Privacy Policy
Last Updated: September 2026
1. Introduction
Cepine Juj4 (“we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, share, retain, and protect personal information when you visit https://juj4.cepine.com, create an account, make a purchase, or otherwise interact with us.
This policy complies with the Kenyan Data Protection Act, 2019, and, where applicable, the EU General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act (CCPA/CPRA), and other applicable privacy laws.
domain2. Data Controller
The data controller responsible for your personal data is:
- Name: Cepine Juj4 (JUJ4)
- Physical Address: Juja, Kiambu, Kenya
- Email: support@juj4.cepine.com
- Phone: +254 754 866 279
- Data Protection Inquiries: support@juj4.cepine.com
dataset3. Personal Data We Collect
We may collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity Data | Full name, username, date of birth. |
| Contact Data | Email address, phone number, delivery address, billing address. |
| Account Data | Username, encrypted password, account preferences, wishlist items. |
| Transaction Data | Order history, products purchased, refunds, invoice amounts. |
| Payment Data | Payment method, transaction IDs, billing address. (Full credit/debit card numbers and CVVs are processed by certified gateways and never stored on our servers). |
| Technical Data | IP address, browser type, operating system, device identifiers, time zone. |
| Usage Data | Pages visited, search queries, cart interactions, referring URLs. |
| Marketing Data | Newsletter preferences, survey answers, promotional responses. |
| Customer Service Data | Support emails, chat messages, inquiries, complaints. |
download4. How We Collect Personal Data
- Directly from you: when you register, place an order, contact support, subscribe to updates, or complete a form.
- Automatically: through cookies, server logs, web beacons, and performance monitoring technologies.
- From third parties: payment processors (e.g., M-Pesa, card networks), delivery partners, and fraud prevention tools where lawful.
balance5. Legal Bases for Processing
Under the Kenya Data Protection Act and international privacy frameworks, we process personal data under:
- Consent: for optional marketing communications and non-essential cookies.
- Contract: to process and fulfil orders, facilitate delivery, manage your account, and provide support.
- Legal Obligation: for tax accounting (eTIMS), anti-fraud measures, and statutory compliance.
- Legitimate Interest: for website security, analytics, service enhancement, and abuse prevention.
settings_suggest6. Purposes of Processing
- Create and manage user accounts;
- Process, fulfill, dispatch, and track orders;
- Facilitate secure payments and refunds;
- Issue electronic tax invoices through KRA eTIMS;
- Communicate order status, tracking updates, and customer support responses;
- Send marketing communications where you have explicitly opted in;
- Personalise your shopping experience;
- Improve website functionality, security, and performance;
- Detect, prevent, and mitigate fraud and unauthorized activity.
7. Cookies and Tracking Technologies
We use cookies and similar technologies for:
- Strictly Necessary: maintaining your active session, authentication, and shopping cart persistence.
- Analytics & Performance: aggregate metrics and traffic insights to enhance site speed and usability.
- Preferences: remembering your display preferences, region, and recent views.
You can control or disable cookies via your browser settings. Disabling essential cookies may impact checkout functionality.
share8. Sharing of Personal Data
We do not sell your personal data. We may share data with trusted third parties under strict confidentiality and processing agreements:
- Payment Processors: (e.g. M-Pesa, card gateways) to securely process checkout transactions.
- Delivery & Logistics Providers: public and third-party carriers to deliver physical shipments.
- Hosting & Cloud Infrastructure: (e.g. Cloudflare, Firebase/Google Cloud) for reliable hosting and database storage.
- Professional Advisers & Regulators: accountants, auditors, legal counsel, and government agencies where mandated by law.
public9. International Data Transfers
Your data may be processed on servers hosted by global cloud providers (such as Cloudflare and Google Cloud). Where data transfers occur outside Kenya, we ensure appropriate safeguards are maintained in compliance with the Kenyan Data Protection Act and international standards, including Standard Contractual Clauses (SCCs) and rigorous technical security standards.
10. Data Security
We employ robust technical and organizational security measures, including SSL/TLS encryption in transit, hashed credentials, least-privilege administrative access, and regular vulnerability scanning. While we strive to maintain top-tier protection, no online transmission or storage method is completely infallible.
history_toggle_off11. Data Retention
We retain personal data only as long as necessary for the purposes outlined:
- Account & Transaction Data: Retained for 6 years or as required by applicable tax and commercial record-keeping laws.
- Marketing Records: Retained until you opt-out or withdraw consent.
- Support Logs: Retained for 1 to 3 years after inquiry resolution.
12. Your Rights under the Kenyan Data Protection Act
Under the Kenyan Data Protection Act, 2019, you have the right to:
- Be informed of how your personal data is collected and used;
- Access the personal data we hold about you;
- Request rectification of inaccurate, outdated, or incomplete data;
- Request erasure or deletion of data no longer necessary;
- Object to data processing, including direct marketing;
- Request restriction of processing in specific circumstances;
- Data portability (receive your personal data in a structured format);
- Withdraw consent at any time where processing was consent-based.
To exercise your rights, contact us at support@juj4.cepine.com. We respond within 30 days as required by law.
13. Additional International Rights (GDPR / UK GDPR / CCPA)
Residents of the EEA, UK, and California are entitled to statutory protections including the right to erasure (“right to be forgotten”), right to lodge complaints with supervisory authorities, and California rights to know, delete, and opt out of cross-context behavioral marketing. Contact support@juj4.cepine.com to submit inquiries.
campaign14. Marketing Communications
We only send marketing emails or SMS if you have opted in. You can unsubscribe anytime by clicking the “Unsubscribe” link in emails or by contacting support. Unsubscribing does not affect crucial transactional notices regarding your orders or account security.
child_care15. Children's Privacy
Our platform is not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has submitted personal information, please contact us immediately for prompt deletion.
smart_toy16. Automated Decision-Making & Profiling
We do not make decisions solely on automated processing or profiling that produce legal or similarly significant effects on users without human review.
crisis_alert17. Data Breach Notification
In the unlikely event of a security breach that risks the rights and freedoms of individuals, we will notify affected individuals and the Office of the Data Protection Commissioner (ODPC) in Kenya without undue delay as mandated by law.
report18. Complaints & Supervisory Authority
If you have questions or complaints regarding data privacy, please contact us first at support@juj4.cepine.com.
You also have the right to lodge a complaint with the regulatory authority:
Office of the Data Protection Commissioner, Kenya (ODPC)
Website: https://www.odpc.go.ke
Email: info@odpc.go.ke / complaints@odpc.go.ke
Address: Britam Tower, 12th & 13th Floor, Hospital Road, Upper Hill, P.O. Box 30920-00100, Nairobi, Kenya
update19. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect evolving practices or regulatory requirements. The latest version will always be published on this page with the updated date.
By using JUJ4, you acknowledge and agree to this Privacy Policy.