Last updated: January 2026
We collect your name, email address, phone number, delivery address, and M-Pesa transaction data (transaction ID, amount, phone number) when you place an order. We do not store your M-Pesa PIN.
Your data is used exclusively to process your order, send order confirmations and shipping updates, and provide customer support. We do not sell your data to third parties.
Payments are processed via Safaricom Daraja API. We store only the M-Pesa receipt number and transaction reference — not your PIN or full account details. Safaricom's privacy policy also applies to M-Pesa transactions.
Order data is retained for 7 years as required by Kenyan tax law. Account data is retained for as long as your account is active. You may request deletion of your account at any time.
Under Kenya's Data Protection Act, you have the right to access, correct, or delete your personal data. Contact us at hello@heada.co.ke to exercise these rights.
We use only essential session cookies to maintain your cart and authentication state. We do not use tracking or advertising cookies.
Questions about this policy? Email us at hello@heada.co.ke or write to Heada Limited, Nairobi, Kenya.