. How We Collect Your Information

• Directly from you: when you register an account, complete checkout, contact customer support, respond to surveys, or otherwise interact with the Platform.
• Automatically: through cookies, analytics tools, and server logs when you use the Platform.

6. How We Use Your Information

We use personal data for the following purposes:

1. To create, maintain, and secure your account;
2. To process, fulfil, and deliver your orders, including coordinating with third-party delivery and courier partners;
3. To process payments through mobile money operators, card processors, and payment gateways;
4. To provide customer support and respond to enquiries, complaints, and returns;
5. To send transactional communications, such as order confirmations, delivery updates, and account notifications;
6. Where you have provided consent, to send marketing communications about promotions, discounts, and new products;
7. To personalise your shopping experience, including product recommendations, based on your browsing and purchase history;
8. To maintain, test, and improve the Platform, including through aggregated analytics; and
9. To enable you to participate in promotions, competitions, and surveys.

7. Legal Basis for Processing

We process personal data on one or more of the following legal bases:

• Consent: for example, for marketing communications, optional cookies, and certain data sharing with marketing or advertising partners. You may withdraw your consent at any time, including by clicking the “unsubscribe” link at the bottom of any marketing email we send you.
• Performance of a contract: to process and deliver the orders you place with us, including using your contact details and payment information to fulfil and deliver your order.
• Our legitimate business interests: where necessary for us to understand our customers, and operate and improve the Platform, provided this does not unduly affect your privacy and other rights.
• Compliance with a legal obligation: where we are required to process personal data to comply with an obligation under Kenyan law.

8. Cookies and Similar Technologies

We and our service providers use cookies, pixels, SDKs, and similar tracking technologies to operate and improve the Platform, including:

• Strictly necessary cookies, required for core functions such as login and checkout;
• Performance and analytics cookies, used to understand how users interact with the Platform;
• Functional cookies, used to remember your preferences; and
• Advertising and targeting cookies, used to deliver relevant promotions, subject to your consent.

You can manage or disable cookies through your browser or device settings, and through the cookie preference banner presented on the Platform. Disabling certain cookies may affect the functionality of the Platform.

9. Marketing Communications

Where you have opted in, we may send you marketing communications by email, SMS, WhatsApp, or push notification. You may withdraw consent at any time by:

• Clicking the “unsubscribe” link included in marketing emails; or
• Replying “STOP” to marketing SMS messages.
• Writing to the email above requesting withdrawal. 

10. Sharing and Disclosure of your Information

We do not sell your personal data. We may share personal data with the following categories of recipients, only as necessary for the purposes described in this Policy:

• Payment service providers: mobile money operators and licensed payment gateways/processors to process and confirm payments.
• Delivery and logistics partners: third-party courier companies and independent riders, who receive your name, phone number, and delivery address as necessary to fulfil your order.
• Regulators and public authorities: where required by law, court order, or to establish, exercise, or defend legal claims.

When we share your personal data with third parties, we require them to agree to protect your data in accordance with this Policy and applicable law, and we only permit them to process your personal data for the specified purposes and in accordance with our instructions. We do not allow our third-party service providers to use your personal data for their own independent purposes.

11. Data Retention

We take every reasonable step to ensure that your personal data is processed for the minimum period necessary for the purposes set out in this Policy. Your personal data may be retained in a form that allows for identification for as long as:

• we maintain an ongoing relationship with you, so that we can provide the Platform to you and ensure you receive communications you have requested; or
• your personal data is necessary in connection with the purposes set out in this Policy and we have a valid legal basis for retaining it.

We actively review the personal data we hold and delete it securely, or in some cases anonymise it, when there is no longer a legal, business, or customer need for it to be retained.

12. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encryption of data in transit and at rest, access controls, staff confidentiality obligations and training, engagement of PCI-DSS-compliant payment partners, and periodic security testing.

We limit access to your personal data to those with a genuine business need to know it, and your personal data may only be processed on our instructions, subject to a duty of confidentiality.

13. Your Rights under the Data Protection Act, 2019

Please keep us informed if your personal data changes while you hold an account with us. Subject to applicable exceptions, you have the right to:

• Be informed of the use to which your personal data is to be put;
• Access your personal data held by us;
• Request correction or rectification of inaccurate or outdated personal data;
• Request erasure of your personal data, subject to any legal retention requirements;
• Request restriction of processing in certain circumstances;
• Receive your personal data in a structured, commonly used, and machine-readable format (data portability);
• Object to processing based on legitimate interests, or to direct marketing at any time; and
• Not be subject to a decision based solely on automated processing that significantly affects you, without human review.

To exercise any of these rights, please contact us using the details above. We may need to verify your identity before processing your request, and we will respond within 21 days of receipt, extendable by a further 21 days where reasonably necessary, with notice to you.

14. Children’s Privacy

The Platform is not directed at, and must not be used by, individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a person under 18, we will take reasonable steps to delete that data without undue delay.

15. Call Centre, USSD, and Recorded Communications

Where you contact our customer care team by phone, WhatsApp, USSD, or live chat, we may collect your phone number, the content of your enquiry, and, where applicable, a recording or transcript of the call for quality assurance, staff training, dispute resolution purposes. Recorded calls are retained for 30 days unless required for longer to resolve an ongoing dispute or complaint.

16. Loyalty, Rewards, and Referral Programmes

If you enroll in any loyalty, rewards, discount-voucher, or referral programme we may offer (for example, earning points on purchases or referring a friend for a discount code), we will collect additional information such as your points balance, redemption history, referral code usage, and the identity of referred users to the extent necessary to administer the programme and prevent abuse. Participation is optional, and you may withdraw at any time; withdrawal may result in forfeiture of unredeemed points or vouchers in accordance with the programme terms.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. We will post the updated version on the Platform.

19. Governing Law

This Privacy Policy is governed by, and shall be construed in accordance with, the laws of the Republic of Kenya, including the Data Protection Act, 2019, and its subsidiary regulations. Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Kenya.

20. Related Practices and Information

This Privacy Policy should be read together with the following related documents:

• Terms and Conditions and User Generated Content Policy