DR.DULLU
Privacy Policy
Last updated: 7 June 2026
We collect only what we need, we don't sell it, and you can remove yourself at any time. This policy is governed by the Kenya Data Protection Act, 2019.
1. Who Is Responsible
DR.DULLU / Dullu Digital, Kilifi, Kenya.
Contact: shop@dullugroup.co.ke
2. What We Collect
- —Email address — when you register, download a free product, or make a purchase.
- —Full name — provided at registration or checkout.
- —Phone number — optionally, for WhatsApp notifications. Never required.
- —Payment data — M-Pesa transactions are processed by Safaricom. PayPal transactions are processed by PayPal. We store only the transaction ID and confirmation status — never your M-Pesa PIN or payment card details.
- —Download history — which products you have accessed, stored in your account dashboard.
- —Onboarding answers — your business persona and primary pain point, used to personalise your dashboard.
3. Legal Basis for Processing
Under DPA Section 26, we process your data on the following legal bases:
| Data | Legal Basis |
|---|---|
| Email (transactional) | Contract performance — needed to deliver your purchase or download |
| Email (marketing digest) | Consent — collected separately at registration or checkout |
| Phone / WhatsApp | Consent — explicitly opt-in, skippable at any point |
| Purchase records | Legal obligation — KRA 7-year retention requirement |
| Download history | Legitimate interest — powering your personal dashboard |
| Onboarding answers | Legitimate interest — personalising content and recommendations |
4. How We Use It
- —To deliver your purchases and free downloads.
- —To send transactional emails (order confirmation, download link, password reset).
- —To send the weekly DR.DULLU digest — only if you have opted in.
- —To send WhatsApp notifications about new content and events — only if you have provided your number and consented.
- —To maintain your personal dashboard of downloads and member content.
5. What We Don't Do
- —We do not sell your data to anyone.
- —We do not share your email with third-party advertisers.
- —We do not use advertising or behavioural tracking cookies. The PayPal payment SDK, loaded during checkout, may set its own cookies — these are governed by PayPal's privacy policy.
6. Cookies
We use one strictly necessary cookie:
- —Session cookie — an HttpOnly, Secure, SameSite=Lax JWT token that keeps you logged in for up to 30 days. It is set only when you sign in and is deleted when you log out. No advertising or analytics cookies are used by this site.
During checkout, the PayPal payment SDK is loaded and may set cookies under PayPal's own policy. You can disable cookies in your browser but this will prevent you from signing in to your account.
7. Third-Party Services
We use the following services to operate the platform. Each acts as a data processor under our instruction:
- —Supabase — member database (accounts, content, subscriptions) and file storage (downloadable PDFs). Hosted on AWS.
- —Cloudflare — site hosting, CDN, and commerce processing. All order records, payment confirmations, download tokens, and transaction data are stored in Cloudflare D1 (SQLite) and processed by a Cloudflare Worker.
- —Safaricom M-Pesa — M-Pesa payment processing. Safaricom processes payment data independently under its own privacy policy.
- —PayPal — international payment processing. PayPal receives customer name, email, and transaction value during PayPal checkout. PayPal processes this data under its own privacy policy.
- —Resend — transactional and marketing email delivery.
8. Cross-Border Data Transfers
Personal data processed by Supabase (AWS), Cloudflare, PayPal, and Resend may be transferred to and stored outside Kenya. Such transfers are made under standard contractual clauses or equivalent safeguards consistent with DPA Section 48. We maintain Data Processing Agreements with each processor.
9. Data Retention
- —Account data is retained for as long as your account is active.
- —Purchase and transaction records are kept for 7 years as required by Kenyan tax law.
- —Marketing consent records are kept for the duration of the consent plus 3 years.
- —You can request deletion of your account and non-transactional data at any time.
10. Data Breach Notification
In the event of a personal data breach, we will notify the Office of the Data Protection Commissioner (ODPC) and affected data subjects as required under DPA Section 43 and the Computer Misuse and Cybercrimes Act, 2018 — in the most expedient time possible and without unreasonable delay.
11. Your Rights
Under the Kenya Data Protection Act, 2019, you have the following rights:
- —Right to be informed — to know what data we hold and how we use it (this policy).
- —Right of access — to request a copy of your personal data. Email us.
- —Right to rectification — to correct inaccurate or incomplete personal data. Email us.
- —Right to erasure — to delete your account and non-transactional data. Email us.
- —Right to object — to object to processing based on legitimate interest. Email us.
- —Right to data portability — to receive your data in a structured, machine-readable format. Email us.
- —Right to withdraw consent — unsubscribe from marketing at any time via the link in any email, or by emailing us.
- —Right to lodge a complaint — if you believe we have not handled your data lawfully, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.
12. Governing Law
This policy is governed by the Kenya Data Protection Act, 2019.
13. Contact
For any data-related request or question, email shop@dullugroup.co.ke.