The short version
- When you order on this website we keep your name, your phone number and what you asked for, so we can call you back.
- We don't sell your details, show you ads or track you around the web.
- You can ask us to show, correct or delete what we hold about you.
Who we are
Tunda Pop ice pops are made and sold by ISE Madyani Ltd in Mombasa, Kenya. We decide how the personal data described here is used, which makes us its data controller under Kenya's Data Protection Act, 2019.
What we collect
When you order on this website
Your name, your phone number, the flavours and number of pops you asked for, and when you sent the request. To stop the order form being abused, we also keep your internet (IP) address for one hour to limit how many orders one connection can send.
When you buy from us as a business
For shops, wholesalers and other customers: your business name, contact person, phone numbers, email address, address and county, and the orders, invoices and payments we record for you.
When you sell Tunda Pop as a hawker
Your name, national ID number, phone number and area, and the records of the stock you take, what you return, the cash you hand in and anything you owe.
When you work in our system
For our staff: your name, email address, username and role. Your password is stored only in a scrambled (hashed) form that nobody can read. We keep a log of sign-ins, failed sign-in attempts and important changes, with the time, the internet address and the browser they came from.
Cookies and your browser
We use only the cookies the site needs to work:
- Session cookie: keeps staff signed in.
- Security (CSRF) cookie: protects our forms from being submitted by other websites.
- Theme cookie: remembers whether you chose light or dark.
Some settings are kept in your browser's own storage and never sent to us: your light or dark choice, the last flavour you picked (so we can say "Karibu tena" next time) and, for staff using Easy Mode, the app's settings and any entries saved while offline.
We don't use advertising or analytics cookies. Two outside services are involved:
- The home page loads a typeface from Google Fonts. Like any web request, this tells Google your internet address and browser.
- The melt meter's temperature comes from the Open-Meteo weather service. Our server asks for it, so your device never contacts them and nothing about you is sent.
The WhatsApp button opens WhatsApp, where WhatsApp's own privacy policy applies.
Why we use it
- To answer your order: we call you to confirm the flavours, the price, the day and the place. These are steps you asked us to take before a sale.
- To keep our business records: orders, invoices, payments and hawker accounts, as Kenyan tax and company law requires.
- To run and protect the system: sign-in logs keep accounts safe and let us trace mistakes. This is in our legitimate interest and yours.
We don't use your details for marketing, and we never sell them.
Who sees it
Only ISE Madyani staff who need it for their work, and each person sees only what their role needs. Order requests may also be emailed to our team's own mailbox. Our hosting provider stores the system's data on our behalf and may not use it for anything else. We share personal data with nobody else, unless the law requires it.
How long we keep it
- Website order requests: up to 24 months after we last dealt with you, then deleted.
- Sales, invoice, payment and hawker records: as long as the law requires us to keep business and tax records (currently five years).
- Staff accounts and their logs: while you work with us, and for up to 24 months after.
Your rights
Under the Data Protection Act, 2019 you can:
- be told how your data is used (this page);
- see the personal data we hold about you;
- have anything wrong corrected;
- have it deleted where we no longer need it or the law doesn't require us to keep it;
- object to how we use it.
To ask, contact us using the details below. We may need to check who you are before we act. If you're not happy with our answer, you can complain to the Office of the Data Protection Commissioner.
Keeping it safe
The site only works over an encrypted (HTTPS) connection. Passwords are stored hashed, staff see only what their role allows, and sign-ins, failed attempts and important actions are logged. No system is perfectly secure, but if something goes wrong that puts your data at risk, we'll tell you and the Data Protection Commissioner as the law requires.
Children
The website is meant for adults. Orders for schools and children's parties are placed by grown-ups, and we don't knowingly collect personal data from children.
Changes to this policy
If we change how we use personal data, we'll update this page and the date at the top.