Privacy Policy

1. Introduction

El Mencho Restaurant ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you visit our website elmencho.co.ke or place orders with us.

2. Information We Collect

We collect the following types of information:

3. How We Use Your Information

We use your information to:

• Process and fulfill your food orders
• Process payments securely via M-Pesa
• Create and manage your customer account
• Track and award loyalty points
• Send order confirmations and status updates via email/SMS
• Respond to your inquiries and provide customer support
• Improve our website and services
• Prevent fraud and ensure security of transactions
• Send promotional offers (only with your consent)

4. Legal Basis for Processing

We process your personal data based on:

• Contract Performance: To fulfill your orders and provide services you request
• Legal Obligations: To comply with tax and financial regulations
• Legitimate Interests: To improve our services and prevent fraud
• Consent: For marketing communications (you can opt-out anytime)

5. Data Sharing and Disclosure

We share your information only with:

• Safaricom (M-Pesa): To process payments (we never store your M-Pesa PIN)
• Delivery Partners: To deliver your orders (name, address, phone number)
• Service Providers: For website hosting, analytics, and email delivery
• Legal Authorities: When required by law or to protect our rights

We never sell your personal information to third parties.

6. Data Security

We implement industry-standard security measures to protect your data:

• SSL/TLS encryption for all data transmission
• Secure database storage with encryption
• Regular security audits and updates
• Access controls and authentication for staff
• M-Pesa payments processed directly with Safaricom (PCI compliant)

7. Data Retention

We retain your personal data for as long as necessary to:

• Provide our services and fulfill orders
• Comply with legal and tax obligations (7 years for financial records)
• Resolve disputes and enforce agreements

You may request deletion of your account at any time by contacting us.

8. Your Rights

Under Kenyan and international data protection laws, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we use your data
• Portability: Receive your data in a machine-readable format
• Object: Object to certain data processing
• Withdraw Consent: Opt-out of marketing communications

To exercise these rights, contact us at hello@elmencho.com

9. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us.

10. International Data Transfers

Your information may be transferred to and processed in countries other than Kenya. We ensure appropriate safeguards are in place to protect your data.

11. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.

12. Contact Information

For privacy-related questions or to exercise your rights: