Privacy Policy

PicassoCare ("we", "us", "our") is a Kenyan retail group headquartered at Kaka House, Muthaiga Close, Westlands, Nairobi, operating the Picasso Glow, Picasso Afya, Picasso Noir, and Picasso Byte collections under one commercial entity.

This Privacy Policy explains how PicassoCare, acting as a Data Controller under the Kenya Data Protection Act, 2019 ("DPA"), processes personal data of visitors and customers.

Account data (name, email, phone, delivery address), order data (items, prices, invoices), payment metadata (Paystack / M-Pesa reference numbers — never full card numbers), device and browsing data (IP address, cookies, session), and support interactions (chat transcripts, tickets).

We process personal data on the bases permitted by section 30 of the DPA: performance of a contract (fulfilling your order), compliance with a legal obligation (tax, pharmaceutical records), our legitimate interests (fraud prevention, service improvement), and your consent (marketing communications).

We share data with processors acting on our instructions: payment providers (Paystack, Safaricom M-Pesa), delivery partners, cloud hosting, and analytics. We do not sell personal data. We disclose data to authorities only when legally required.

Where data is transferred outside Kenya, we apply the safeguards required under Part VI of the DPA.

We retain personal data for as long as your account is active and for the periods required by Kenyan tax and pharmaceutical regulations, after which the data is deleted or anonymised.

Under Part V of the DPA you have the right to be informed, to access, to correct, to erase, to object, and to restrict processing. To exercise a right, email dpo@picassocare.co.ke. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

We apply technical and organisational measures including encryption in transit, encrypted storage of integration credentials, role-based access control, and audit logging.

Data Protection Officer: dpo@picassocare.co.ke.