Last updated: 4 October 2026
4brands Print Solutions Limited ("4brands", "we", "us") prints and brands products in Nairobi and sells them at 4brands.co.ke. This policy explains what personal information we collect, why, who we share it with, how long we keep it, and your rights under the Data Protection Act, 2019 of Kenya.
1. Who is responsible for your information
4brands Print Solutions Limited is the data controller for the information described here.
- Address: Twiga Towers, 6th Floor, Suite 610, Nairobi, Kenya
- Phone: +254 717 643 818
- WhatsApp: 0717 643 818
- Email: info@4brands.co.ke
2. What we collect
When you order (on the website, by phone, on WhatsApp or at our office): your name, phone number and email address; how you want your order delivered and, for deliveries, the location; the M-Pesa transaction code you send us, or the cash or bank payment we record, and the amount; what you ordered and any notes or instructions; and designs, logos or photos you upload for printing.
When you create or use an account: your password, stored in a scrambled (hashed) form that we cannot read. If you sign in with Google, we receive your name, email address and a Google account identifier, never your Google password.
When you ask for a quotation: your name, phone number, email address, and the item, quantity and details you describe.
When you review a product: your star rating, comment and any photos you add. We remove hidden location and camera information from uploaded photos. Reviews show your first name and the first letter of your surname.
On invoices, quotations and receipts: the name, company, KRA PIN, phone, email and address you ask us to put on them.
When you browse the website: two necessary cookies, a session cookie (4brands-session) that keeps your cart and keeps you logged in, and a security cookie (XSRF-TOKEN) that protects forms; both expire after 2 hours without use. If you accept them in our cookie banner, Google Analytics and Google Ads measure visits, and purchases made after seeing an advert; they then set their own cookies (for example _ga) and receive your IP address and information about your browser. If you reject them, or haven't chosen yet, they set no cookies; Google only receives basic, cookie-free signals that a page was viewed. A small cookie (fb4_consent) remembers your choice for 6 months. Our web server also keeps standard technical logs (IP address, pages requested, browser), mainly to keep the site secure.
Staff notes: our team may note things that help serve you, such as "prefers WhatsApp after 5pm".
3. Why we use it
- To make, deliver and support your order, prepare quotations and run your account: to perform our contract with you, or take steps you asked for before one.
- To check payments and keep invoices and receipts: because tax law requires it, and for our contract with you.
- To send order updates, design proofs and password links by email or WhatsApp: for our contract with you.
- To ask once for a review after delivery: our legitimate interest; you can simply ignore it.
- To keep the website secure and prevent fraud and spam: our legitimate interest.
- To measure our website and adverts (Google Analytics, Google Ads): your consent, given in our cookie banner. You can change your choice at any time with "Cookie settings" at the bottom of every page.
We don't sell your personal information, and we don't make decisions about you by automated means alone.
4. Who we share it with
Only where needed for the purposes above:
- Couriers and riders, when you choose delivery: your name, phone number and delivery location.
- Namecheap, our hosting provider, which runs the servers for our website and email.
- Google: Analytics and Ads (browsing information), Google sign-in if you use it, and encrypted backups of our database and files kept in our Google Drive account.
- Cloudflare (Turnstile): a spam check on our quotation form, which sees your browser and IP address.
- Have I Been Pwned: when you choose a password, we check whether it has appeared in a known data breach. Only the first five characters of a scrambled form of the password are sent, never the password itself.
- Safaricom (M-Pesa) and banks, which process your payments under their own privacy terms.
- Authorities, when the law requires it, for example the Kenya Revenue Authority.
Some of these providers keep information outside Kenya. We use established providers and share with each only what it needs.
5. How long we keep it
- Invoices, receipts, payments and the order details on them: at least 5 years after the transaction, as Kenyan tax law requires.
- Your account and the designs you upload: until you ask us to delete them.
- Password links: 1 hour when you ask for one; 7 days for links sent to new customers.
- Security reports: up to 60 days.
- Backups: 30 days.
6. Your rights
Under the Data Protection Act you have the right to be told how your information is used (this policy); to get a copy of the information we hold about you; to have wrong information corrected; to have your information deleted, except what the law requires us to keep, such as invoices; to object to our use of it, or withdraw your consent, for example to analytics cookies; and to get your information in a format you can take elsewhere.
To use these rights, contact us by WhatsApp, phone or email (section 1). We may ask you to confirm it's you before we act, and we will reply as soon as we can, within the time the law sets.
If you're unhappy with how we handle your information, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
7. How we protect it
The whole website runs over an encrypted connection (https). Passwords are stored scrambled. Our team logs in with personal accounts and a code from their phone (two-factor login), and each person only sees what their role needs. Changes to payments, prices and customer details are recorded. Uploaded designs are kept private, not on the public website, and backups are encrypted and kept away from the website's server. No system is perfectly secure; if a breach puts your information at risk, we will tell you and the Data Protection Commissioner as the law requires.
8. Children
Our website and services are meant for adults and businesses. We don't knowingly collect information from children under 18.
9. Changes to this policy
We'll update this page when how we use information changes, and change the date at the top. For important changes we will tell account holders by email.