Privacy Policy

UKEN ("UKEN", "we", "us", "our") is a marketplace connecting Kenyan artisans with buyers in the United Kingdom and beyond. We operate from Osmaston 10, NG7 1SD, Nottingham, United Kingdom, and from Nairobi Garage, Karen — Watermark Business Park, Ndege Rd, Off Langata Rd, Nairobi, Kenya. This Privacy Policy explains how we collect, use, share, and protect personal data when you use ukena.co.uk and related services.

For any privacy-related question, request, or complaint, contact our data team by phone on +44 7425 241649 (UK) or +254 720 848 695 (Kenya).

We only collect what we need to run the marketplace. The forms on this site collect the following data:

Account registration (Sign up / Sign in)

• Full name
• Email address
• Password (stored hashed; never visible to us)

Checkout & delivery

• Full name, email, phone number
• Delivery address (lines, city, country, postal code)
• Order contents and order history
• Payment is processed by Stripe on Stripe-hosted pages — we do not see or store your card number, CVC, or full card details.

Contact form

• Name, email, role (UK Buyer, Kenyan Producer, Press, Other) and message

Newsletter

• Email address (only used to send the monthly letter)

Artisan / Creator application

• Full name, email, craft details, and uploaded workshop photos

Creator profile (for approved makers)

• Portrait and workshop images, biography, story, product listings, payout details

Automatic data

• Device, browser, IP address, pages viewed, and referrer (via server logs and analytics)
• Cart contents stored locally in your browser so your bag survives a refresh

• To create and manage your account — performance of a contract with you.
• To process orders, payments, and delivery — performance of a contract; legal obligation (tax, accounting).
• To reply to enquiries through the contact form — legitimate interest in responding to messages addressed to us.
• To send the newsletter — your consent, which you can withdraw at any time using the unsubscribe link or by emailing us.
• To assess artisan applications and host creator profiles — performance of a contract and legitimate interest in maintaining a curated marketplace.
• To detect fraud, secure the platform, and meet legal duties — legitimate interest and legal obligation.
• To improve the site through aggregated analytics — legitimate interest, balanced against your right to object.

We never sell your data. We share it only with the service providers we rely on to operate UKEN:

• Stripe — payment processing. Card data is collected directly by Stripe on their hosted checkout.
• Cloudinary — hosting and delivery of images uploaded by creators (portraits, workshop photos, product shots).
• Hosting and infrastructure providers — to serve the website and store the database.
• Couriers and logistics partners — to deliver your order; they receive your name, address, phone, and email.
• Approved creators — receive the first name and delivery town of buyers of their pieces for fulfilment context.
• Authorities — where required by Kenyan, UK, or other applicable law.

We use the following categories of cookies and local storage:

• Strictly necessary — authentication token (ukena_token), CSRF protection, and the shopping cart. The site cannot work without these.
• Functional — remembering your delivery details between checkout steps, preferred currency, and recently viewed items.
• Analytics — anonymised page-view and performance data so we can see which pages help buyers find makers. Set only with your consent where required.
• Marketing — not currently used on this site. If we introduce them, we will update this policy and request consent first.

• Account data — for as long as your account is open, plus 12 months.
• Order, payment, and tax records — 7 years, to meet tax law.
• Contact form messages — up to 24 months after the last reply.
• Newsletter subscriptions — until you unsubscribe.
• Creator applications and profiles — for the lifetime of the relationship, plus 24 months.
• Server and security logs — up to 12 months.

As a data subject, you have the right to:

• Be informed of the use to which your personal data is being put;
• Access your personal data held by us;
• Object to the processing of all or part of your personal data;
• Correct false or misleading data;
• Have false or misleading data deleted;
• Request that your data be transferred to you or another controller (data portability).

To exercise any of these rights, call Andrew Soi on +44 7425 241649 (UK) or Edwin Agasa on +254 720 848 695 (Kenya) and quote "Data request". We will respond within 30 days. If you are not satisfied, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, at www.odpc.go.ke.

UKEN is in the process of registering as a Data Controller and Data Processor with the Office of the Data Protection Commissioner of Kenya, in line with the Data Protection Act, 2019 and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

Because UKEN operates between Kenya and the United Kingdom, your data may be transferred between the two jurisdictions and to the service providers listed above. We rely on adequacy decisions, standard contractual clauses, or your explicit consent for such transfers, as required by Kenyan law.

We use HTTPS, hashed passwords, access controls, and reputable infrastructure providers to protect your data. No method is ever 100% secure — if a breach affects your data, we will notify the ODPC and you in line with the law.

We may update this Privacy Policy from time to time. The "last updated" date above will always reflect the current version.