Legal

Privacy Policy

Last updated: 1 October 2026

Your stories, names and memories are what make each book personal. This policy explains what information we collect, why we collect it, how we look after it, and the rights you have over it. We only collect what we need to make and deliver your book.

1. Who we are

Inked & Given is a creative imprint operated by Amara Experiences, based in Kenya. Amara Experiences is the data controller for personal data collected through this website, and is responsible for it under the Kenya Data Protection Act, 2019.

2. What data we collect

Contact details: your name, email address and phone number.
Order details: the book you choose, gift and bouquet choices, budget, preferred date and delivery town/area.
Personalisation details: the recipient's name, relationship, age range, occasion, themes, colours and instructions you give us, plus any photos or memories you choose to send by email or WhatsApp after ordering.
Payment information: the amount, payment method (M-Pesa, card, cash or bank), payment reference and status. Card numbers and M-Pesa PINs are entered directly with our licensed payment processor, Paystack — we never see or store them.
Messages: anything you send through our contact form, email or WhatsApp.
Technical and usage data: basic device, browser and visit information collected through cookies and similar tools — see our Cookie Policy.

Please only share details about another person (such as a gift recipient) when you have a good reason to believe they would be comfortable with it. We do not knowingly collect data from children; orders must be placed by adults.

3. How we use your data

To design, draw, produce and deliver your personalised book and gifts.
To confirm your order, send invoices, take payment and send receipts.
To reply to your questions and keep you updated about your order.
To prevent fraud, payment abuse and misuse of our website.
To understand how our site is used so we can improve it.
To send occasional news or offers — only if you have agreed, and you can opt out at any time.
To meet our legal, tax and accounting obligations.

We rely on these legal bases: performing our contract with you, your consent, our legitimate interests (such as security and improving our service), and compliance with the law.

4. We do not sell your data

We never sell, rent or trade your personal data to data brokers, advertisers or anyone else. We do not use your stories, photos or personal details for our own personal gain, and we do not publish your artwork, photos or reviews without your permission.

5. Who we share it with

We share only what is necessary, with trusted categories of service providers who process it on our behalf and under confidentiality and data-protection obligations. The specific companies we use may change over time; every provider we work with falls into one of these groups:

Payment processors and mobile-money operators — to process M-Pesa, card and other payments securely.
Email and messaging providers — to send order emails, invoices, receipts and replies, and to talk with you on channels you choose (such as WhatsApp).
Hosting, database, storage and security providers — to run this website, store records and files securely, back them up and protect the site from attacks.
Analytics and error-monitoring providers — to understand how the site is used and fix problems, using grouped or limited technical data.
Delivery and courier partners — only your name, phone number, town or area, and order number, and only when we arrange delivery. Couriers never receive your photos or personal stories.
Professional advisers and authorities — accountants, lawyers or government bodies, only when needed or required by Kenyan law, or to protect against fraud.

You can ask us at any time for the current list of providers we use. Some providers may store data outside Kenya; where this happens, we make sure appropriate safeguards are in place as required by the Data Protection Act.

6. How we store and protect it

Data is stored in a secured database with strict access rules; the public cannot read customer records.
All traffic to our site is encrypted (HTTPS).
Our admin area is private, protected by a password, an emailed one-time code and device-locked sessions.
Payment links are unique, signed and expire; payment attempts are rate-limited and logged.
Only the studio owner has access to your information.

No system is perfectly secure, but if a breach affecting your data ever occurred, we would notify you and the Office of the Data Protection Commissioner as required by law.

Photos you upload. Photos are accepted only as JPG, PNG or WebP images. Before storage we automatically remove hidden details such as camera information and GPS location, and reject files that are not genuine images. Each customer's files are stored in a private, access-controlled folder separated by order, reached only through a private, expiring link or by our studio staff.

7. How long we keep it

We keep order and payment records for as long as needed to fulfil your order and meet tax and accounting rules (generally up to 7 years). Personal photos and memories you send are kept only while your book is being made and for a short time afterwards in case of reprints, then deleted on request or within 12 months. Contact messages are kept for up to 2 years.

If we decline your order. When we decline an order, all photos, memories and reference files you shared for it are permanently deleted from our storage at the time we decline it, and in any case within 14 days. We keep only the minimum order and payment record (name, contact details, reference and any refund) needed for accounting and legal obligations, for the retention periods above.

8. Your rights

Under the Kenya Data Protection Act, 2019 you have the right to:

Be told how your data is used (this policy).
Access the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Ask us to delete data we no longer need, or that was processed unlawfully.
Object to, or withdraw consent for, marketing and other processing.
Request a copy of your data in a portable format.
Complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

9. Laws that apply

We handle personal data in line with the Constitution of Kenya, 2010 (Article 31, right to privacy), the Data Protection Act, 2019 and its Regulations, the Computer Misuse and Cybercrimes Act, 2018, and the Consumer Protection Act, 2012.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will change, and significant changes will be highlighted on the site.

Contact us

Inked & Given is a creative imprint operated by Amara Experiences, Kenya. For any question or request about this document, email admin@inkedgiven.shop or call / WhatsApp +254 759 731309.