Privacy Policy

Werezi Books (“Werezi”, “we”, “us” or “our”) respects your privacy. This notice explains how we collect, use, share, retain and protect personal data when you use our website, buy books, request a quote, contact support, use an AI-assisted feature, or opt in to marketing.

1. Personal data we collect

Depending on how you use Werezi, we may collect:

• Account and identity data: name, email address, phone number, account credentials and customer number.
• Order and delivery data: books ordered, billing and delivery details, county, collection information, order history, returns and customer-support records.
• Payment data: payment status, transaction references and limited payment metadata. M-PESA and card providers process payment credentials; Werezi does not store complete card numbers.
• Quote, contact and marketing data: quote requests, contact messages, newsletter choices, WhatsApp number, consent source and consent or opt-out history.
• Device and usage data: IP address and ordinary server logs, browser/device information, cookie choices, an anonymous browser identifier, viewed books or categories, cart activity and engagement duration.
• Assistant data: questions submitted to reading or support assistants, the book involved, generated answers, citations and whether support escalation was suggested. Please do not enter passwords, complete payment details, health information or other sensitive data into an assistant.

We generally collect data directly from you, your browser, or your interactions with the storefront. We may receive payment confirmation from payment providers and delivery status from fulfilment partners.

2. Why we use personal data and our legal bases

Information marked as required at checkout is needed to complete and deliver your order. If it is not provided, we may be unable to fulfil the order. Optional analytics and marketing consent are not required to shop.

3. How we share personal data

We do not sell personal data. We disclose only what is reasonably necessary to:

• M-PESA, card processors and financial institutions for payment and fraud prevention;
• couriers, collection locations and fulfilment partners for delivery and returns;
• hosting, security, communications, email and technical-service providers that operate the storefront;
• Google’s Gemini service when an enabled AI-assisted reading or support feature processes a submitted question;
• Meta and WhatsApp service providers when you opt in to WhatsApp messages or contact us through WhatsApp;
• professional advisers, regulators, courts or law-enforcement bodies where legally required or necessary to protect legal rights.

Service providers may use data only for the contracted service and must protect it appropriately.

4. International transfers

Some technology providers, including Google and Meta, may process data outside Kenya. Where personal data is transferred internationally, Werezi will use a lawful transfer basis and appropriate contractual, technical and organisational safeguards required by Kenyan law. Contact us if you would like information about the safeguard applicable to a particular transfer.

5. Cookies and similar storage

Essential cookies support security, sign-in, sessions, carts and your cookie choice. They are required for the storefront to work and do not depend on optional analytics consent.

Optional analytics and personalisation remain off unless you select “Allow all”. If enabled, Werezi creates an anonymous browser identifier and records commerce interactions to understand storefront use and improve recommendations. The identifier rotates after approximately 180 days.

Your cookie choice is remembered for up to 12 months. You can withdraw or change it at any time using Cookie settings in the footer. Withdrawing consent stops future optional tracking and removes the optional identifier from that browser; it does not make earlier consent-based processing unlawful.

Review cookie settings

6. Marketing choices

We send promotional email or WhatsApp messages only where the required consent has been recorded. You may use an unsubscribe link, reply STOP to a supported WhatsApp marketing conversation, or contact us to withdraw consent. You will still receive necessary order, payment, delivery and service communications.

7. Retention

We retain data only for as long as needed for the relevant purpose, legal obligations, dispute resolution and security. Our retention schedule uses the following general periods, subject to a longer period where law or an active dispute requires it:

• Accounts: while active and normally up to 24 months after closure.
• Orders, invoices and payment records: for the applicable statutory accounting and tax-record period.
• Quotes, ordinary support records and assistant conversations: normally up to 12 months after the last interaction.
• Optional commerce events: normally up to 12 months; the browser identifier rotates after approximately 180 days.
• Marketing preferences and consent evidence: while the preference remains active and for a reasonable compliance period after withdrawal.
• Security logs: for the period reasonably necessary to investigate and prevent abuse.

At the end of the applicable period, data is deleted, anonymised or securely archived where continued legal retention is required.

8. Security and personal-data breaches

We use proportionate technical and organisational measures intended to protect confidentiality, integrity and availability, including access controls, staff permissions, secure transmission, application validation, backups, logging and service-provider controls. No internet service can guarantee absolute security. Where a personal-data breach creates a real risk of harm, Werezi will notify the Office of the Data Protection Commissioner and affected people as required by law.

9. Your rights

Subject to Kenyan law, you may:

• be informed about how your personal data is used;
• request access to personal data held about you;
• object to or request restriction of particular processing;
• request correction of inaccurate, outdated, incomplete or misleading data;
• request deletion where Werezi is no longer authorised or required to retain the data;
• withdraw consent for optional analytics or marketing at any time;
• request portable data where the statutory conditions apply; and
• request human review where a decision with significant effects is made solely through automated processing.

Send a request to [email protected] or call +254 799 626 359. Describe the right you wish to exercise. We may request proportionate information to verify your identity and will respond within the timelines required by law. Rights may be limited where Werezi must retain or process data for a legal obligation, legal claim, fraud prevention or another lawful exception.

You may also complain to Kenya’s Office of the Data Protection Commissioner (ODPC).

10. Children

The online purchasing service is intended for adults. A child should not create an account, place an order, opt in to marketing or submit personal data without involvement and consent from a parent or guardian. If you believe a child has provided personal data without appropriate authority, contact us so that we can investigate and take appropriate action.

11. Changes to this notice

We may update this notice when our services, providers or legal obligations change. We will publish the revised effective date and, where a change materially affects your choices, provide an additional notice or request fresh consent where required.

12. Contact us

For privacy questions or requests, email [email protected], call +254 799 626 359, or write to Werezi Books, 804A, Malik Heights, Ngong Rd. Opp Greenhouse.