Privacy Policy

1. Who we are

Shiriaka Aromatherapy Limited is the data controller for this site. Address: P.O. Box 1993-00100, Nairobi, Kenya. For any privacy question or request, email hello@rianaturals.com.

2. What we collect

• ·Identity and contact: name, phone number, email address.
• ·Orders: products bought, order history, delivery address and instructions, returns and complaints.
• ·Payments: payment method, transaction references and confirmations. Card and M-Pesa payments are handled by our payment provider; we never see or store full card numbers or M-Pesa PINs.
• ·Account: login details and preferences, if you create an account.
• ·Device and usage: IP address, browser, device type, pages visited and similar technical data.
• ·Communications: messages with our team (by email, WhatsApp, Instagram or Facebook Messenger), reviews, quiz answers and survey responses.
• ·Marketing choices: whether you have agreed to hear from us by email, SMS or WhatsApp.

3. How we collect it

Directly from you (checkout, account sign-up, contact forms, reviews, quiz, and messages you send us on Instagram, Facebook Messenger or WhatsApp) and automatically when you browse the site (cookies, analytics and server logs). When you message us on Instagram or Messenger, Meta shares your message and your public profile name with us.

4. How we use it

• ·To process, deliver and support your orders, including sharing delivery details with our riders and couriers.
• ·To take payment and prevent fraud.
• ·To send order confirmations and delivery updates.
• ·To answer questions and handle returns and complaints. On Instagram and Facebook Messenger, an AI assistant may draft or send replies to common questions (prices, delivery, opening hours, how to use a product); orders, payments, complaints and anything else are answered by our team.
• ·To send offers and news, only if you have agreed.
• ·To suggest products (for example from the skin quiz) and improve the site.
• ·To run promotions, competitions and surveys you choose to join.
• ·To meet our legal, tax and accounting obligations.

5. Our legal grounds

We rely on: performing our contract with you (orders and delivery); your consent (marketing, optional cookies), which you can withdraw at any time; our legitimate interests in running and improving the business; and compliance with Kenyan law.

6. Cookies

• ·Strictly necessary: keep your cart and checkout working.
• ·Analytics: help us understand how the site is used.
• ·Functional: remember your preferences.
• ·Advertising: measure and personalise our ads, only with your consent.

You can control cookies in your browser settings. Blocking some cookies may stop parts of the site working.

7. Marketing messages

We only send marketing if you opt in. You can stop at any time using the unsubscribe link in an email, by replying STOP to an SMS, or by emailing us.

8. Who we share it with

We never sell your personal data. We share only what is needed with:

• ·payment providers, to take payment;
• ·riders and courier partners, who receive your name, phone number and delivery address;
• ·service providers who host the site, manage our product catalogue and content, send our emails, and provide the AI that drafts message replies, under contracts that require them to protect your data. Some of them store data outside Kenya, with safeguards as required by the Data Protection Act;
• ·Meta (Instagram and Facebook), which delivers the messages you send us on those platforms;
• ·authorities or regulators, where the law requires it or to establish or defend legal claims.

9. How long we keep it

Only as long as needed: generally while you are a customer, and afterwards for as long as the law requires (for example tax records). We then delete or anonymise it. Call and chat recordings, if any, are kept for 30 days unless needed for a dispute.

10. Security

We use encryption in transit, access controls and trusted, PCI-DSS compliant payment partners. Only staff who need your data to do their job can access it.

11. Your rights

Under the Data Protection Act, 2019 you can ask to:

• ·be told how your data is used;
• ·get a copy of your data;
• ·correct data that is wrong;
• ·have your data deleted, unless we must keep it by law;
• ·restrict or object to how we use it, including for direct marketing;
• ·receive your data in a portable format;
• ·not be subject to decisions made only by automated means.

12. Making a request

Email hello@rianaturals.com. We may ask you to confirm your identity. We reply within 21 days, or tell you if we need up to 21 more days. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

To delete your data, including copies of Instagram or Facebook Messenger conversations we hold, email hello@rianaturals.com with the subject "Delete my data" and your Instagram username or Facebook name. We delete it within 21 days and confirm by email. Messages stay in your own Instagram or Messenger inbox until you delete them there.

13. Children

This site is not aimed at children under 18. If we learn we have collected a child’s data without a parent’s consent, we delete it.

14. Changes and governing law

We post any updates on this page. This policy is governed by Kenyan law. See also our Terms & Conditions and User Content Policy.